Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

IIS Worker Process w3wp.exe hangs debugdiag log help

680 views

Skip to first unread message

Scott Trick

unread,

Jun 12, 2009, 8:56:01 PM6/12/09

We have an iis worker process that hangs for up to a few minutes, or until
the user clicks the refresh button.

I ran a debugdiag on the w3wp process and here are the results.

Any help figuring out what the log is telling me is much appreciated.

Thank You!

Scott

------------------------------------------

Analysis Summary
Type Description Recommendation
Warning The following threads in server 3 fail2.dmp are waiting on data to
be returned from another server via WinSock.

The call to WinSock originated from wininet!ICAsyncThread::SelectThread+242

( 18 )

4.55% of threads blocked

Ensure that any remote server this application may be calling is
functioning properly and there are no network issues between the two servers.
If the problem continues, please contact the application vendor for further
assistance

Analysis Details
Table Of Contents
server 3 fail2.dmp
Top 5 threads by CPU time
Thread report
Well-Known COM STA Threads Report
HTTP Report

Report for server 3 fail2.dmp
Type of Analysis Performed Hang Analysis
Machine Name PSPT0003
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 4
Process ID 4716
Process Image C:\WINDOWS\SysWOW64\inetsrv\w3wp.exe
System Up-Time 0 day(s) 23:32:15
Process Up-Time 0 day(s) 00:03:34

Top 5 Threads by CPU time
Note - Times include both user mode and kernel mode for each thread Thread
ID: 14 Total CPU Time: 0 day(s) 00:00:18.921 Entry Point for Thread:
XRserver+4e40
Thread ID: 9 Total CPU Time: 0 day(s) 00:00:07.656 Entry Point for
Thread: w3tp!THREAD_MANAGER::ThreadManagerThread
Thread ID: 7 Total CPU Time: 0 day(s) 00:00:04.921 Entry Point for
Thread: w3tp!THREAD_MANAGER::ThreadManagerThread
Thread ID: 17 Total CPU Time: 0 day(s) 00:00:00.218 Entry Point for
Thread: ole32!CRpcThreadCache::RpcWorkerThreadEntry
Thread ID: 0 Total CPU Time: 0 day(s) 00:00:00.125 Entry Point for
Thread: w3wp!wmainCRTStartup

Thread report

Thread 0 - System ID 4688
Entry point w3wp!wmainCRTStartup
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:0.78
Time spent in kernel mode 0 Days 0:0:0.46

Function Source
ntdll!ZwWaitForSingleObject+15
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3dt!WP_CONTEXT::RunMainThreadLoop+10
w3dt!UlAtqStartListen+2d
w3core!W3_SERVER::StartListen+bd
w3core!UlW3Start+26e
w3wp!wmain+22a
w3wp!wmainCRTStartup+12f
kernel32!BaseProcessStart+28

Thread 1 - System ID 4700
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForMultipleObjects+15
ntdll!EtwpWaitForMultipleObjectsEx+f7
ntdll!EtwpEventPump+27f
kernel32!BaseThreadStart+34

Thread 2 - System ID 4632
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!NtDelayExecution+15
ntdll!RtlpTimerThread+47
kernel32!BaseThreadStart+34

Thread 3 - System ID 4648
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 4 - System ID 3128
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwReplyWaitReceivePortEx+12
rpcrt4!LRPC_ADDRESS::ReceiveLotsaCalls+198
rpcrt4!RecvLotsaCallsWrapper+d
rpcrt4!BaseCachedThreadRoutine+9d
rpcrt4!ThreadStartRoutine+1b
kernel32!BaseThreadStart+34

Thread 5 - System ID 4672
Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForSingleObject+15
kernel32!WaitForSingleObjectEx+ac
ole32!CRpcThread::WorkerLoop+a2
ole32!CRpcThreadCache::RpcWorkerThreadEntry+20
kernel32!BaseThreadStart+34

Thread 6 - System ID 4880
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
kernel32!GetQueuedCompletionStatus+29
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34

Thread 7 - System ID 4868
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:1.31
Time spent in kernel mode 0 Days 0:0:3.890

Thread 8 - System ID 4884
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Thread 9 - System ID 4824
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:1.656
Time spent in kernel mode 0 Days 0:0:6.0

Thread 10 - System ID 4852
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForMultipleObjects+15
ntdll!RtlpWaitThread+161
kernel32!BaseThreadStart+34

Thread 11 - System ID 4920
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForSingleObject+15
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3core!HTTP_COMPRESSION::CompressionThread+126
kernel32!BaseThreadStart+34

Thread 12 - System ID 4980
Entry point rpcrt4!ThreadStartRoutine
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Thread 13 - System ID 4888
Entry point ntdll!RtlpIOWorkerThread
Create time 6/12/2009 3:24:06 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!NtDelayExecution+15
ntdll!RtlpIOWorkerThread+3f
kernel32!BaseThreadStart+34

Thread 14 - System ID 5056
Entry point XRserver+4e40
Create time 6/12/2009 3:24:07 PM
Time spent in user mode 0 Days 0:0:11.281
Time spent in kernel mode 0 Days 0:0:7.640

This thread is not fully resolved and may or may not be a problem. Further
analysis of these threads may be required.

Function Source
ntdll!ZwSuspendThread+15
kernel32!SuspendThread+12
XRserver!DllUnregisterServer+1e8e8b
XRserver!DllUnregisterServer+1c37a5
XRserver!DllUnregisterServer+15ac6e
XRserver!DllUnregisterServer+15d8e3
XRserver!DllUnregisterServer+15c81b
XRserver!DllUnregisterServer+15c9da
XRserver!DllUnregisterServer+14c818
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+188ced
XRserver!DllUnregisterServer+1895e0
XRserver!DllUnregisterServer+18bf94
XRserver!DllUnregisterServer+156752
XRserver!DllUnregisterServer+17ccd5
XRserver!DllUnregisterServer+17dad9
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585
XRserver!DllUnregisterServer+15d7af
XRserver!DllUnregisterServer+15c81b
XRserver!DllUnregisterServer+15c9da
XRserver!DllUnregisterServer+14c818
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+188ced
XRserver!DllUnregisterServer+1895e0
XRserver!DllUnregisterServer+18d0bc
XRserver+4e6a
kernel32!BaseThreadStart+34

Thread 15 - System ID 3256
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForMultipleObjects+15
netapi32!NetbiosWaiter+73
kernel32!BaseThreadStart+34

Thread 16 - System ID 3536
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 17 - System ID 556
Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry
Create time 6/12/2009 3:24:47 PM
Time spent in user mode 0 Days 0:0:0.109
Time spent in kernel mode 0 Days 0:0:0.109

Function Source
user32!NtUserGetMessage+15
ole32!CDllHost::STAWorkerLoop+72
ole32!CDllHost::WorkerThread+c8
ole32!DLLHostThreadEntry+d
ole32!CRpcThread::WorkerLoop+26
ole32!CRpcThreadCache::RpcWorkerThreadEntry+20
kernel32!BaseThreadStart+34

Thread 18 - System ID 3092
Entry point wininet!ICAsyncThread::SelectThreadWrapper
Create time 6/12/2009 3:24:48 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

This thread is waiting on data to be returned from another server via WinSock.

The call to WinSock originated from wininet!ICAsyncThread::SelectThread+242

Function Source
ntdll!ZwWaitForSingleObject+15
mswsock!SockWaitForSingleObject+19d
mswsock!WSPSelect+380
ws2_32!select+b9
wininet!ICAsyncThread::SelectThread+242
wininet!ICAsyncThread::SelectThreadWrapper+d
kernel32!BaseThreadStart+34

Thread 19 - System ID 3840
Entry point mswsock!SockAsyncThread
Create time 6/12/2009 3:24:48 PM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
mswsock!SockAsyncThread+69
kernel32!BaseThreadStart+34

Thread 20 - System ID 3320
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 21 - System ID 3844
Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Well-Known COM STA Threads Report
STA Name Thread ID Thread Status Call Status

Main STA 17 Unknown
Apartment-threaded host for MTA clients 17 Unknown

HTTP report
IIS ATQ worker thread count 4 Thread(s)
Available ATQ worker thread count 4 Thread(s)
Active client connections 20 client connection(s)

Client Connections
20 connection(s) waiting for the next request.

Script Summary

Ken Schaefer

unread,

Jun 14, 2009, 12:12:09 AM6/14/09

What is XRServer?

Also, it seems you are using something that is calling into WinSock to make
requests to a remote server, and that is being called by WinInet. By default
that has a limit of two concurrent connections to remote hosts, so that
could result in blocking behavior for other threads.

Cheers
Ken

"Scott Trick" <Scott...@discussions.microsoft.com> wrote in message
news:308037E2-1AC6-4DEB...@microsoft.com...

Scott Trick

unread,

Jun 16, 2009, 9:31:01 AM6/16/09

Hi Ken,

XRServer is a 3rd party dll and is called by the worker process.

Unfortunately I do not know what is calling Winsock.

I did run another debugdiag after waiting about a minute and have a new
error in the analysis summary.

When I follow the dump it leads to Thread 7 with this message:

'This thread is making a COM call to thread 15 within the same process'

Could this be the reason for the hang?

Thanks!

Here is the dump:

Analysis Summary
Type Description Recommendation
Warning The following threads in

w3wp.exe__Eagle__PID__3664__Date__06_16_2009__Time_08_53_53AM__710__Manual
Dump.dmp are waiting on data to be returned from another server via WinSock.

The call to WinSock originated from wininet!ICAsyncThread::SelectThread+242

( 16 )

4.35% of threads blocked

Warning 1 client connection(s) in
w3wp.exe__Eagle__PID__3664__Date__06_16_2009__Time_08_53_53AM__710__Manual
Dump.dmp have been executing a request for more than 90 seconds. Please see
the Client Connections section of this report for more detailed information
about the connection(s).

Analysis Details
Table Of Contents

w3wp.exe__Eagle__PID__3664__Date__06_16_2009__Time_08_53_53AM__710__Manual
Dump.dmp

Top 5 threads by CPU time

Thread report

Well-Known COM STA Threads Report

HTTP Report

Report for
w3wp.exe__Eagle__PID__3664__Date__06_16_2009__Time_08_53_53AM__710__Manual
Dump.dmp

Type of Analysis Performed Hang Analysis
Machine Name PSPT0003
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 4

Process ID 3664

Process Image C:\WINDOWS\SysWOW64\inetsrv\w3wp.exe

System Up-Time 0 day(s) 19:54:19
Process Up-Time 0 day(s) 00:06:29

Top 5 Threads by CPU time
Note - Times include both user mode and kernel mode for each thread Thread

ID: 13 Total CPU Time: 0 day(s) 00:00:26.468 Entry Point for Thread:
XRserver+4e40
Thread ID: 7 Total CPU Time: 0 day(s) 00:00:09.828 Entry Point for
Thread: w3tp!THREAD_MANAGER::ThreadManagerThread
Thread ID: 5 Total CPU Time: 0 day(s) 00:00:08.140 Entry Point for
Thread: w3tp!THREAD_MANAGER::ThreadManagerThread
Thread ID: 15 Total CPU Time: 0 day(s) 00:00:00.250 Entry Point for
Thread: ole32!CRpcThreadCache::RpcWorkerThreadEntry
Thread ID: 0 Total CPU Time: 0 day(s) 00:00:00.218 Entry Point for
Thread: w3wp!wmainCRTStartup

Thread report

Thread 0 - System ID 728
Entry point w3wp!wmainCRTStartup
Create time 6/16/2009 8:47:24 AM

Time spent in user mode 0 Days 0:0:0.109
Time spent in kernel mode 0 Days 0:0:0.109

Function Source

ntdll!ZwWaitForSingleObject+15
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3dt!WP_CONTEXT::RunMainThreadLoop+10
w3dt!UlAtqStartListen+2d
w3core!W3_SERVER::StartListen+bd
w3core!UlW3Start+26e
w3wp!wmain+22a
w3wp!wmainCRTStartup+12f
kernel32!BaseProcessStart+28

Thread 1 - System ID 2948

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!NtDelayExecution+15
ntdll!RtlpTimerThread+47
kernel32!BaseThreadStart+34

Thread 2 - System ID 184
Entry point rpcrt4!ThreadStartRoutine
Create time 6/16/2009 8:47:25 AM

Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Thread 3 - System ID 3596
Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry
Create time 6/16/2009 8:47:25 AM

Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForSingleObject+15
kernel32!WaitForSingleObjectEx+ac

ole32!CRpcThread::WorkerLoop+a2
ole32!CRpcThreadCache::RpcWorkerThreadEntry+20
kernel32!BaseThreadStart+34

Thread 4 - System ID 2196
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/16/2009 8:47:25 AM

Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15

kernel32!GetQueuedCompletionStatus+29
w3tp!THREAD_POOL_DATA::ThreadPoolThread+33
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34

Thread 5 - System ID 3568
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/16/2009 8:47:25 AM
Time spent in user mode 0 Days 0:0:2.625
Time spent in kernel mode 0 Days 0:0:5.515

Thread 6 - System ID 228
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/16/2009 8:47:25 AM

Time spent in user mode 0 Days 0:0:0.0

Time spent in kernel mode 0 Days 0:0:0.15

Thread 7 - System ID 3728
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 6/16/2009 8:47:25 AM
Time spent in user mode 0 Days 0:0:4.281
Time spent in kernel mode 0 Days 0:0:5.546

This thread is making a COM call to thread 15 within the same process

Function Source
ntdll!ZwWaitForSingleObject+15
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12

ole32!GetToSTA+7c
ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+cb
ole32!CRpcChannelBuffer::SendReceive2+d3
ole32!CAptRpcChnl::SendReceive+ab
ole32!CCtxComChnl::SendReceive+1a9
rpcrt4!NdrProxySendReceive+43
rpcrt4!NdrClientCall2+206
oleaut32!IDispatch_RemoteInvoke_Proxy+1c
oleaut32!IDispatch_Invoke_Proxy+b6
XRserver!DllUnregisterServer+106e6f
XRserver!DllUnregisterServer+1224ca
XRserver!DllUnregisterServer+122866
XRserver!DllUnregisterServer+18cf9f
XRserver!DllUnregisterServer+18d414
oleaut32!DispCallFunc+16a
oleaut32!CTypeInfo2::Invoke+234
XRserver+20414
Ajax!TerminateExtension+f50
Ajax!TerminateExtension+1200
Ajax+11778
Ajax!TerminateExtension+5df26
Ajax!TerminateExtension+655a5
Ajax!TerminateExtension+5eff3
Ajax+29ff2
Ajax+2af49
Ajax+2b14f
Ajax+2c7b0
Ajax+2c719
Ajax+2d695
Ajax+2fd07
Ajax!HttpExtensionProc+4d
w3isapi!ProcessIsapiRequest+214
w3core!W3_ISAPI_HANDLER::IsapiDoWork+3fd
w3core!W3_ISAPI_HANDLER::OnCompletion+7e
w3core!W3_HANDLER::MainOnCompletion+52
w3core!W3_CONTEXT::ExecuteHandlerCompletion+23
w3core!W3_MAIN_CONTEXT::DoWork+91
w3core!W3_MAIN_CONTEXT::OnIoCompletion+37
w3dt!UL_NATIVE_REQUEST::DoStateProcess+48
w3dt!UL_NATIVE_REQUEST::DoWork+7f
w3dt!OverlappedCompletionRoutine+1a
w3tp!THREAD_POOL_DATA::ThreadPoolThread+73

w3tp!THREAD_POOL_DATA::ThreadPoolThread+24
w3tp!THREAD_MANAGER::ThreadManagerThread+39
kernel32!BaseThreadStart+34

Thread 15 - System ID 2780
Entry point ole32!CRpcThreadCache::RpcWorkerThreadEntry
Create time 6/16/2009 8:48:39 AM
Time spent in user mode 0 Days 0:0:0.125
Time spent in kernel mode 0 Days 0:0:0.125

Function Source
ntdll!ZwWaitForMultipleObjects+15
kernel32!WaitForMultipleObjectsEx+11a
user32!RealMsgWaitForMultipleObjectsEx+152
user32!MsgWaitForMultipleObjects+1f
urlmon!CTransaction::CompleteOperation+6c
urlmon!CTransaction::StartEx+548
urlmon!CTransaction::Start+39
msxml3!CXMLHTTP::send+146
msxml3!XMLHTTPWrapper::send+6a
oleaut32!DispCallFunc+16a
oleaut32!CTypeInfo2::Invoke+234
msxml3!_dispatchImpl::Invoke+9b
msxml3!__dispatch::Invoke+2b
msxml3!_dispatch<IMXAttributes,&LIBID_MSXML2,&IID_IMXAttributes>::Invoke+2a

oleaut32!IDispatch_Invoke_Stub+52
oleaut32!IDispatch_RemoteInvoke_Thunk+5b
rpcrt4!NdrStubCall2+214
rpcrt4!CStdStubBuffer_Invoke+c6
oleaut32!CStubWrapper::Invoke+9f
ole32!SyncStubInvoke+37
ole32!StubInvoke+a7
ole32!CCtxComChnl::ContextInvoke+ec
ole32!MTAInvoke+1a
ole32!STAInvoke+48
ole32!AppInvoke+a3
ole32!ComInvokeWithLockAndIPID+2c5
ole32!ComInvoke+ca
ole32!ThreadDispatch+23
ole32!ThreadWndProc+fe
user32!InternalCallWinProc+28
user32!UserCallWinProcCheckWow+114
user32!DispatchMessageWorker+37b
user32!DispatchMessageW+f
ole32!CDllHost::STAWorkerLoop+5c

ole32!CDllHost::WorkerThread+c8
ole32!DLLHostThreadEntry+d
ole32!CRpcThread::WorkerLoop+26
ole32!CRpcThreadCache::RpcWorkerThreadEntry+20
kernel32!BaseThreadStart+34

Thread 8 - System ID 176

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForMultipleObjects+15
ntdll!RtlpWaitThread+161
kernel32!BaseThreadStart+34

Thread 9 - System ID 3076

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForSingleObject+15
kernel32!WaitForSingleObjectEx+ac
kernel32!WaitForSingleObject+12
w3core!HTTP_COMPRESSION::CompressionThread+126
kernel32!BaseThreadStart+34

Thread 10 - System ID 3192
Entry point rpcrt4!ThreadStartRoutine
Create time 6/16/2009 8:47:25 AM

Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Thread 11 - System ID 3820
Entry point ntdll!RtlpIOWorkerThread
Create time 6/16/2009 8:47:25 AM

Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!NtDelayExecution+15
ntdll!RtlpIOWorkerThread+3f
kernel32!BaseThreadStart+34

Thread 12 - System ID 3884

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 13 - System ID 3180
Entry point XRserver+4e40
Create time 6/16/2009 8:48:32 AM
Time spent in user mode 0 Days 0:0:16.250
Time spent in kernel mode 0 Days 0:0:10.218

This thread is not fully resolved and may or may not be a problem. Further
analysis of these threads may be required.

Function Source
ntdll!ZwSuspendThread+15
kernel32!SuspendThread+12
XRserver!DllUnregisterServer+1e8e8b

XRserver!DllUnregisterServer+12187e
XRserver!DllUnregisterServer+122842
XRserver!DllUnregisterServer+14b87d
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585
XRserver!DllUnregisterServer+14c38b
XRserver!DllUnregisterServer+17da25

XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585
XRserver!DllUnregisterServer+15d7af
XRserver!DllUnregisterServer+15c81b
XRserver!DllUnregisterServer+15c9da
XRserver!DllUnregisterServer+14c818
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+188ced
XRserver!DllUnregisterServer+1895e0
XRserver!DllUnregisterServer+18bf94
XRserver!DllUnregisterServer+156752
XRserver!DllUnregisterServer+17ccd5
XRserver!DllUnregisterServer+17dad9
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585

XRserver!DllUnregisterServer+14c38b
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585
XRserver!DllUnregisterServer+14c38b
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585
XRserver!DllUnregisterServer+14c38b
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585
XRserver!DllUnregisterServer+14c38b
XRserver!DllUnregisterServer+17da25
XRserver!DllUnregisterServer+17e169
XRserver!DllUnregisterServer+17e585
XRserver!DllUnregisterServer+1c381e

Thread 14 - System ID 3684

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwWaitForMultipleObjects+15
netapi32!NetbiosWaiter+73
kernel32!BaseThreadStart+34

Thread 16 - System ID 1824
Entry point wininet!ICAsyncThread::SelectThreadWrapper
Create time 6/16/2009 8:48:40 AM
Time spent in user mode 0 Days 0:0:0.15

Time spent in kernel mode 0 Days 0:0:0.0

This thread is waiting on data to be returned from another server via WinSock.

The call to WinSock originated from wininet!ICAsyncThread::SelectThread+242

Thread 17 - System ID 2492
Entry point mswsock!SockAsyncThread
Create time 6/16/2009 8:48:40 AM

Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
mswsock!SockAsyncThread+69
kernel32!BaseThreadStart+34

Thread 18 - System ID 2600

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 19 - System ID 3800

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 20 - System ID 2468

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 21 - System ID 2112

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Thread 22 - System ID 3808

Create time 12:00:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0

Function Source
ntdll!ZwRemoveIoCompletion+15
ntdll!RtlpWorkerThread+3d
kernel32!BaseThreadStart+34

Well-Known COM STA Threads Report
STA Name Thread ID Thread Status Call Status

Main STA 15 In-Call
Apartment-threaded host for MTA clients 15 In-Call

HTTP report
IIS ATQ worker thread count 4 Thread(s)

Available ATQ worker thread count 3 Thread(s)

Active client connections 20 client connection(s)

Client Connections
Client connection from 10.104.101.90:61224 to 10.134.2.121:80
Host Header pspt0003.ci.root:80
POST request for /eagle/master.xra
HTTP Version HTTP/1.1
SSL Request False
Time alive 0 day(s) 00:02:01
QueryString
Request mapped to
HTTP Request State HTR_READING_CLIENT_REQUEST
Native Request State NREQ_STATE_PROCESS
Connection serviced by Thread 7

19 connection(s) waiting for the next request.

Script Summary
Script Name Status Error Code Error Source Error Description Source Line
IISAnalysis.asp Completed

Scott Trick

unread,

Jun 23, 2009, 8:43:01 AM6/23/09

As it turns out the cause of this issue is the firewall between the DMZ and
our local LAN.

Even though we know it is the firewall our network team still cannot figure
out what is causing the hanging with IIS.

Other than ports, does anyone know what else in a firewall can cause IIS to
hang?

Thanks!

Scott

0 new messages