From: mma on
Hi all,

I have a .Net 2.0 Web Application running on server 2003.
sometimes it crashes, probalbly somewhere inside a soap call with the
following error message in the application log of the event viewer.

"Source NET Runtime 2.0 Error Reporting

Faulting application w3wp.exe, version 6.0.3790.1830, stamp 42435be1,
faulting module kernel32.dll, version 5.2.3790.1830, stamp 424377d2,
debug? 0, fault address 0x00015dea."


Any ideas on how to proceed tracking this error? should i use iisstate?


thanks in advance
Markus

From: Pat [MSFT] on
You can try IISState - make sure to have a dump created so that you can fall
back to WinDBG w/out needing to repro the issue:

iisstate -p <pid of w3wp.exe> -sc -d <enter>


Pat

<mma(a)cas.com> wrote in message
news:1132581343.125158.276100(a)g43g2000cwa.googlegroups.com...
> Hi all,
>
> I have a .Net 2.0 Web Application running on server 2003.
> sometimes it crashes, probalbly somewhere inside a soap call with the
> following error message in the application log of the event viewer.
>
> "Source NET Runtime 2.0 Error Reporting
>
> Faulting application w3wp.exe, version 6.0.3790.1830, stamp 42435be1,
> faulting module kernel32.dll, version 5.2.3790.1830, stamp 424377d2,
> debug? 0, fault address 0x00015dea."
>
>
> Any ideas on how to proceed tracking this error? should i use iisstate?
>
>
> thanks in advance
> Markus
>


From: mma on
Pat,

follwing your advice, i get the following dmp(see below)

any ideas how to proceed with this?

thanks,
Markus

***********************
Starting new log output
IISState version 3.3.1

Tue Nov 22 14:34:11 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 20844

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
DLL (!FunctionName) that failed:




Thread ID: 18
System Thread ID: 4bc4
Kernel Time: 0:0:0.328
User Time: 0:0:0.328
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00 01a7ec8c 053646a4 0x5364e2f
01 01a7ecd0 05364594 0x53646a4
02 01a7ed00 0536262e 0x5364594
03 01a7ee1c 053620f7 0x536262e
04 00000000 00000000 0x53620f7
Closing open log file C:\iisstate\output\IISState-20844.log
Opened log file 'C:\iisstate\output\IISState-20844.log'

***********************
Starting new log output
IISState version 3.3.1


Pat [MSFT] schrieb:

> You can try IISState - make sure to have a dump created so that you can fall
> back to WinDBG w/out needing to repro the issue:
>
> iisstate -p <pid of w3wp.exe> -sc -d <enter>
>
>
> Pat
>
> <mma(a)cas.com> wrote in message
> news:1132581343.125158.276100(a)g43g2000cwa.googlegroups.com...
> > Hi all,
> >
> > I have a .Net 2.0 Web Application running on server 2003.
> > sometimes it crashes, probalbly somewhere inside a soap call with the
> > following error message in the application log of the event viewer.
> >
> > "Source NET Runtime 2.0 Error Reporting
> >
> > Faulting application w3wp.exe, version 6.0.3790.1830, stamp 42435be1,
> > faulting module kernel32.dll, version 5.2.3790.1830, stamp 424377d2,
> > debug? 0, fault address 0x00015dea."
> >
> >
> > Any ideas on how to proceed tracking this error? should i use iisstate?
> >
> >
> > thanks in advance
> > Markus
> >

From: mma on
sorry, but I've attached an incomplete log.
here is a more telling and longer version

thanks,
Markus


Opened log file 'C:\iisstate\output\IISState-21036.log'

***********************
Starting new log output
IISState version 3.3.1

Tue Nov 22 14:56:30 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 21036

Note: Thread times are formatted as HH:MM:SS.ms

***********************


IIS has crashed...
Beginning Analysis
DLL (!FunctionName) that failed:




Thread ID: 15
System Thread ID: 4f74
Kernel Time: 0:0:0.453
User Time: 0:0:2.375
*** WARNING: Unable to verify checksum for
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\433ef18ee3f5cc49af7883a7efb7c02c\System.Web.ni.dll
*** ERROR: Module load completed but symbols could not be loaded for
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\433ef18ee3f5cc49af7883a7efb7c02c\System.Web.ni.dll
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00 019bef90 04da46b4 0x4da4e3f
01 019befd4 059602cd 0x4da46b4
02 019bf048 0572ed63 0x59602cd
03 019bf080 04da1c29 0x572ed63
04 019bf368 689c31c4 0x4da1c29
05 019bf398 687cad0d System_Web_ni+0x4031c4
06 00000000 00000000 System_Web_ni+0x20ad0d
Closing open log file C:\iisstate\output\IISState-21036.log
Opened log file 'C:\iisstate\output\IISState-21036.log'

***********************
Starting new log output
IISState version 3.3.1

Tue Nov 22 14:56:30 2005

OS = Windows 2003 Server
Executable: w3wp.exe
PID = 21036

Note: Thread times are formatted as HH:MM:SS.ms

***********************




Thread ID: 0
System Thread ID: 51dc
Kernel Time: 0:0:0.15
User Time: 0:0:0.46
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\WINDOWS\system32\ntdll.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\WINDOWS\system32\kernel32.dll -
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for c:\windows\system32\inetsrv\w3dt.dll -
*** ERROR: Module load completed but symbols could not be loaded for
c:\windows\system32\inetsrv\w3wp.exe
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0006fc7c 77e6ba12 ntdll!KiFastSystemCallRet
01 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=+0x1b31
03 0006ff44 01001a23 w3wp+0x187c
04 0006ffc0 77e523cd w3wp+0x1a23
05 0006fff0 00000000 kernel32!IsProcessorFeaturePresent+0x9e




Thread ID: 1
System Thread ID: 4d9c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0096ff48 7c80e933 ntdll!KiFastSystemCallRet
01 0096ffb8 77e66063
ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus+0x282
02 0096ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 2
System Thread ID: 51b8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 009affb8 77e66063 ntdll!KiFastSystemCallRet
01 009affec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 3
System Thread ID: 45a4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 009effb8 77e66063 ntdll!KiFastSystemCallRet
01 009effec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 4
System Thread ID: 57b8
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\WINDOWS\system32\RPCRT4.dll -
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\WINDOWS\system32\ole32.dll -
OLE32.dll Symbols not found. Unable to proceed with DCOM check.
Continuing other analysis.

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00a6ff84 77c5778f ntdll!KiFastSystemCallRet
01 00a6ff8c 77c5f7dd RPCRT4!NdrOleFree+0x3c5
02 00a6ffac 77c5de88 RPCRT4!I_RpcTransGetThreadEvent+0x188
03 00a6ffb8 77e66063 RPCRT4!I_RpcLogEvent+0xe92
04 00a6ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 5
System Thread ID: 3ee0
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00aaffb8 77e66063 ntdll!KiFastSystemCallRet
01 00aaffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 6
System Thread ID: 4e2c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for c:\windows\system32\inetsrv\W3TP.dll -
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00c6ff54 5a30249e ntdll!KiFastSystemCallRet
01 00c6ff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
02 00c6ffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 00c6ffb8 77e66063 W3TP+0x1db9
04 00c6ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 7
System Thread ID: 48c4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00caff54 5a30249e ntdll!KiFastSystemCallRet
01 00caff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
02 00caffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 00caffb8 77e66063 W3TP+0x1db9
04 00caffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 8
System Thread ID: 4e88
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00ceff54 5a30249e ntdll!KiFastSystemCallRet
01 00ceff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
02 00ceffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 00ceffb8 77e66063 W3TP+0x1db9
04 00ceffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 9
System Thread ID: 4280
Kernel Time: 0:0:0.78
User Time: 0:0:0.15
Thread Type: HTTP Listener
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00d2ff54 5a30249e ntdll!KiFastSystemCallRet
01 00d2ff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
02 00d2ffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
03 00d2ffb8 77e66063 W3TP+0x1db9
04 00d2ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 10
System Thread ID: 5428
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 00deffb8 77e66063 ntdll!KiFastSystemCallRet
01 00deffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 11
System Thread ID: 5320
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for c:\windows\system32\inetsrv\w3core.dll -
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 017dfaf8 77e6ba12 ntdll!KiFastSystemCallRet
01 017dfb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
02 017dffb8 77e66063 w3core!W3_FILE_INFO_CACHE::GetFileCache+0xd784
03 017dffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 12
System Thread ID: 570c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.

OLE32.dll Symbols not found. Unable to proceed with DCOM check.
Continuing other analysis.

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0181ff84 77c5778f ntdll!KiFastSystemCallRet
01 0181ff8c 77c5f7dd RPCRT4!NdrOleFree+0x3c5
02 0181ffac 77c5de88 RPCRT4!I_RpcTransGetThreadEvent+0x188
03 0181ffb8 77e66063 RPCRT4!I_RpcLogEvent+0xe92
04 0181ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 13
System Thread ID: 51a4
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll -
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
PDB symbol for mscorwks.dll not loaded
failed to load from resource.Failed to load SOS data.
No valid SOS data table found.


Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0193fea8 79f2f30a ntdll!KiFastSystemCallRet
01 0511ea60 0880a220 mscorwks!CreateAssemblyCache+0x2125c
02 79eca48c 7a0d87ab 0x880a220
03 7a15a4ac 000cc280 mscorwks!CorLaunchApplication+0x5620c
04 004002b8 00000000 0xcc280




Thread ID: 14
System Thread ID: 445c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
No valid SOS data table found.


Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0197feb0 79f2c9f3 ntdll!KiFastSystemCallRet
01 0197fee4 79f2c9c3 mscorwks!CreateAssemblyCache+0x1e945
02 0197ff18 79f758ec mscorwks!CreateAssemblyCache+0x1e915
03 0197ffb8 77e66063 mscorwks!CompareAssemblyIdentity+0x11cbd
04 0197ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 15
System Thread ID: 4f74
Kernel Time: 0:0:0.453
User Time: 0:0:2.375
Thread Type: Other
# ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be
wrong.
00 019bef90 04da46b4 0x4da4e3f
01 019befd4 059602cd 0x4da46b4
02 019bf048 0572ed63 0x59602cd
03 019bf080 04da1c29 0x572ed63
04 019bf368 689c31c4 0x4da1c29
05 019bf398 687cad0d System_Web_ni+0x4031c4
06 00000000 00000000 System_Web_ni+0x20ad0d




Thread ID: 16
System Thread ID: 546c
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
No valid SOS data table found.


Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 01a9fedc 77e61075 ntdll!KiFastSystemCallRet
01 01a9fef8 79ed4b06 kernel32!WaitForMultipleObjects+0x18
02 01a9ff58 79ed4a63 mscorwks!InitializeFusion+0x266e
03 01a9ff88 79ed49a6 mscorwks!InitializeFusion+0x25cb
04 01a9ffb8 77e66063 mscorwks!InitializeFusion+0x250e
05 01a9ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 17
System Thread ID: 52f4
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
No valid SOS data table found.


Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 01b9fcf4 79e77fd1 ntdll!KiFastSystemCallRet
01 01b9fd38 79e77f9a mscorwks!DllUnregisterServerInternal+0x47b1
02 01b9fd88 79e77f50 mscorwks!DllUnregisterServerInternal+0x477a
03 00000003 00000000 mscorwks!DllUnregisterServerInternal+0x4730




Thread ID: 18
System Thread ID: 4e24
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
No valid SOS data table found.


Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 01caff34 79f446b6 ntdll!KiFastSystemCallRet
01 01caffb0 79f44647
mscorwks!GetMetaDataPublicInterfaceFromInternal+0xdf7
02 01caffec 00000000
mscorwks!GetMetaDataPublicInterfaceFromInternal+0xd88




Thread ID: 19
System Thread ID: 5030
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
No valid SOS data table found.


Begin System Thread Information

# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 01cefd2c 79e77fd1 ntdll!KiFastSystemCallRet
01 01cefd70 79e77f9a mscorwks!DllUnregisterServerInternal+0x47b1
02 01cefdc0 79e77f50 mscorwks!DllUnregisterServerInternal+0x477a
03 01cefe20 00000000 mscorwks!DllUnregisterServerInternal+0x4730




Thread ID: 20
System Thread ID: 55ac
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
-
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0541ff84 64ffe9e9 ntdll!KiFastSystemCallRet
01 0541ffb8 77e66063 System_Data!DllBidInitialize+0xdd10
02 0541ffec 00000000 kernel32!GetModuleFileNameA+0xeb




Thread ID: 21
System Thread ID: 5274
Kernel Time: 0:0:0.0
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may
be wrong.
00 0619ffb8 77e66063 ntdll!KiFastSystemCallRet
01 0619ffec 00000000 kernel32!GetModuleFileNameA+0xeb

*****

Dump name is formatted as: PID-Timestamp.dmp

Creating C:\iisstate\output\21036-1132667791.dmp - mini user dump

*****

Closing open log file C:\iisstate\output\IISState-21036.log


mma(a)cas.com schrieb:

> Pat,
>
> follwing your advice, i get the following dmp(see below)
>
> any ideas how to proceed with this?
>
> thanks,
> Markus
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Tue Nov 22 14:34:11 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 20844
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
> IIS has crashed...
> Beginning Analysis
> DLL (!FunctionName) that failed:
>
>
>
>
> Thread ID: 18
> System Thread ID: 4bc4
> Kernel Time: 0:0:0.328
> User Time: 0:0:0.328
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 00 01a7ec8c 053646a4 0x5364e2f
> 01 01a7ecd0 05364594 0x53646a4
> 02 01a7ed00 0536262e 0x5364594
> 03 01a7ee1c 053620f7 0x536262e
> 04 00000000 00000000 0x53620f7
> Closing open log file C:\iisstate\output\IISState-20844.log
> Opened log file 'C:\iisstate\output\IISState-20844.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
>
> Pat [MSFT] schrieb:
>
> > You can try IISState - make sure to have a dump created so that you can fall
> > back to WinDBG w/out needing to repro the issue:
> >
> > iisstate -p <pid of w3wp.exe> -sc -d <enter>
> >
> >
> > Pat
> >
> > <mma(a)cas.com> wrote in message
> > news:1132581343.125158.276100(a)g43g2000cwa.googlegroups.com...
> > > Hi all,
> > >
> > > I have a .Net 2.0 Web Application running on server 2003.
> > > sometimes it crashes, probalbly somewhere inside a soap call with the
> > > following error message in the application log of the event viewer.
> > >
> > > "Source NET Runtime 2.0 Error Reporting
> > >
> > > Faulting application w3wp.exe, version 6.0.3790.1830, stamp 42435be1,
> > > faulting module kernel32.dll, version 5.2.3790.1830, stamp 424377d2,
> > > debug? 0, fault address 0x00015dea."
> > >
> > >
> > > Any ideas on how to proceed tracking this error? should i use iisstate?
> > >
> > >
> > > thanks in advance
> > > Markus
> > >

From: Pat [MSFT] on
Definitely a failure in managed code (unhandled exception).

Open the dump in WinDBG and:
1) set the symbols (.symfix <enter>)
2) .reload <enter>
3) Switch the the failing stack: ~15s<enter>
4) dump the managed stack: !.\clr10\sos.clrstack <enter>

Post the output.

Pat

<mma(a)cas.com> wrote in message
news:1132669718.191599.240250(a)o13g2000cwo.googlegroups.com...
> sorry, but I've attached an incomplete log.
> here is a more telling and longer version
>
> thanks,
> Markus
>
>
> Opened log file 'C:\iisstate\output\IISState-21036.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Tue Nov 22 14:56:30 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 21036
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
> IIS has crashed...
> Beginning Analysis
> DLL (!FunctionName) that failed:
>
>
>
>
> Thread ID: 15
> System Thread ID: 4f74
> Kernel Time: 0:0:0.453
> User Time: 0:0:2.375
> *** WARNING: Unable to verify checksum for
> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\433ef18ee3f5cc49af7883a7efb7c02c\System.Web.ni.dll
> *** ERROR: Module load completed but symbols could not be loaded for
> C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\433ef18ee3f5cc49af7883a7efb7c02c\System.Web.ni.dll
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 00 019bef90 04da46b4 0x4da4e3f
> 01 019befd4 059602cd 0x4da46b4
> 02 019bf048 0572ed63 0x59602cd
> 03 019bf080 04da1c29 0x572ed63
> 04 019bf368 689c31c4 0x4da1c29
> 05 019bf398 687cad0d System_Web_ni+0x4031c4
> 06 00000000 00000000 System_Web_ni+0x20ad0d
> Closing open log file C:\iisstate\output\IISState-21036.log
> Opened log file 'C:\iisstate\output\IISState-21036.log'
>
> ***********************
> Starting new log output
> IISState version 3.3.1
>
> Tue Nov 22 14:56:30 2005
>
> OS = Windows 2003 Server
> Executable: w3wp.exe
> PID = 21036
>
> Note: Thread times are formatted as HH:MM:SS.ms
>
> ***********************
>
>
>
>
> Thread ID: 0
> System Thread ID: 51dc
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.46
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for C:\WINDOWS\system32\ntdll.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for C:\WINDOWS\system32\kernel32.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for c:\windows\system32\inetsrv\w3dt.dll -
> *** ERROR: Module load completed but symbols could not be loaded for
> c:\windows\system32\inetsrv\w3wp.exe
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0006fc7c 77e6ba12 ntdll!KiFastSystemCallRet
> 01 0006fc90 5a36467a kernel32!WaitForSingleObject+0x12
> 02 0006ff0c 0100187c w3dt!IPM_MESSAGE_PIPE::operator=+0x1b31
> 03 0006ff44 01001a23 w3wp+0x187c
> 04 0006ffc0 77e523cd w3wp+0x1a23
> 05 0006fff0 00000000 kernel32!IsProcessorFeaturePresent+0x9e
>
>
>
>
> Thread ID: 1
> System Thread ID: 4d9c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0096ff48 7c80e933 ntdll!KiFastSystemCallRet
> 01 0096ffb8 77e66063
> ntdll!RtlSetLastWin32ErrorAndNtStatusFromNtStatus+0x282
> 02 0096ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 2
> System Thread ID: 51b8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 009affb8 77e66063 ntdll!KiFastSystemCallRet
> 01 009affec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 3
> System Thread ID: 45a4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 009effb8 77e66063 ntdll!KiFastSystemCallRet
> 01 009effec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 4
> System Thread ID: 57b8
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for C:\WINDOWS\system32\RPCRT4.dll -
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for C:\WINDOWS\system32\ole32.dll -
> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> Continuing other analysis.
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00a6ff84 77c5778f ntdll!KiFastSystemCallRet
> 01 00a6ff8c 77c5f7dd RPCRT4!NdrOleFree+0x3c5
> 02 00a6ffac 77c5de88 RPCRT4!I_RpcTransGetThreadEvent+0x188
> 03 00a6ffb8 77e66063 RPCRT4!I_RpcLogEvent+0xe92
> 04 00a6ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 5
> System Thread ID: 3ee0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00aaffb8 77e66063 ntdll!KiFastSystemCallRet
> 01 00aaffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 6
> System Thread ID: 4e2c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for c:\windows\system32\inetsrv\W3TP.dll -
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00c6ff54 5a30249e ntdll!KiFastSystemCallRet
> 01 00c6ff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
> 02 00c6ffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 00c6ffb8 77e66063 W3TP+0x1db9
> 04 00c6ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 7
> System Thread ID: 48c4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00caff54 5a30249e ntdll!KiFastSystemCallRet
> 01 00caff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
> 02 00caffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 00caffb8 77e66063 W3TP+0x1db9
> 04 00caffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 8
> System Thread ID: 4e88
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00ceff54 5a30249e ntdll!KiFastSystemCallRet
> 01 00ceff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
> 02 00ceffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 00ceffb8 77e66063 W3TP+0x1db9
> 04 00ceffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 9
> System Thread ID: 4280
> Kernel Time: 0:0:0.78
> User Time: 0:0:0.15
> Thread Type: HTTP Listener
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00d2ff54 5a30249e ntdll!KiFastSystemCallRet
> 01 00d2ff8c 5a3026bc W3TP!THREAD_POOL::PostCompletion+0x89
> 02 00d2ffa0 5a301db9 W3TP!THREAD_POOL::~THREAD_POOL+0x153
> 03 00d2ffb8 77e66063 W3TP+0x1db9
> 04 00d2ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 10
> System Thread ID: 5428
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 00deffb8 77e66063 ntdll!KiFastSystemCallRet
> 01 00deffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 11
> System Thread ID: 5320
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for c:\windows\system32\inetsrv\w3core.dll -
> Thread Type: HTTP Compression Thread
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 017dfaf8 77e6ba12 ntdll!KiFastSystemCallRet
> 01 017dfb0c 5a3b8147 kernel32!WaitForSingleObject+0x12
> 02 017dffb8 77e66063 w3core!W3_FILE_INFO_CACHE::GetFileCache+0xd784
> 03 017dffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 12
> System Thread ID: 570c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
> Continuing with other analysis.
>
> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> Continuing other analysis.
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0181ff84 77c5778f ntdll!KiFastSystemCallRet
> 01 0181ff8c 77c5f7dd RPCRT4!NdrOleFree+0x3c5
> 02 0181ffac 77c5de88 RPCRT4!I_RpcTransGetThreadEvent+0x188
> 03 0181ffb8 77e66063 RPCRT4!I_RpcLogEvent+0xe92
> 04 0181ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 13
> System Thread ID: 51a4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll -
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> PDB symbol for mscorwks.dll not loaded
> failed to load from resource.Failed to load SOS data.
> No valid SOS data table found.
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0193fea8 79f2f30a ntdll!KiFastSystemCallRet
> 01 0511ea60 0880a220 mscorwks!CreateAssemblyCache+0x2125c
> 02 79eca48c 7a0d87ab 0x880a220
> 03 7a15a4ac 000cc280 mscorwks!CorLaunchApplication+0x5620c
> 04 004002b8 00000000 0xcc280
>
>
>
>
> Thread ID: 14
> System Thread ID: 445c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> No valid SOS data table found.
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0197feb0 79f2c9f3 ntdll!KiFastSystemCallRet
> 01 0197fee4 79f2c9c3 mscorwks!CreateAssemblyCache+0x1e945
> 02 0197ff18 79f758ec mscorwks!CreateAssemblyCache+0x1e915
> 03 0197ffb8 77e66063 mscorwks!CompareAssemblyIdentity+0x11cbd
> 04 0197ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 15
> System Thread ID: 4f74
> Kernel Time: 0:0:0.453
> User Time: 0:0:2.375
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Frame IP not in any known module. Following frames may be
> wrong.
> 00 019bef90 04da46b4 0x4da4e3f
> 01 019befd4 059602cd 0x4da46b4
> 02 019bf048 0572ed63 0x59602cd
> 03 019bf080 04da1c29 0x572ed63
> 04 019bf368 689c31c4 0x4da1c29
> 05 019bf398 687cad0d System_Web_ni+0x4031c4
> 06 00000000 00000000 System_Web_ni+0x20ad0d
>
>
>
>
> Thread ID: 16
> System Thread ID: 546c
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> No valid SOS data table found.
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 01a9fedc 77e61075 ntdll!KiFastSystemCallRet
> 01 01a9fef8 79ed4b06 kernel32!WaitForMultipleObjects+0x18
> 02 01a9ff58 79ed4a63 mscorwks!InitializeFusion+0x266e
> 03 01a9ff88 79ed49a6 mscorwks!InitializeFusion+0x25cb
> 04 01a9ffb8 77e66063 mscorwks!InitializeFusion+0x250e
> 05 01a9ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 17
> System Thread ID: 52f4
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> No valid SOS data table found.
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 01b9fcf4 79e77fd1 ntdll!KiFastSystemCallRet
> 01 01b9fd38 79e77f9a mscorwks!DllUnregisterServerInternal+0x47b1
> 02 01b9fd88 79e77f50 mscorwks!DllUnregisterServerInternal+0x477a
> 03 00000003 00000000 mscorwks!DllUnregisterServerInternal+0x4730
>
>
>
>
> Thread ID: 18
> System Thread ID: 4e24
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> No valid SOS data table found.
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 01caff34 79f446b6 ntdll!KiFastSystemCallRet
> 01 01caffb0 79f44647
> mscorwks!GetMetaDataPublicInterfaceFromInternal+0xdf7
> 02 01caffec 00000000
> mscorwks!GetMetaDataPublicInterfaceFromInternal+0xd88
>
>
>
>
> Thread ID: 19
> System Thread ID: 5030
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Managed Thread. Possible ASP.Net page or other .Net worker
> No valid SOS data table found.
>
>
> Begin System Thread Information
>
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 01cefd2c 79e77fd1 ntdll!KiFastSystemCallRet
> 01 01cefd70 79e77f9a mscorwks!DllUnregisterServerInternal+0x47b1
> 02 01cefdc0 79e77f50 mscorwks!DllUnregisterServerInternal+0x477a
> 03 01cefe20 00000000 mscorwks!DllUnregisterServerInternal+0x4730
>
>
>
>
> Thread ID: 20
> System Thread ID: 55ac
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export symbols
> for
> C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
> -
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0541ff84 64ffe9e9 ntdll!KiFastSystemCallRet
> 01 0541ffb8 77e66063 System_Data!DllBidInitialize+0xdd10
> 02 0541ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
>
>
>
> Thread ID: 21
> System Thread ID: 5274
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames may
> be wrong.
> 00 0619ffb8 77e66063 ntdll!KiFastSystemCallRet
> 01 0619ffec 00000000 kernel32!GetModuleFileNameA+0xeb
>
> *****
>
> Dump name is formatted as: PID-Timestamp.dmp
>
> Creating C:\iisstate\output\21036-1132667791.dmp - mini user dump
>
> *****
>
> Closing open log file C:\iisstate\output\IISState-21036.log
>
>
> mma(a)cas.com schrieb:
>
>> Pat,
>>
>> follwing your advice, i get the following dmp(see below)
>>
>> any ideas how to proceed with this?
>>
>> thanks,
>> Markus
>>
>> ***********************
>> Starting new log output
>> IISState version 3.3.1
>>
>> Tue Nov 22 14:34:11 2005
>>
>> OS = Windows 2003 Server
>> Executable: w3wp.exe
>> PID = 20844
>>
>> Note: Thread times are formatted as HH:MM:SS.ms
>>
>> ***********************
>>
>>
>> IIS has crashed...
>> Beginning Analysis
>> DLL (!FunctionName) that failed:
>>
>>
>>
>>
>> Thread ID: 18
>> System Thread ID: 4bc4
>> Kernel Time: 0:0:0.328
>> User Time: 0:0:0.328
>> Thread Type: Other
>> # ChildEBP RetAddr
>> WARNING: Frame IP not in any known module. Following frames may be
>> wrong.
>> 00 01a7ec8c 053646a4 0x5364e2f
>> 01 01a7ecd0 05364594 0x53646a4
>> 02 01a7ed00 0536262e 0x5364594
>> 03 01a7ee1c 053620f7 0x536262e
>> 04 00000000 00000000 0x53620f7
>> Closing open log file C:\iisstate\output\IISState-20844.log
>> Opened log file 'C:\iisstate\output\IISState-20844.log'
>>
>> ***********************
>> Starting new log output
>> IISState version 3.3.1
>>
>>
>> Pat [MSFT] schrieb:
>>
>> > You can try IISState - make sure to have a dump created so that you can
>> > fall
>> > back to WinDBG w/out needing to repro the issue:
>> >
>> > iisstate -p <pid of w3wp.exe> -sc -d <enter>
>> >
>> >
>> > Pat
>> >
>> > <mma(a)cas.com> wrote in message
>> > news:1132581343.125158.276100(a)g43g2000cwa.googlegroups.com...
>> > > Hi all,
>> > >
>> > > I have a .Net 2.0 Web Application running on server 2003.
>> > > sometimes it crashes, probalbly somewhere inside a soap call with the
>> > > following error message in the application log of the event viewer.
>> > >
>> > > "Source NET Runtime 2.0 Error Reporting
>> > >
>> > > Faulting application w3wp.exe, version 6.0.3790.1830, stamp 42435be1,
>> > > faulting module kernel32.dll, version 5.2.3790.1830, stamp 424377d2,
>> > > debug? 0, fault address 0x00015dea."
>> > >
>> > >
>> > > Any ideas on how to proceed tracking this error? should i use
>> > > iisstate?
>> > >
>> > >
>> > > thanks in advance
>> > > Markus
>> > >
>