IIS5 intermittent crash

External Since: Aug 18, 2004 Posts: 6

Hi there,

I posted my problem a couple of weeks ago, and Pat kindly gave me a couple
of pointers, but the problem still remains, and I can't locate the thread,
so I thought I'd post again fresh.

I've got a win2k web server handling around 30 websites, and it's been
running fine for about a year. However, over the last few weeks, IIS has
been regularly crashing; first once every couple of weeks, to now where it
crashes about 3 or 4 times a day. When it crashes, the server has the
following pop-ups:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 18/08/2004
Time: 15:40:58
User: N/A
Computer: REMOTE1
Description:
Application popup: inetinfo.exe - Application Error : The instruction at
"0x01ed123f" referenced memory at "0x04659000". The memory could not be
"written".

Click on OK to terminate the program
Click on CANCEL to debug the program
___________________________________________________________________________

Often followed by:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 18/08/2004
Time: 16:23:49
User: N/A
Computer: REMOTE1
Description:
Application popup: inetinfo.exe - Application Error : The instruction at
"0x77fcc2c0" referenced memory at "0x3d646965". The memory could not be
"written".

Click on OK to terminate the program
Click on CANCEL to debug the program
___________________________________________________________________________

Then:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 18/08/2004
Time: 16:50:19
User: N/A
Computer: REMOTE1
Description:
The IIS Admin Service service terminated unexpectedly. It has done this 49
time(s). The following corrective action will be taken in 0 milliseconds:
No action.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 18/08/2004
Time: 16:50:19
User: N/A
Computer: REMOTE1
Description:
The FTP Publishing Service service terminated unexpectedly. It has done
this 47 time(s). The following corrective action will be taken in 0
milliseconds: No action.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 18/08/2004
Time: 16:50:19
User: N/A
Computer: REMOTE1
Description:
The World Wide Web Publishing Service service terminated unexpectedly. It
has done this 48 time(s). The following corrective action will be taken in
0 milliseconds: No action.

___________________________________________________________

I've been getting various iisState logs, and - more recently - ADPlus logs
too, which I've put here if you're able to have a look at them:

http://www.remote.uk.com/iiscrashlogs/

I've also used MS Crash/hang Agent & IIS dump to try to work out what
websites are setting off the problem, but can't find any pattern at all to
it; different languages, and using different combinations of the ISAPI
filters. The logs are at the URL above as well.

ISAPI filters

Pat analysed my last lot of iisState logs, and concluded that there might be
a problem with the ISAPI filters. I've got the following installed:

httpZip - http://www.port80software.com/products/httpzip/
ASPSpiderBait -
http://www.webanalyst.com.au/index.cfm?objectId=6BE0C0C1-0A09-049D-C85...B24AD6B
URL Rewrite - http://www.smalig.com/url_rewrite-en.htm
Flicks Webquota/Authentix - http://www.flicks.com/prod.htm#webq

I've had Authentix running for 3 years without any problems, although I did
upgrade to the latest version yesterday, just in case there's a conflict
with .NET, which we're building our sites in now.
ASP Spiderbait's been on for quite a while too, with no problems that I can
remember.
httpZip and URL Rewrite are relatively new additions, but software vendors
of both components insist that they haven't had anyone else report the same
problem as the one I'm describing. A;so, I'm not able to recreate the
problem on my local test servers, so I'd say maybe something's having a
problem with high traffic on various sites, but saying that, I'm getting
crashes at 3 or 4 in the morning, so I can see how it could be a high
traffic problem...

So I'm stuck! Would someone please look over the logs in the URL provided,
and compare the data so that I can get some kind of solution to this; It's
been going on for so long now I'm at the end of my tether!

Many, many thanks,

Paul McGillivray

External Since: Aug 24, 2003 Posts: 1478

The link below didn't work. Can you post the IISState logs?

pat

"Paul McGillivray" <paul.TakeThisOut@remote.uk.com> wrote in message
news:cg0fqr$ftn$1@titan.btinternet.com...
> Hi there,
>
> I posted my problem a couple of weeks ago, and Pat kindly gave me a couple
> of pointers, but the problem still remains, and I can't locate the thread,
> so I thought I'd post again fresh.
>
> I've got a win2k web server handling around 30 websites, and it's been
> running fine for about a year. However, over the last few weeks, IIS has
> been regularly crashing; first once every couple of weeks, to now where it
> crashes about 3 or 4 times a day. When it crashes, the server has the
> following pop-ups:
>
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 18/08/2004
> Time: 15:40:58
> User: N/A
> Computer: REMOTE1
> Description:
> Application popup: inetinfo.exe - Application Error : The instruction at
> "0x01ed123f" referenced memory at "0x04659000". The memory could not be
> "written".
>
> Click on OK to terminate the program
> Click on CANCEL to debug the program
> ___________________________________________________________________________
>
> Often followed by:
>
> Event Type: Information
> Event Source: Application Popup
> Event Category: None
> Event ID: 26
> Date: 18/08/2004
> Time: 16:23:49
> User: N/A
> Computer: REMOTE1
> Description:
> Application popup: inetinfo.exe - Application Error : The instruction at
> "0x77fcc2c0" referenced memory at "0x3d646965". The memory could not be
> "written".
>
> Click on OK to terminate the program
> Click on CANCEL to debug the program
> ___________________________________________________________________________
>
> Then:
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7031
> Date: 18/08/2004
> Time: 16:50:19
> User: N/A
> Computer: REMOTE1
> Description:
> The IIS Admin Service service terminated unexpectedly. It has done this
> 49
> time(s). The following corrective action will be taken in 0 milliseconds:
> No action.
>
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7031
> Date: 18/08/2004
> Time: 16:50:19
> User: N/A
> Computer: REMOTE1
> Description:
> The FTP Publishing Service service terminated unexpectedly. It has done
> this 47 time(s). The following corrective action will be taken in 0
> milliseconds: No action.
>
>
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7031
> Date: 18/08/2004
> Time: 16:50:19
> User: N/A
> Computer: REMOTE1
> Description:
> The World Wide Web Publishing Service service terminated unexpectedly. It
> has done this 48 time(s). The following corrective action will be taken
> in
> 0 milliseconds: No action.
>
> ___________________________________________________________
>
> I've been getting various iisState logs, and - more recently - ADPlus logs
> too, which I've put here if you're able to have a look at them:
>
 > <a style='text-decoration: underline;' href="http://www.remote.uk.com/iiscrashlogs/</font" target="_blank">http://www.remote.uk.com/iiscrashlogs/</font</a>>
>
> I've also used MS Crash/hang Agent & IIS dump to try to work out what
> websites are setting off the problem, but can't find any pattern at all to
> it; different languages, and using different combinations of the ISAPI
> filters. The logs are at the URL above as well.
>
>
> ISAPI filters
>
> Pat analysed my last lot of iisState logs, and concluded that there might
> be
> a problem with the ISAPI filters. I've got the following installed:
>
 > httpZip - <a style='text-decoration: underline;' href="http://www.port80software.com/products/httpzip/</font" target="_blank">http://www.port80software.com/products/httpzip/</font</a>>
> ASPSpiderBait -
 > <a style='text-decoration: underline;' href="http://www.webanalyst.com.au/index.cfm?objectId=6BE0C0C1-0A09-049D-C85D7BB24AD6B366</font" target="_blank">http://www.webanalyst.com.au/index.cfm?objectId=6BE0C0C1-0A09-049D-C85...B24AD6B</a>>
 > URL Rewrite - <a style='text-decoration: underline;' href="http://www.smalig.com/url_rewrite-en.htm</font" target="_blank">http://www.smalig.com/url_rewrite-en.htm</font</a>>
 > Flicks Webquota/Authentix - <a style='text-decoration: underline;' href="http://www.flicks.com/prod.htm#webq</font" target="_blank">http://www.flicks.com/prod.htm#webq</font</a>>
>
> I've had Authentix running for 3 years without any problems, although I
> did
> upgrade to the latest version yesterday, just in case there's a conflict
> with .NET, which we're building our sites in now.
> ASP Spiderbait's been on for quite a while too, with no problems that I
> can
> remember.
> httpZip and URL Rewrite are relatively new additions, but software vendors
> of both components insist that they haven't had anyone else report the
> same
> problem as the one I'm describing. A;so, I'm not able to recreate the
> problem on my local test servers, so I'd say maybe something's having a
> problem with high traffic on various sites, but saying that, I'm getting
> crashes at 3 or 4 in the morning, so I can see how it could be a high
> traffic problem...
>
> So I'm stuck! Would someone please look over the logs in the URL provided,
> and compare the data so that I can get some kind of solution to this; It's
> been going on for so long now I'm at the end of my tether!
>
> Many, many thanks,
>
> Paul McGillivray
>
>
>
>
>
>
>
>
>
>
>
>