Hi there,
I posted my problem a couple of weeks ago, and Pat kindly gave me a couple
of pointers, but the problem still remains, and I can't locate the thread,
so I thought I'd post again fresh.
I've got a win2k web server handling around 30 websites, and it's been
running fine for about a year. However, over the last few weeks, IIS has
been regularly crashing; first once every couple of weeks, to now where it
crashes about 3 or 4 times a day. When it crashes, the server has the
following pop-ups:
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 18/08/2004
Time: 15:40:58
User: N/A
Computer: REMOTE1
Description:
Application popup: inetinfo.exe - Application Error : The instruction at
"0x01ed123f" referenced memory at "0x04659000". The memory could not be
"written".
Click on OK to terminate the program
Click on CANCEL to debug the program
___________________________________________________________________________
Often followed by:
Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 18/08/2004
Time: 16:23:49
User: N/A
Computer: REMOTE1
Description:
Application popup: inetinfo.exe - Application Error : The instruction at
"0x77fcc2c0" referenced memory at "0x3d646965". The memory could not be
"written".
Click on OK to terminate the program
Click on CANCEL to debug the program
___________________________________________________________________________
Then:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 18/08/2004
Time: 16:50:19
User: N/A
Computer: REMOTE1
Description:
The IIS Admin Service service terminated unexpectedly. It has done this 49
time(s). The following corrective action will be taken in 0 milliseconds:
No action.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 18/08/2004
Time: 16:50:19
User: N/A
Computer: REMOTE1
Description:
The FTP Publishing Service service terminated unexpectedly. It has done
this 47 time(s). The following corrective action will be taken in 0
milliseconds: No action.
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 18/08/2004
Time: 16:50:19
User: N/A
Computer: REMOTE1
Description:
The World Wide Web Publishing Service service terminated unexpectedly. It
has done this 48 time(s). The following corrective action will be taken in
0 milliseconds: No action.
___________________________________________________________
I've been getting various iisState logs, and - more recently - ADPlus logs
too, which I've put here if you're able to have a look at them:
http://www.remote.uk.com/iiscrashlogs/
I've also used MS Crash/hang Agent & IIS dump to try to work out what
websites are setting off the problem, but can't find any pattern at all to
it; different languages, and using different combinations of the ISAPI
filters. The logs are at the URL above as well.
ISAPI filters
Pat analysed my last lot of iisState logs, and concluded that there might be
a problem with the ISAPI filters. I've got the following installed:
httpZip - http://www.port80software.com/products/httpzip/
ASPSpiderBait -
http://www.webanalyst.com.au/index.cfm?objectId=6BE0C0C1-0A09-049D-C85D7BB24AD6B366
URL Rewrite - http://www.smalig.com/url_rewrite-en.htm
Flicks Webquota/Authentix - http://www.flicks.com/prod.htm#webq
I've had Authentix running for 3 years without any problems, although I did
upgrade to the latest version yesterday, just in case there's a conflict
with .NET, which we're building our sites in now.
ASP Spiderbait's been on for quite a while too, with no problems that I can
remember.
httpZip and URL Rewrite are relatively new additions, but software vendors
of both components insist that they haven't had anyone else report the same
problem as the one I'm describing. A;so, I'm not able to recreate the
problem on my local test servers, so I'd say maybe something's having a
problem with high traffic on various sites, but saying that, I'm getting
crashes at 3 or 4 in the morning, so I can see how it could be a high
traffic problem...
So I'm stuck! Would someone please look over the logs in the URL provided,
and compare the data so that I can get some kind of solution to this; It's
been going on for so long now I'm at the end of my tether!
Many, many thanks,
Paul McGillivray