Hi
I am getting a fair amount of errorid 37's so i decided to run iisstate on
the inetpub process to see what is happening. Here is the output, after an
example eid37. Can anyone help diagnose please?
Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 37
Date: 30/01/2004
Time: 10:32:46
User: N/A
Computer: KIWISERVER
Description:
Out of process application '/LM/W3SVC/19/Root' terminated unexpectedly.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
Opened log file 'C:\iisstate\output\IISState-3908.log'
***********************
Starting new log output
IISState version 3.3.1
Fri Jan 30 10:46:08 2004
OS = Windows 2000
Executable: inetinfo.exe
PID = 3908
Note: Thread times are formatted as HH:MM:SS.ms
***********************
IIS has crashed...
Beginning Analysis
DLL (!FunctionName) that failed: RPCRT4!IUnknown_QueryInterface_Proxy
Thread ID: 87
System Thread ID: d28
Kernel Time: 0:0:12.765
User Time: 0:0:6.515
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0345ecac 77aac790 RPCRT4!IUnknown_QueryInterface_Proxy+0x12
01 0345ecc4 77aac949 ole32!CGIPTable::GetRequestedInterface+0x22
02 0345ed00 65f35ee7 ole32!CGIPTable::GetInterfaceFromGlobal+0x1b0
03 0345ed2c 65f35f76 w3svc!CWamInfoOutProc::EnterOOPZone+0x95
04 0345ed50 65f04c20 w3svc!CWamInfoOutProc::PreProcessWamRequest+0x1b
05 0345ed7c 65f03d71 w3svc!CWamInfo::ProcessWamRequest+0xa1
06 0345f5b4 65f03c49 w3svc!WAM_DICTATOR::ProcessWamRequest+0x1e5
07 0345f5d8 65f03aa2 w3svc!HTTP_REQUEST::DoWamRequest+0x75
08 0345f5fc 65f0249e w3svc!HTTP_REQUEST::ProcessBGI+0x166
09 0345f77c 65f2f427 w3svc!HTTP_REQUEST::DoWork+0x43f
0a 0345f7a0 65f22dd7 w3svc!HTTP_REQUEST::ReprocessURL+0x25a
0b 0345fcfc 65f23a10 w3svc!HTTP_REQUEST::CheckDefaultLoad+0x352
0c 0345fd54 65f0242b w3svc!HTTP_REQUEST::DoGet+0x39b
0d 0345fec4 65f01d97 w3svc!HTTP_REQUEST::DoWork+0x504
0e 0345fee4 65f06be5 w3svc!CLIENT_CONN::DoWork+0x1aa
0f 0345ff08 65f06b58 w3svc!CreateClient+0x7b
10 0345ff4c 6d701ad2 w3svc!W3OnConnectEx+0x118
11 0345ff80 6d7029a6 ISATQ!AtqpProcessContext+0x23e
12 0345ffb4 7c57b382 ISATQ!AtqPoolThread+0x1a8
13 0345ffec 00000000 KERNEL32!BaseThreadStart+0x52
Closing open log file C:\iisstate\output\IISState-3908.log
Opened log file 'C:\iisstate\output\IISState-3908.log'
***********************
Starting new log output
IISState version 3.3.1
Fri Jan 30 11:02:57 2004
OS = Windows 2000
Executable: inetinfo.exe
PID = 3908
Note: Thread times are formatted as HH:MM:SS.ms
***********************
Thread ID: 0
System Thread ID: 12a4
Kernel Time: 0:0:0.156
User Time: 0:0:0.46
Thread Type: Other
# ChildEBP RetAddr
00 0006f89c 7c586235 ntdll!ZwReadFile+0xb
01 0006f910 7c2e0135 KERNEL32!ReadFile+0x181
02 0006f93c 7c2dffbb ADVAPI32!ScGetPipeInput+0x28
03 0006f9b8 7c2e1995 ADVAPI32!ScDispatcherLoop+0x4a
04 0006fbf4 01002884 ADVAPI32!StartServiceCtrlDispatcherA+0x7d
05 0006fd30 01001e94 inetinfo!StartDispatchTable+0x2f1
06 0006ff70 01002fbf inetinfo!main+0x654
07 0006ffc0 7c5987e7 inetinfo!mainCRTStartup+0xff
08 0006fff0 00000000 KERNEL32!BaseProcessStart+0x3d
Thread ID: 1
System Thread ID: 794
Kernel Time: 0:0:0.203
User Time: 0:0:0.109
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 005dfd1c 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 005dfd44 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 005dfd54 6e6f1685 KERNEL32!WaitForSingleObject+0xf
03 005dfd70 01002440 iisadmin!ServiceEntry+0x156
04 005dffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
05 005dffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
06 005dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 2
System Thread ID: 10bc
Kernel Time: 0:4:31.234
User Time: 0:1:28.109
Thread Type: Other
# ChildEBP RetAddr
00 0071fe5c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0071feac 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 0071ff08 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 0071ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 0071ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 0071ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
06 0071ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 3
System Thread ID: 1458
Kernel Time: 0:4:5.750
User Time: 0:1:36.703
Thread Type: Other
# ChildEBP RetAddr
00 0075fe5c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0075feac 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 0075ff08 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 0075ff24 6e5a5a7c USER32!MsgWaitForMultipleObjects+0x1d
04 0075ff7c 780085bc IisRTL!SchedulerWorkerThread+0xa7
05 0075ffb4 7c57b382 MSVCRT!_endthreadex+0xc1
06 0075ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 4
System Thread ID: 1338
Kernel Time: 0:0:0.93
User Time: 0:0:0.15
Thread Type: Other
# ChildEBP RetAddr
00 0cb7ebe0 77f8385e ntdll!ZwWaitForMultipleObjects+0xb
01 0cb7ffb4 7c57b382 ntdll!RtlpWaitThread+0x1b9
02 0cb7ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 5
System Thread ID: 14a0
Kernel Time: 0:0:15.15
User Time: 0:0:39.109
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 016bfe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 016bff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 016bff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 016bffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 016bffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 016bffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 6
System Thread ID: 10c4
Kernel Time: 0:0:0.468
User Time: 0:0:0.265
Thread Type: Other
# ChildEBP RetAddr
00 00e4fc1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 00e4fc6c 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 00e4fcc8 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 00e4fce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 00e4fd30 65f0cfd8 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 00e4fd70 01002440 w3svc!ServiceEntry+0x1b5
06 00e4ffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
07 00e4ffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
08 00e4ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 7
System Thread ID: 105c
Kernel Time: 0:0:0.46
User Time: 0:0:0.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00f8ff5c 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 00f8ff88 6d7029ef KERNEL32!GetQueuedCompletionStatus+0x27
02 00f8ffb4 7c57b382 ISATQ!I_AtqOplockThreadFunc+0x32
03 00f8ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 8
System Thread ID: 534
Kernel Time: 0:0:17.953
User Time: 0:0:9.78
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 00fcff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 00fcff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 00fcffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 00fcffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 9
System Thread ID: 10f4
Kernel Time: 0:0:18.937
User Time: 0:0:10.0
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0104ff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0104ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0104ffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 0104ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 10
System Thread ID: 91c
Kernel Time: 0:0:0.46
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 011cfeb8 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 011cfee4 77d809da KERNEL32!GetQueuedCompletionStatus+0x27
02 011cff20 77d50ede RPCRT4!COMMON_ProcessCalls+0x9e
03 011cff74 77d50d17 RPCRT4!LOADABLE_TRANSPORT::ProcessIOEvents+0x99
04 011cff78 77d39a00 RPCRT4!ProcessIOEventsWrapper+0x9
05 011cffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
06 011cffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
07 011cffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 11
System Thread ID: 888
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 013cfe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 013cff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 013cff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 013cffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 013cffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 013cffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 12
System Thread ID: 808
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 0144fd20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0144fd70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0144fd88 778322b2 KERNEL32!WaitForMultipleObjects+0x17
03 0144ffb4 7c57b382 RTUTILS!TraceServerThread+0xde
04 0144ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 13
System Thread ID: 804
Kernel Time: 0:0:0.15
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Compression Thread
# ChildEBP RetAddr
00 0149ff5c 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 0149ff84 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 0149ff94 732c3366 KERNEL32!WaitForSingleObject+0xf
03 0149ffb4 7c57b382 compfilt!CompressionThread+0x29
04 0149ffc0 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 14
System Thread ID: 83c
Kernel Time: 0:0:0.187
User Time: 0:0:0.296
Thread Type: Other
# ChildEBP RetAddr
00 015bfe70 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 015bfec0 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 015bff1c 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 015bff38 65f09ccb USER32!MsgWaitForMultipleObjects+0x1d
04 015bff7c 78008454 w3svc!CMTACallbackThread::Thread+0x42
05 015bffb4 7c57b382 MSVCRT!_endthread+0xc6
06 015bffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 15
System Thread ID: 7b4
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 015ffea8 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 015ffef8 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 015fff54 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 015fff70 65f09d47 USER32!MsgWaitForMultipleObjects+0x1d
04 015fffb4 7c57b382 w3svc!OleHackThread+0x88
05 015fffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 16
System Thread ID: 800
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Status: Thread is in a WAIT state.
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0167fdfc 74fd1394 ntdll!NtWaitForSingleObject+0xb
01 0167fe38 74fd3c59 msafd!SockWaitForSingleObject+0x1a8
02 0167ff24 750312f5 msafd!WSPSelect+0x24e
03 0167ff88 6d7075bd WS2_32!select+0xe7
04 0167ffb0 6d70791b ISATQ!ATQ_BMON_SET::BmonThreadFunc+0x22
05 0167ffb4 7c57b382 ISATQ!BmonThreadFunc+0x9
06 0167ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 17
System Thread ID: 12b0
Kernel Time: 0:0:24.140
User Time: 0:0:11.656
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 017dff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 017dff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 017dffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 017dffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 18
System Thread ID: f84
Kernel Time: 0:0:0.62
User Time: 0:0:0.93
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 01cefc1c 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 01cefc6c 77e1e9fb KERNEL32!WaitForMultipleObjectsEx+0xea
02 01cefcc8 77e1ea48 USER32!MsgWaitForMultipleObjectsEx+0x153
03 01cefce4 769c71e0 USER32!MsgWaitForMultipleObjects+0x1d
04 01cefd30 6b561a78 INFOCOMM!IIS_SERVICE::StartServiceOperation+0x209
05 01cefd70 01002440 SMTPSVC!ServiceEntry+0x136
06 01ceffa4 7c2e02f7 inetinfo!InetinfoStartService+0x2bd
07 01ceffb4 7c57b382 ADVAPI32!ScSvcctrlThreadA+0xe
08 01ceffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 19
System Thread ID: f3c
Kernel Time: 0:0:0.93
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01d6ff20 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 01d6ff70 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 01d6ff88 701224fa KERNEL32!WaitForMultipleObjects+0x17
03 01d6ffb4 7c57b382 exstrace!RegNotifyThread+0x6f
04 01d6ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 20
System Thread ID: 1104
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: Other
# ChildEBP RetAddr
00 01daff24 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 01daff74 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 01daff8c 70121e6a KERNEL32!WaitForMultipleObjects+0x17
03 01daffb4 7c57b382 exstrace!WriteTraceThread+0x2f
04 01daffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 21
System Thread ID: f8c
Kernel Time: 0:0:0.421
User Time: 0:0:2.234
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 01f2ff64 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 01f2ff8c 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 01f2ff9c 6ff2841e KERNEL32!WaitForSingleObject+0xf
03 01f2ffb4 7c57b382 FCACHDLL!CScheduleThread::ScheduleThread+0x22
04 01f2ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 22
System Thread ID: ad4
Kernel Time: 0:0:0.31
User Time: 0:0:0.0
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0206ff18 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0206ff68 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0206ff80 6b57b026 KERNEL32!WaitForMultipleObjects+0x17
03 0206ffb4 7c57b382 SMTPSVC!TcpRegNotifyThread+0x136
04 0206ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 23
System Thread ID: f38
Kernel Time: 0:0:0.156
User Time: 0:0:0.62
Thread Status: Thread is in a WAIT state.
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 020aff68 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 020aff90 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 020affa0 6b57ae5a KERNEL32!WaitForSingleObject+0xf
03 020affb4 7c57b382 SMTPSVC!FreeLibThread+0x1d
04 020affec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 24
System Thread ID: f34
Kernel Time: 0:0:0.46
User Time: 0:0:0.0
Thread Type: Possible ASP page. Possible DCOM activity
Executing Page: ASP.dll symbols not found. Unable to locate ASP page.
Continuing with other analysis.
No remote call being made
# ChildEBP RetAddr
00 0216fe24 77d574d4 ntdll!NtReplyWaitReceivePortEx+0xb
01 0216ff74 77d56d9e RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x74
02 0216ff78 77d39a00 RPCRT4!RecvLotsaCallsWrapper+0x9
03 0216ffa8 77d41c6c RPCRT4!BaseCachedThreadRoutine+0x4f
04 0216ffb4 7c57b382 RPCRT4!ThreadStartRoutine+0x18
05 0216ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 25
System Thread ID: f4c
Kernel Time: 0:0:0.62
User Time: 0:0:0.15
Thread Status: Thread is in a WAIT state.
Thread Type: Other
# ChildEBP RetAddr
00 021bff54 7c599e8e ntdll!NtWaitForSingleObject+0xb
01 021bff7c 7c57b3d5 KERNEL32!WaitForSingleObjectEx+0x71
02 021bff8c 741a99cd KERNEL32!WaitForSingleObject+0xf
03 021bffb4 7c57b382 aqueue!CSMTP_RETRY_HANDLER::RetryThreadRoutine+0xce
04 021bffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 26
System Thread ID: f60
Kernel Time: 0:0:0.593
User Time: 0:0:0.250
Thread Type: SMTP Service Worker Thread
# ChildEBP RetAddr
00 0223fed0 7c59a059 ntdll!ZwWaitForMultipleObjects+0xb
01 0223ff20 7c599f6c KERNEL32!WaitForMultipleObjectsEx+0xea
02 0223ff38 741900e1 KERNEL32!WaitForMultipleObjects+0x17
03 0223ff9c 6b56dccd aqueue!CConnMgr::GetNextConnection+0x1da
04 0223ffb4 7c57b382 SMTPSVC!PERSIST_QUEUE::QueueThreadRoutine+0x23
05 0223ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 27
System Thread ID: 14fc
Kernel Time: 0:0:2.968
User Time: 0:0:1.500
Thread Type: HTTP Listener
# ChildEBP RetAddr
00 0108ff50 7c585323 ntdll!NtRemoveIoCompletion+0xb
01 0108ff7c 6d702957 KERNEL32!GetQueuedCompletionStatus+0x27
02 0108ffb4 7c57b382 ISATQ!AtqPoolThread+0x40
03 0108ffec 00000000 KERNEL32!BaseThreadStart+0x52
Thread ID: 28
System Thread ID: 10fc
Kernel Time: 0:0:0.156
User Time: 0:0:0.46