Ok, I installed WinDbg, set the Symbol Search path to
set
_NT_SYMBOL_PATH=srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
and loaded the dmp file, I choose the second_chance_exception file from the
initial debug diagnostic monitoring as that’s the one that said an access
violation exception was thrown.
I ran the statement and here’s the output, however it did say that my
debugger is not using the correct symbols so does this make the output
invalid?
Here is the output…
FAULTING_IP:
ntdll!wcslen+1d6
7c82a754 8b09 mov ecx,dword ptr [ecx]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 7c82a754 (ntdll!wcslen+0x000001d6)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 00000000
Attempt to read from address 00000000
DEFAULT_BUCKET_ID: WRONG_SYMBOLS
PROCESS_NAME: w3wp.exe
MODULE_NAME: iisutil
FAULTING_MODULE: 7c800000 ntdll
DEBUG_FLR_IMAGE_TIMESTAMP: 45d70a58
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced
memory at "0x%08lx". The memory could not be "%s".
READ_ADDRESS: 00000000
BUGCHECK_STR: ACCESS_VIOLATION
MANAGED_STACK: !dumpstack -EE
OS Thread Id: 0x1e38 (0)
Current frame:
ChildEBP RetAddr Caller,Callee
LAST_CONTROL_TRANSFER: from 7c82a82b to 7c82a754
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
0006fb14 7c82a82b 012b0048 00000000 0006fbdc ntdll!wcslen+0x1d6
0006fbfc 6470f012 00700000 00000000 01537080 ntdll!wcslen+0x2ad
0006fc18 647115a2 01537080 0006fc4c 6471882e
iisutil!CDataCache<CDateTime>::_SetSequence+0x22
0006fc24 6471882e 01537080 00647430 00647418
iisutil!CLKRLinearHashTable::_FreeSegment+0x20
0006fc4c 64718961 00000000 00000001 00647418
iisutil!CLKRLinearHashTable::_Clear+0xd8
0006fc68 647189c2 00000001 0006fc90 647189e5
iisutil!CLKRLinearHashTable::~CLKRLinearHashTable+0x19
0006fc74 647189e5 00647418 00000000 0026bb28
iisutil!CLKRHashTable::_FreeSubTable+0x13
0006fc90 5a403439 00000001 00264ed8 5a4038f8
iisutil!CLKRHashTable::~CLKRHashTable+0x18
0006fcb4 5a3bc347 00000000 01001418 010013e4
w3cache!OBJECT_CACHE::OBJECT_CACHE+0x3ab
0006ff0c 0100187c 00000005 00263a70 00000000 w3core!UlW3Start+0x280
0006ff44 01001a27 00000005 00263a70 00264378 w3wp+0x187c
0006ffc0 77e6f23b 00000000 00000000 7ffdd000 w3wp+0x1a27
0006fff0 00000000 010018f8 00000000 78746341
kernel32!ProcessIdToSessionId+0x209
STACK_COMMAND: ~0s; .ecxr ; kb
FAULTING_THREAD: 00001e38
FOLLOWUP_IP:
iisutil!CDataCache<CDateTime>::_SetSequence+22
6470f012 8d4638 lea eax,[esi+38h]
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: iisutil!CDataCache<CDateTime>::_SetSequence+22
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: iisutil.dll
BUCKET_ID: WRONG_SYMBOLS
FAILURE_BUCKET_ID: iisutil.dll!base_address_c0000005_WRONG_SYMBOLS
Followup: MachineOwner
"Pat [MSFT]" wrote:
> The easiest way to look at them is to use WinDBG and open them one at a
> time. If you type !analyze -v <enter> at the prompt, it will dump out the
> stack for you.
>
>
> Pat
>
> "Rob" <Rob DeleteThis @discussions.microsoft.com> wrote in message
> news:AE77D3D6-AB32-4456-B7B5-DE9CFA477F0A@microsoft.com...
> > Thanks for your help so far Pat
> >
> > I got another crash this morning (no event log entries though?) when this
> > happened I ran IISDump.exe and it generated 6 dmp files, I ran these
> > through
> > Debug Diagnostics and tried to post the output, which I can't as it's to
> > long. This confirms I’m missing something so...
> >
> > I've got 6 dmp file with the following name
> >
> > Hang--8120_w3wp_SharePoint_-_ssp.abbeylegal.com.dmp
> > Hang--7636_w3wp_DefaultAppPool.dmp
> > Hang--6636_w3wp_SharePoint_Central_Administration_v3.dmp
> > Hang--7240_inetinfo.dmp
> > Hang--7328_svchost.dmp
> > Hang--5208_dllhost_System_Application.dmp
> >
> > how do I find the failing thread stacks from the dump files?
> >
> >
> > "Pat [MSFT]" wrote:
> >
> >> Can you post the failing thread stacks from the dump files?
> >>
> >> Pat
> >> "Rob" <Rob DeleteThis @discussions.microsoft.com> wrote in message
> >> news:EA0CE9D6-E979-4375-A65F-C644AF36F8F2@microsoft.com...
> >> >i set this up to run and it's generated some dump files, even though the
> >> > error hasn't occured in the event log. I analyze these is Debug
> >> > Diagnostic
> >> > but it doesn't report anything. Is IISDump.exe still running?
> >> >
> >> >
> >> >
> >> > "Pat [MSFT]" wrote:
> >> >
> >> >> You are hitting a memory corruption issue. Basically, some dll stomps
> >> >> on
> >> >> the memory and leaves it trashed, which is at some later time touched
> >> >> and
> >> >> a
> >> >> crash ensues. If you enable PageHeap on the process, it will force a
> >> >> crash
> >> >> at the time of corruption & you can identify the culprit.
> >> >>
> >> >>
> >> >> Pat
> >> >>
> >> >> "Rob" <Rob DeleteThis @discussions.microsoft.com> wrote in message
> >> >> news:CE071B32-9290-4089-9088-83E76187497F@microsoft.com...
> >> >> > excellent, thank you hB
> >> >> >
> >> >> > I installed and ran the analysis on my dump file and this is the
> >> >> > result
> >> >> >
> >> >> > Error In
> >> >> > inetinfo__PID__1520__Date__10_12_2007__Time_06_12_42AM__781__Second_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlpWaitOnCriticalSection+df in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to write to memory
> >> >> > location
> >> >> > 0x00000014 on thread 21
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >
> >> >> > Error In
> >> >> > w3wp__PID__7744__Date__10_12_2007__Time_01_05_25AM__296__Second_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlpCoalesceFreeBlocks+36e in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to read from memory
> >> >> > location
> >> >> > 0x00000000 on thread 0
> >> >> >
> >> >> > Heap corruption was detected in heap 0x00700000, however pageheap
> >> >> > was
> >> >> > not
> >> >> > enabled in this dump. Please follow the instructions in the
> >> >> > recommendation
> >> >> > section for troubleshooting heap corruption issues.
> >> >> >
> >> >> > Current NTGlobalFlags value: 0x0 An access violation exception
> >> >> > thrown
> >> >> > by a
> >> >> > heap memory manager function indicates heap corruption. Please
> >> >> > follow
> >> >> > the
> >> >> > steps outlined in the following Knowledge Base article:
> >> >> >
> >> >> > 300966 Howto debug heap corruption issues in Internet Information
> >> >> > Services
> >> >> > (IIS)
> >> >> > Error In
> >> >> > dllhost__PID__7356__Date__10_12_2007__Time_01_05_41AM__796__Second_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlFindCharInUnicodeString+3d in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to write to memory
> >> >> > location
> >> >> > 0x009b0ffc on thread 2
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >
> >> >> > Error In
> >> >> > w3wp__PID__7140__Date__10_11_2007__Time_06_57_59PM__406__Second_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at ntdll!RtlEnterCriticalSection+31 in
> >> >> > C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused
> >> >> > an
> >> >> > access
> >> >> > violation exception (0xC0000005) when trying to read from memory
> >> >> > location
> >> >> > 0x00000024 on thread 16
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\system32\ntdll.dll
> >> >> >
> >> >> > Error In
> >> >> > w3wp__PID__7484__Date__10_11_2007__Time_09_30_00PM__984__Second_Chance_Exception_C0000005.dmp
> >> >> > the assembly instruction at mscorwks!SVR::gc_heap::plan_phase+529 in
> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll from
> >> >> > Microsoft
> >> >> > Corporation has caused an access violation exception (0xC0000005)
> >> >> > when
> >> >> > trying
> >> >> > to read from memory location 0x00000000 on thread 22
> >> >> > Please follow up with the vendor Microsoft Corporation for
> >> >> > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
> >> >> >
> >> >> > i'm following the KB on the heap corruption entry, anyone offer any
> >> >> > thoughts
> >> >> > or opinions?
> >> >> >
> >> >> >
> >> >> > "hB" wrote:
> >> >> >
> >> >> >> Check with DebugDiag.
> >> >> >>
> >> >> >> Debug Diagnostic Tool v1.1
> >> >> >> The Debug Diagnostic Tool (DebugDiag) is designed to assist in
> >> >> >> troubleshooting issues such as hangs, slow performance, memory
> >> >> >> leaks
> >> >> >> or fragmentation, and crashes in any Win32 user-mode process. The
> >> >> >> tool
> >> >> >> includes additional debugging scripts focused on Internet
> >> >> >> Information
> >> >> >> Services (IIS) applications, web data access components, COM+ and
> >> >> >> related Microsoft technologies.
> >> >> >> http://www.microsoft.com/downloads/details.aspx?FamilyID=28BD5941-C458...F1-B24D
> >> >> >>
> >> >> >> ---
> >> >> >> hB
> >> >> >>
> >> >> >>
> >> >>
> >>
> >> Stay informed about: w3wp.exe crash - reading dmp file 
FAQ
Search
Profile
Private Messages
Log in/Register/Password
