Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

Faulting application w3wp.exe, faulting module ntdll.dll

157 views

Skip to first unread message

Michel Meeuwissen

unread,

Sep 7, 2006, 4:35:01 AM9/7/06

First something about our website:
Our website consists of two servers, an IIS (Windows 2003) server and a SQL
(Windows 2003/SQL 2000) server. The website is programmed by our developer in
visual studio and uses .net1.1.4. It uses sqlxml to communicate with the
sql-server, uses application pools and is visited about 1500 times each day.

Usually our webserver is fine. Nothing bad in the logs and a reasonable to
good performance. A few times each week though, content that has to be loaded
from our sql server doesn't appear and people see a website with white spaces
where text should appear. The message in the eventlog states following at
such times:
Faulting application w3wp.exe, version 6.0.3790.1830, faulting module
ntdll.dll, version 5.2.3790.1830, fault address 0x0003248b.

Now, this is nothing new, because a lot of people experience this so I read.
So I started MS's debug diagnostics tool to monitor the process w3wp.exe and
to create a log when it crashes. The log follows below this text.
Now we're very much in need of a solution to this strange behaviour of our
website, because we've been coping with this for over a year now and nobody
seems to know what exactly is wrong here. I hope somebody is willing to try
and help us out here if possible...

Thanks in advance,

Michel

This is the log:

Analysis Summary
Type Description Recommendation
Error In
w3wp__PID__3700__Date__08_31_2006__Time_09_53_10PM__916__Second_Chance_Exception_C0000017.dmp
the assembly instruction at ntdll!RtlAllocateHeap+ee0 in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
unknown exception (0xc0000017) on thread 23

Please follow up with vendor Microsoft Corporation for problem resolution
concerning the following file: C:\WINDOWS\system32\ntdll.dll.

Analysis Details
Table Of Contents
w3wp__PID__3700__Date__08_31_2006__Time_09_53_10PM__916__Second_Chance_Exception_C0000017.dmp

Top 5 threads by CPU time
Thread report
Well-Known COM STA Threads Report
HTTP Report
Faulting Module Information

Report for
w3wp__PID__3700__Date__08_31_2006__Time_09_53_10PM__916__Second_Chance_Exception_C0000017.dmp
Type of Analysis Performed Combined Crash/Hang Analysis
Machine Name SERVER1
Operating System Windows Server 2003 Service Pack 1
Number Of Processors 4
Process ID 3700
Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
System Up-Time 49 day(s) 19:58:05
Process Up-Time 0 day(s) 01:15:58

Top 5 Threads by CPU time
Note - Times include both user mode and kernel mode for each thread Thread
ID: 13 Total CPU Time: 0 day(s) 00:00:48.328 Entry Point for Thread:
mscorsvr!ThreadpoolMgr::intermediateThreadProc
Thread ID: 22 Total CPU Time: 0 day(s) 00:00:46.265 Entry Point for
Thread: mscorsvr!ThreadpoolMgr::intermediateThreadProc
Thread ID: 18 Total CPU Time: 0 day(s) 00:00:09.93 Entry Point for
Thread: mscorsvr!gc_heap::gc_thread_stub
Thread ID: 16 Total CPU Time: 0 day(s) 00:00:08.921 Entry Point for
Thread: mscorsvr!gc_heap::gc_thread_stub
Thread ID: 17 Total CPU Time: 0 day(s) 00:00:07.890 Entry Point for
Thread: mscorsvr!gc_heap::gc_thread_stub

Thread report

Thread 0 - System ID 2744
Entry point w3wp!wmainCRTStartup
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.62
Time spent in kernel mode 0 Days 0:0:0.78

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3dt!WP_CONTEXT::RunMainThreadLoop+10
w3dt!UlAtqStartListen+2d
w3core!W3_SERVER::StartListen+bd
w3core!UlW3Start+26e
w3wp!wmain+22a
w3wp!wmainCRTStartup+12b
kernel32!BaseProcessStart+23

Thread 1 - System ID 6656
Entry point ntdll!RtlpTimerThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.46

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+c
ntdll!RtlpTimerThread+47
kernel32!BaseThreadStart+34

Thread 2 - System ID 7936
Entry point ntdll!RtlpWorkerThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.15
Time spent in kernel mode 0 Days 0:0:0.31

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtRemoveIoCompletion+c
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 3 - System ID 2972
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!KiFastSystemCallRet
ntdll!ZwReplyWaitReceivePortEx+c
rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+198
rpcrt4!RecvLotsaCallsWrapper+d
rpcrt4!BaseCachedThreadRoutine+9d
rpcrt4!ThreadStartRoutine+1b
kernel32!BaseThreadStart+34

Thread 4 - System ID 7752
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.921
Time spent in kernel mode 0 Days 0:0:0.640

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtRemoveIoCompletion+c
kernel32!GetQueuedCompletionStatus+29
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34

Thread 5 - System ID 2720
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.750
Time spent in kernel mode 0 Days 0:0:0.578

Thread 6 - System ID 480
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.968
Time spent in kernel mode 0 Days 0:0:0.609

Thread 7 - System ID 5544
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:1.109
Time spent in kernel mode 0 Days 0:0:0.750

Thread 8 - System ID 456
Entry point ntdll!RtlpWaitThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.62

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
ntdll!RtlpWaitThread+161
kernel32!BaseThreadStart+34

Thread 9 - System ID 648
Entry point w3core!HTTP_COMPRESSION::CompressionThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.78

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3core!HTTP_COMPRESSION::CompressionThread+126
kernel32!BaseThreadStart+34

Thread 10 - System ID 4756
Entry point rpcrt4!ThreadStartRoutine
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.15
Time spent in kernel mode 0 Days 0:0:0.46

Thread 11 - System ID 6384
Entry point ntdll!RtlpIOWorkerThread
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+c
ntdll!RtlpIOWorkerThread+3f
kernel32!BaseThreadStart+34

Thread 12 - System ID 4596
Entry point mscorsvr!ThreadpoolMgr::GateThreadStart
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.62

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+c
kernel32!SleepEx+68
kernel32!Sleep+f
mscorsvr!ThreadpoolMgr::GateThreadStart+54
kernel32!BaseThreadStart+34

Thread 13 - System ID 7804
Entry point mscorsvr!ThreadpoolMgr::intermediateThreadProc
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:44.375
Time spent in kernel mode 0 Days 0:0:3.953

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
mscorsvr!ThreadpoolMgr::WorkerThreadStart+3a
mscorsvr!ThreadpoolMgr::intermediateThreadProc+44
kernel32!BaseThreadStart+34

Thread 14 - System ID 4160
Entry point mscorsvr!DebuggerRCThread::ThreadProcStatic
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.46

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
kernel32!WaitForMultipleObjects+18
mscorsvr!DebuggerRCThread::MainLoop+90
mscorsvr!DebuggerRCThread::ThreadProc+68
mscorsvr!DebuggerRCThread::ThreadProcStatic+b
kernel32!BaseThreadStart+34

Thread 15 - System ID 5224
Entry point mscorsvr!gc_heap::gc_thread_stub
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:7.484
Time spent in kernel mode 0 Days 0:0:0.62

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
mscorsvr!gc_heap::gc_thread_function+2f
mscorsvr!gc_heap::gc_thread_stub+1e
kernel32!BaseThreadStart+34

Thread 16 - System ID 7772
Entry point mscorsvr!gc_heap::gc_thread_stub
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:8.890
Time spent in kernel mode 0 Days 0:0:0.31

Thread 17 - System ID 2820
Entry point mscorsvr!gc_heap::gc_thread_stub
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:7.859
Time spent in kernel mode 0 Days 0:0:0.31

Thread 18 - System ID 212
Entry point mscorsvr!gc_heap::gc_thread_stub
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:9.62
Time spent in kernel mode 0 Days 0:0:0.31

Thread 19 - System ID 3568
Entry point mscorsvr!Thread::intermediateThreadProc
Create time 8/31/2006 8:37:14 PM
Time spent in user mode 0 Days 0:0:0.78
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
kernel32!WaitForMultipleObjects+18
mscorsvr!WaitForFinalizerEvent+5a
mscorsvr!GCHeap::FinalizerThreadStart+96
mscorsvr!Thread::intermediateThreadProc+44
kernel32!BaseThreadStart+34

Thread 20 - System ID 7860
Entry point mscorsvr!ThreadpoolMgr::TimerThreadStart
Create time 8/31/2006 8:37:15 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.78

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+c
kernel32!SleepEx+68
mscorsvr!ThreadpoolMgr::TimerThreadStart+30
kernel32!BaseThreadStart+34

Thread 21 - System ID 7572
Entry point comsvcs!PingThread
Create time 8/31/2006 8:37:17 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.31

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForSingleObject+c
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
comsvcs!PingThread+f6
kernel32!BaseThreadStart+34

Thread 22 - System ID 7272
Entry point mscorsvr!ThreadpoolMgr::intermediateThreadProc
Create time 8/31/2006 8:37:28 PM
Time spent in user mode 0 Days 0:0:42.937
Time spent in kernel mode 0 Days 0:0:3.328

Thread 23 - System ID 4404
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 8/31/2006 8:37:55 PM
Time spent in user mode 0 Days 0:0:0.781
Time spent in kernel mode 0 Days 0:0:0.375

Function Source
ntdll!RtlAllocateHeap+ee0
kernel32!LocalAlloc+58
w3dt!UL_NATIVE_REQUEST::DoStateRead+51
w3dt!UL_NATIVE_REQUEST::DoWork+7f
w3dt!OverlappedCompletionRoutine+1a
w3tp!THREAD_POOL_DATA::ThreadPoolThread+73
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34

Thread 24 - System ID 2900
Entry point GdiPlus!BackgroundThreadProc
Create time 8/31/2006 8:38:35 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.31

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtWaitForMultipleObjects+c
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+141
user32!MsgWaitForMultipleObjects+1f
GdiPlus!BackgroundThreadProc+59
kernel32!BaseThreadStart+34

Thread 25 - System ID 3976
Entry point httpext!CDavWorkerThread::ThreadDispatcher
Create time 8/31/2006 8:38:46 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.46

This thread is calling an ISAPI Extension httpext

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtRemoveIoCompletion+c
kernel32!GetQueuedCompletionStatus+29
httpext!CDavWorkerThread::GetWorkCompletion+29
httpext!CDavWorkerThread::ThreadDispatcher+30
kernel32!BaseThreadStart+34

Thread 26 - System ID 7812
Entry point httpext!CDavWorkerThread::ThreadDispatcher
Create time 8/31/2006 8:38:46 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.46

This thread is calling an ISAPI Extension httpext

Thread 27 - System ID 4448
Entry point httpext!CDavWorkerThread::ThreadDispatcher
Create time 8/31/2006 8:38:46 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.62

This thread is calling an ISAPI Extension httpext

Thread 28 - System ID 6828
Entry point httpext!CDavWorkerThread::ThreadDispatcher
Create time 8/31/2006 8:38:46 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.125

This thread is calling an ISAPI Extension httpext

Thread 29 - System ID 4296
Entry point httpext!CDavWorkerThread::ThreadDispatcher
Create time 8/31/2006 8:38:46 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15

This thread is calling an ISAPI Extension httpext

Thread 30 - System ID 1972
Entry point rpcrt4!ThreadStartRoutine
Create time 8/31/2006 8:40:23 PM
Time spent in user mode 0 Days 0:0:0.15
Time spent in kernel mode 0 Days 0:0:0.78

Thread 31 - System ID 2412
Entry point mscorsvr!ThreadpoolMgr::WaitThreadStart
Create time 8/31/2006 8:41:48 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtDelayExecution+c
kernel32!SleepEx+68
mscorsvr!ThreadpoolMgr::WaitThreadStart+45
kernel32!BaseThreadStart+34

Thread 32 - System ID 6312
Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry
Create time 8/31/2006 8:55:36 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.62

Function Source
ntdll!KiFastSystemCallRet
user32!NtUserGetMessage+c
ole32!CDllHost::STAWorkerLoop+72
ole32!CDllHost::WorkerThread+c8
ole32!DLLHostThreadEntry+d
ole32!CRpcThread::WorkerLoop+1e
ole32!_imp__InstallApplication <PERF> (ole32+0x0)
kernel32!BaseThreadStart+34

Thread 33 - System ID 4232
Entry point ntdll!RtlpWorkerThread
Create time 8/31/2006 9:31:50 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.15

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtRemoveIoCompletion+c
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 34 - System ID 5260
Entry point mscorsvr!ThreadpoolMgr::intermediateThreadProc
Create time 8/31/2006 9:51:00 PM
Time spent in user mode 0 Days 0:0:0.718
Time spent in kernel mode 0 Days 0:0:0.93

Function Source
ntdll!vDbgPrintExWithPrefixInternal+150
ntdll!DbgPrint+1c
ntdll!RtlpCheckHeapSignature+57
ntdll!RtlDebugAllocateHeap+46
ntdll!RtlAllocateHeapSlowly+41
ntdll!RtlAllocateHeap+e9f
kernel32!LocalAlloc+58
kernel32!BaseDllFormatMessage+1ee
kernel32!FormatMessageW+21
mscorsvr!WszFormatMessage+1d3
mscorsvr!CreateMethodExceptionObject+4d3
mscorsvr!RealCOMPlusThrowHRWorker+b9
mscorsvr!RealCOMPlusThrowHRWorker+15
mscorsvr!RealCOMPlusThrowHR+168
mscorsvr!ThrowBecauseOfFailedHRWorker+88
mscorsvr!ArrayStoreCheck
2686553
25d1994
25d18bd
25d1623
25d89e6
37e213f
37e1ce9
25fce94
25fa6c7
25fa12b
25a99b2
25a9883
2196450
mscorsvr!ComCallMLStubCache::CompileMLStub+1af
mscorsvr!Thread::DoADCallBack+5c
mscorsvr!ComCallMLStubCache::CompileMLStub+2ba
1c1a399
6189288

Thread 35 - System ID 2732
Entry point ntdll!RtlpWorkerThread
Create time 8/31/2006 9:51:52 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtRemoveIoCompletion+c
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 36 - System ID 356
Entry point mscorsvr!ThreadpoolMgr::intermediateThreadProc
Create time 8/31/2006 9:52:00 PM
Time spent in user mode 0 Days 0:0:0.375
Time spent in kernel mode 0 Days 0:0:0.62

Thread 37 - System ID 5988
Entry point ntdll!RtlpWorkerThread
Create time 8/31/2006 9:52:52 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtRemoveIoCompletion+c
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 38 - System ID 7064
Entry point ntdll!RtlpWorkerThread
Create time 8/31/2006 9:52:52 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!KiFastSystemCallRet
ntdll!NtRemoveIoCompletion+c
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Well-Known COM STA Threads Report
STA Name Thread ID Thread Status Call Status

Main STA 32 Idle (N/A)
Apartment-threaded host for MTA clients 32 Idle (N/A)

HTTP report
IIS ATQ worker thread count 5 Thread(s)
Available ATQ worker thread count 4 Thread(s)
Active client connections 31 client connection(s)

Client Connections
Client connection from 84.26.150.162:3967 to 212.83.211.202:80
Host Header www.omroepbrabant.nl:80
GET request for /search.aspx?search=top+900...
Mapped To URL /search.aspx
HTTP Version HTTP/1.1
SSL Request False
Time alive 0 day(s) 00:00:18
QueryString search=top+900...
Request mapped to
HTTP Request State HTR_READING_CLIENT_REQUEST
Native Request State NREQ_STATE_PROCESS

30 connection(s) waiting for the next request.In
w3wp__PID__3700__Date__08_31_2006__Time_09_53_10PM__916__Second_Chance_Exception_C0000017.dmp
the assembly instruction at ntdll!RtlAllocateHeap+ee0 in
C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an
unknown exception (0xc0000017) on thread 23

Module Information
Image Name: C:\WINDOWS\system32\ntdll.dll Symbol Type: PDB
Base address: 0x7c800000 Time Stamp: Fri Mar 25 03:30:42 2005
Checksum: 0x000c90bf Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: NT Layer DLL
ISAPIFilter: False File Version: 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)
Managed DLL: False Internal Name: ntdll.dll
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights
reserved.
Loaded Image Name: ntdll.dll Legal Trademarks:
Mapped Image Name: Original filename: ntdll.dll
Module name: ntdll Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating System
Module Size: 768.00 KBytes Product Version: 5.2.3790.1830
Symbol File Name:
c:\symcache\ntdll.pdb\DCE823FCF71A4BF5AA489994520EA18F2\ntdll.pdb Special
Build: &

Script Summary
Script Name Status Error Code Error Source Error Description Source Line
IISAnalysis.asp Completed

0 new messages