Recently i received the error log below in my windows Server 2012.
Some consequences like web site down happens and a 503 error are launching in the browser.
I caught up on updates in OS and i have searching for this problems, that let me to do some options like:
Remove net.tcp, net.pipe, net.msmq, and msmq.formatname bindings
Install KB2640103 hotfix, that needs to ask for Microsoft Support Customer.
I'm not an expert in Windows Server but would like to understand the situation and receive more comments.
APPLICATION LOG
Log Name: Application Source: Application Error EventId: 1000
Faulting application name: w3wp.exe, version: 8.0.9200.16384, time
stamp: 0x50108835
Faulting module name: clr.dll, version: 4.0.30319.18449, time stamp:
0x528fdca2 Exception code: 0xc00000fd
Fault offset: 0x000000000010c0c5
Faulting process id: 0x474
Faulting application start time: 0x01d05204681c00ea
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path:
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Report Id: 49a3bf22-bdf8-11e4-944f-22000afcadb1
Faulting package full name:
Faulting package-relative application ID:
SYSTEM LOG
WAS
Application pool 'v3.xxxxx.com.br' is being automatically
disabled due to a series of failures in the process(es) serving that
application pool.
A process serving application pool 'v3.xxxxx.com.br' suffered a
fatal communication error with the Windows Process Activation Service.
The process id was '4492'. The data field contains the error number.
I solved my problem in 5 steps:
1) I installed a software to get a crash dump. In this case i downloaded the
DebugDiag Tools.
2) I configured the DebugDiag Tool following these instructions in this post
. I didn't need to install WindDbg and Symbols.
After the installation it was configured in this way:
Selecting a Crash rule
Selecting a IIS App pool (w3wp.exe)
Selecting the app pool of my application
Configuring a Stack over flow exception (0xc00000fd) in Advanced Settings/Exceptions and finishing the setup.
3) I waited for a first crash dump to be created in a folder location. Ex: C:\DebugDiag\Logs When the crash dump was created, i used the DebugDiag Analysis to open the file from C:\DebugDiag\Logs and a HTML report has been created.
4) In report was easy to see the problem. In my case, there was a recursive function without stop conditional. It was crashing the w3wp process.
5) Our team fixed the bug and solved the problem
What you have tried is less relevant.
0xc00000fd means stack overflow. Thus, you need to review your code to see if it was caused by yours. If you were able to get a crash dump, that can provide more information about why it crashes.
Related
So I've been developing this program for a while now... Its meant to act as an asset manager (and potentially more in the future) for our IT team. I have 2 services which we'll refer to as "Manager" and "IAM" for right now. The "Manager" does all things managerial for all services (currently only the inventory asset manager known as "IAM") such as automatic updates, etc., while the asset manager does its job.
Anyways, its been working great for a while now. Recently I implemented an automatic updating feature (actually still needing to be tested and likely debugged). While doing this, I needed to get my naming consistent (for example, renaming my service from "Updater" and "CppWindowsService" to the software's actual name).
Before this, it had been working great! Started, stopped, installed, and uninstalled with no hiccups. I change the name for everything, and make sure it all compiles ok. Looks good. Install works great for both "Manager" and "IAM" now, but as soon as I try to start it, I get:
StartService failed (1053)
Also, when I try to start it from services.msc, then I get the following error message:
Windows could not start the service on Local Computer.
Error 1053: The service did not respond to the start or control request in a timely fashion
The strange thing about this though is that it doesn't wait for any sort of timeout. It just instantly spits out the message. That message comes from the code called from my wmain() (windows entry point. main() otherwise.) function.
if (!StartService(
schService, // handle to service
0, // number of arguments
NULL)) // no arguments
{
printf("StartService failed (%d)\n", GetLastError());
CloseServiceHandle(schService);
CloseServiceHandle(schSCManager);
return;
}
else printf("Service start pending...\n");
In Windows Event Log, I get an application error containing the following details after fault.
Faulting application name: InITManager.exe, version: 0.0.0.0, time stamp: 0x59e11e44
Faulting module name: ucrtbase.dll, version: 10.0.15063.674, time stamp: 0x8ac9f9d4
Exception code: 0xc0000409
Fault offset: 0x000000000007350e
Faulting process id: 0x3008
Faulting application start time: 0x01d346915918e17d
Faulting application path:
C:\Users\collin.walker\Desktop\InITService\C++\x64\Release\Manager.exe
Faulting module path: C:\WINDOWS\System32\ucrtbase.dll
Report Id: 7fcbdcc4-be8e-476a-960f-4fa1fb21f892
Faulting package full name:
Faulting package-relative application ID:
Other info: ucrtbase.dll is used by Visual Studio and is associated with the Release build, where as ucrtbased.dll is associated with the debugger build. I am building in Release mode.
Now, I've already been told the issue isn't my code, but if anyone feels as though they need to see it, I will include it then. Its very straightforward c++ winapi stuff though.
If anyone has any further suggestions on how to troubleshoot this, please let me know, and thanks for all help in advance!
Kind of forgot about this post during my troubleshooting... Anyways, I figured it out. Comments above were spot on!
For me the buffer overflow came from me changing my service names, which also changed the program directory names. The error was happening when I was initializing my logging object in my service's constructor. I only have like 2 lines of code in the constructor, so I totally forgot to look there. Changed the hardcoded directory location where the log was being created, and it all started working great! Thanks guys for the helpful info!
Since a couple of weeks we get this error in our application log:
Faulting application name: svchost.exe_TermServLicensing, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: tls236.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c9d9
Exception code: 0xc0000005
Fault offset: 0x0000000000002c5d
Faulting process id: 0x7b8
Faulting application start time: 0x01cf87bdab8c4711
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\system32\tls236.dll
Report Id: 8b454229-f471-11e3-858c-005056976264
I can't find the error somewhere else on the internet. Does anyone have a solution for this? Its specific about the faulting module path: C:\Windows\system32\tls236.dll
Server is running Windows server 2008 R2 64-Bit.
We have 4 Terminal Servers (windows server 2008 R2 64-bit) who make connection with this server for the CAL's.
I don't know what further information is needed but if its needed please let me know and i'll post it.
Edit
there is no way i can reproduce this error. Sometimes i see it twice a day and some times i see it once each 2 days. So when some has a solution it will take time to notice if its solved or not.
Here's a lot of good information that may help you. Particularly the last post in the thread.
svchost.exe_TermService crashes after installation of KB2621440
Background:
Our company uses Crystal Reports in our legacy product written in VB6 which I'm performing some maintenance duties for.
Its using version 8.5.0.217 [RTM] with no service packs.
The Problem:
Has worked perfectly on Windows XP x86 to date.
In Windows 7 [x86 and x64] we get an Access Violation followed by an application crash and no further usable error information.
The Details:
The application crashes with a large datasets for any report using the active x viewer.
Visual Studio will crash whilst debugging.
The offending code is here:
Crv_Obj(0).ReportSource = ReportParametersFrm.Report
Crv_Obj(0).EnablePopupMenu = True
Crv_Obj(0).ViewReport
I have checked that:
Crv_Obj(0) is a valid object reference.
ReportParametersFrm.Report is a valid reference.
The only information I have is from the event viewer:
Faulting application name: Pyramid.exe, version: 2.2.0.8, time stamp: 0x51e53053
Faulting module name: craxdrt.dll, version: 8.5.0.217, time stamp: 0x3a849e1a
Exception code: 0xc0000005
Fault offset: 0x002ac3d1
Faulting process id: 0x15a8
Faulting application start time: 0x01ce8228a295c8c8
Faulting application path: C:\Program Files\Pyramid\Pyramid.exe
Faulting module path: C:\Program Files\Pyramid\CrystalSys\craxdrt.dll
I have also tried:
Disabling the DEP to no effect.
Changing Compatibility to Windows XP and below.
Running as both privileged and nonprivileged users.
Tried adding in new error handlers to catch the error
[Fruitlessly] searching on Google and this site.
Contacting SAP [to then be ignored].
What I need help with:
Have you seen this before?
Are there any workarounds or something I should be looking for that is obviously wrong?
Is there more recent version of Crystal that supports VB6 or at least
an upgrade path that you know of that I can attempt?
Any and all help would be most appreciated.
After quite a lot of research and digging around it seems that a slightly newer version of craxdrt.dll crviewer.dll fixes the problem.
Simply a case of replacing these libraries in the application lib folder and in C:\Windows\System32\
I've put a copy of the libs here in the event anyone else has this problem as there was very little consistent help/information out there on the internet.
I have a Windows application scheduled to run on a daily basis and fails intermittently as per the following log in EventViewer.
Faulting application name: MyApplication.exe, version: 1.0.0.0, time stamp: 0x4d54829a
Faulting module name: clr.dll, version: 4.0.30319.1, time stamp: 0x4ba21eeb
Exception code: 0xc0000005
Fault offset: 0x00000000000029e1
Faulting process id: 0xbb1c
Faulting application start time: 0x01cbd99223d8b4eb
Faulting application path: E:\MyApplication\MyApplication.exe
Faulting module path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll
Report Id: 7e74ec7e-45a5-11e0-a95d-003048de380d
And in the second EventViewer log it says:
The process was terminated due to an internal error in the .NET Runtime at IP 000007FEF97329E1 (000007FEF9730000) with exit code 80131506.
The server is Win Server 2008 R2 and the application uses .Net 4.0 (as you can see in the error log too).
The application uses multi-threading intensively and reads from a remote database and writes to local hard disk.
Any guesses on what causes this issue and any suggestions on how to investigate? I have no idea where it fails in the life of the application which is about 5-10 hours.
I'm having the same issue. At approximately 8-10 hours of application life CLR error rises. I suspected my unmanaged code generating exception in the background thread. However I could not really find out why. You can give the following a try however:
If you are using unmanaged code review exception handling statements
while executig it.
Make sure you have the latest fixes of .NET4.
(https://connect.microsoft.com/VisualStudio/Downloads)
Please let me know if you have already found a solution.
I had a similar problem, so this can help future user to find a solution :
We use Apache log4net for application log.
After an update to DLL version 1.2.15, for dotnet Framwork 4.5 it starts to fire this exact exception once the log file reach the maximal size (10MB)
The hot-fix has mostly vanished and I faced a similar issue, so I'll share my answer here.
My solution revolved around the fact that I was passing a Lamda to a P/Invoke:
https://stackoverflow.com/a/52360307/4700841
after migrating our production web application to a new server we are encountering an error which is quite hard to track down:
Faulting application name: w3wp.exe, version: 7.5.7600.16385, time stamp: 0x4a5bd0eb
Faulting module name: KERNELBASE.dll, version: 6.1.7600.16385, time stamp: 0x4a5bdfe0
Exception code: 0xebf00baa
Fault offset: 0x000000000000aa7d
Faulting process id: 0xc90
Faulting application start time: 0x01cb9ddb02758bf5
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: ceecffda-0c1c-11e0-9900-0019998d9a4d
Basically, it kills the worker process and restarts the web application afterwards.
WER is unable to produce a dump and even process orphaning in IIS7 does not help -- the worker process is terminated immediately and no dump is created.
The application will run just fine for a couple of days and then crash with this error.
Has anyone ever dealt with this error?
I suggest you go to ask for DebugDiag 1.2 beta from Microsoft, http://blogs.msdn.com/b/tess/archive/2010/09/30/debug-diag-1-2-beta.aspx
That should give you a dump file to analyze. Or you can share it with Microsoft via http://support.microsoft.com