ntdll.dll is crashing IIS App Pool with 0xc0000008 - asp.net

I have an IIS Web App that has been consistently crashing every day after encountering a series of 0xc000008 exceptions. The error stops getting logged in event viewer after occurring 5 times, however I'm confident it stops after 5 occurrences because the IIS App Pool's Rapid-Fail Protection is configured to kick in after 5 exceptions. I am further convinced the Rapid-Fail Protection is kicking in because I have had to manually recycle/restart the App Pool everyday.
I installed DebugDiag to help trace the exceptions seen in Event Viewer but it has been just as vague as the errors in Event Viewer. At this point I have reached the edge of my very limited knowledge with IIS and ASP.NET and unfortunately haven't been able to try much because I can't get a sensible error message. I've included the error messages from each source below. Any help in understanding them or knowing where to go from here would be greatly appreciated it.
This is a MVC3 Web App written in C# using .NET Framework 4.5.2 running on Windows Server 2012 R2. All applicable windows updates have been installed.
I've enable Failed Request Tracing to hopefully get some more insight into the error.
Event Viewer Error
Faulting application name: w3wp.exe, version: 8.5.9600.16384, time stamp: 0x5215df96
Faulting module name: ntdll.dll, version: 6.3.9600.16502, time stamp: 0x52c359e8
Exception code: 0xc0000374
Fault offset: 0x00000000000f387c
Faulting process id: 0x1588
Faulting application start time: 0x01d239d9a9246e12
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 6dd5b05a-a5ce-11e6-80c5-005056bf6041
Faulting package full name:
Faulting package-relative application ID:
Error Analysis from DebugDiag
Report for w3wp__dataximg__PID__2168__Date__11_01_2016__Time_01_03_36PM__593__Second_Chance_Exception_C0000008.dmp
Type of Analysis Performed Combined Crash/Hang Analysis
Machine Name localhost
Operating System Windows Server 2012
Number Of Processors 2
Process ID 2168
Process Image c:\Windows\System32\inetsrv\w3wp.exe
Command Line c:\windows\system32\inetsrv\w3wp.exe -ap "dataximg" -v "v2.0" -l "webengine4.dll" -a \\.\pipe\iisipm21b77437-5c32-41dc-958b-556a03f34971 -h "C:\inetpub\temp\apppools\dataximg\dataximg.config" -w "" -m 0 -t 20 -ta 0
System Up-Time 35 day(s) 23:08:46
Process Up-Time 00:00:07
Processor Type X64
Process Bitness 64-Bit
Top 5 Threads by CPU time
Note - Times include both user mode and kernel mode for each thread
Thread ID: 0 Total CPU Time: 00:00:00.030 Entry Point for Thread: w3wp!wmainCRTStartup
Thread ID: 2 Total CPU Time: 00:00:00.015 Entry Point for Thread: ntdll!TppWorkerThread
Thread ID: 1 Total CPU Time: 00:00:00.000 Entry Point for Thread: nativerd!NOTIFICATION_THREAD::ThreadProc
Thread ID: 3 Total CPU Time: 00:00:00.000 Entry Point for Thread: ntdll!TppWorkerThread
Thread ID: 4 Total CPU Time: 00:00:00.000 Entry Point for Thread: w3tp!THREAD_MANAGER::ThreadManagerThread
Exception Information
In w3wp__appimg__PID__2168__Date__11_01_2016__Time_01_03_36PM__593__Second_Chance_Exception_C0000008.dmp the assembly instruction at ntdll!KiRaiseUserExceptionDispatcher+3a in C:\Windows\System32\ntdll.dll from Microsoft Corporation has caused an unknown exception (0xc0000008) on thread 1
Module Information
Image Name: C:\Windows\System32\ntdll.dll Symbol Type: PDB
Base address: 0x00000003`00905a4d Time Stamp: Tue Dec 31 18:57:28 2013
Checksum: 0x00000000`00000000 Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: NT Layer DLL
ISAPIFilter: False File Version: 6.3.9600.16502 (winblue_gdr.131231-1531)
Managed DLL: False Internal Name: ntdll.dll
VB DLL: False Legal Copyright:© Microsoft Corporation. All rights reserved.
Loaded Image Name: ntdll.dll Legal Trademarks:
Mapped Image Name: Original filename: ntdll.dll
Module name: ntdll Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating System
Module Size: 1.66 MBytes Product Version: 6.3.9600.16502
Symbol File Name: c:\symbols\ntdll.pdb\A525CD5C71214238B761A6EFA0B3402D1\ntdll.pdb Special Build: &

Related

IIS Connector ODBC 8.0\myodbc8a.dll fault

I am running Windows (Windows Server 2016 Datacenter) and i have a website running ODBC 32-bit applications.
The website has been running fine, no issues or errors, but Monday morning i start getting a Application Crash. It seems like its a problem with the ODBC connector?
I have uninstalled...reinstalled...updated...everything i can think of, but it still seems to crash about every 45 to 60 minutes.
Here is the error in my error log
Faulting application name: w3wp.exe, version: 10.0.14393.0, time stamp: 0x57899135
Faulting module name: myodbc8a.dll, version: 8.0.30.0, time stamp: 0x62a998e4
Exception code: 0xc0000409
Fault offset: 0x00185fec
Faulting process id: 0x1b4c
Faulting application start time: 0x01d92b13b7eebda1
Faulting application path: C:\Windows\SysWOW64\inetsrv\w3wp.exe
Faulting module path: C:\Program Files (x86)\MySQL\Connector ODBC 8.0\myodbc8a.dll
Report Id: 8efe2bd3-15ed-47a6-91a0-0de7e1b309c2
Faulting package full name:
Faulting package-relative application ID:
Has anyone ever had this type of issue before and found a fix?
Thank you for your help
-Brandon
uninstalled, installed drivers
upgraded the driver version.

Xamarin.Forms UWP application crashes on start

I built a Xamarin.Forms app. When I run the UWP version, it works on simulator, but when I install it on my Windows 10 machine from AppCenter, it crashes after splash screen. The same thing happens on a Surface tablet. iOS and Android both work fine. Here is what I see in the Event Viewer:
Application: MyApp.UWP.exe Framework Version: v4.0.30319 Description:
The process was terminated due to an unhandled exception. Exception
Info: exception code e06d7363, exception address 75D9FD82 Stack:
Faulting application name: MyApp.UWP.exe, version: 1.0.0.0, time
stamp: 0x5dbc5c1c Faulting module name: KERNELBASE.dll, version:
10.0.17763.652, time stamp: 0x57e2061a Exception code: 0xe0434352 Fault offset: 0x0011fd82 Faulting process id: 0x49ec Faulting
application start time: 0x01d590e87959548f Faulting application path:
C:\Program
Files\WindowsApps\818F3EF5.MyApp_4.0.1226.0_x86__gkbk8c6n1cpxt\MyApp.UWP.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll Report Id:
2b637e04-8d94-4651-9b19-fa8b0bc91743 Faulting package full name:
818F3EF5.MyApp_4.0.1226.0_x86__gkbk8c6n1cpxt Faulting package-relative
application ID: App
Fault bucket 1339835817727291998, type 5
Event Name: MoAppCrash
Response: Not available
Cab Id: 0
Problem signature: P1:
818F3EF5.MyApp_4.0.1226.0_x86__gkbk8c6n1cpxt P2: praid:App
P3: 1.0.0.0 P4: 5dbc5c1c P5: KERNELBASE.dll P6: 10.0.17763.652 P7:
57e2061a P8: e0434352 P9: 0011fd82 P10:
Attached files:
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER45C5.tmp.mdmp
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER471E.tmp.WERInternalMetadata.xml
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47AB.tmp.xml
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47A9.tmp.csv
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER47E9.tmp.txt
These files may be available here:
\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_818F3EF5.MyApp_24da81352882147d9bc94d42470a2ff1eda6615_f8efac89_037c4e60
Analysis symbol: Rechecking for solution: 0 Report Id:
2b637e04-8d94-4651-9b19-fa8b0bc91743 Report Status: 268435456 Hashed
bucket: f6c4afba0540ebc5f2980d93d4faf25e Cab Guid: 0
Any idea on what could cause this?

Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler (Faulting application name: w3wp.exe , Faulting module name: KERNEL32.DLL)

I am looking for a solution for 6 hours already. Please read before marking it duplicate. There are tens of other questions like this but none has valid answer that works on all.
My IIS 8 defaultapppool start crashing all of sudden after 5 threshold warnings of:
A process serving application pool 'DefaultAppPool' suffered a fatal communication error with the Windows Process Activation Service. The process id was '3604'. The data field contains the error number.
And then this is the Event Viewer Error after 5 warnings
Faulting application name: w3wp.exe, version: 8.5.9600.16384, time stamp: 0x52157ba0
Faulting module name: KERNEL32.DLL, version: 6.3.9600.17415, time stamp: 0x545049be
Exception code: 0xc00000fd
Fault offset: 0x0001bb0b
Faulting process id: 0xd04
Yesterday: It crashed once and I just did right click on application pool > start.
Today: It crashed again around the same time (not exact). stopped every 5 minutes 6-7 times then start working normal until now.
Recycling is every 29 hours, and I don't think its recycling.
I installed DebugDiag to log crash dump after the last crash. With the instruction in https://stackoverflow.com/a/18335759/9357872 but no crash after that to see the results. But the regular ongoing log is indicating the following CLR Exception error:
DebugDiag Log:
CLR Exception on thread 4976. DetailID = 10
ASP.global_asax on thread 4976. DetailID = 2
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler on thread 4008. DetailID = 7
I read that it is caused by using dynamics and memory leak; which I have never used in the whole website project
What is Microsoft.CSharp.RuntimeBinder.Semantics.LangCompiler ? I see there is something wrong in global.asax
Please help. Thanks.

Application pool crash on windows 2012 IIS 8.0 server

we are seeing following error in event logs after app pool crash once in a day. I am trying to understand what is the cause. Can some one advise.
Analysis symbol:
Rechecking for solution: 0
Report Id: cb7c6f90-419d-11e5-9417-005056935d0b
Report Status: 4
Hashed bucket: "
Error 8/13/2015 5:29:29 AM Application Error 1000 (100) "Faulting application name: w3wp.exe, version: 8.0.9200.16384, time stamp: 0x50108835
Faulting module name: sybdrvado20.dll, version: 2.157.1300.0, time stamp: 0x53c85084
Exception code: 0x40000015
Fault offset: 0x0000000000007c32
Faulting process id: 0x1c68
Faulting application start time: 0x01d0d59b5268bfa1
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\TEMP\Sybase.AdoNet4.AseClient.64bits.4.157.1300.0\sybdrvado20.dll
Report Id: cb7c6f90-419d-11e5-9417-005056935d0b
Faulting package full name:
Faulting package-relative application ID: "

warning occurring following move from classic to integrated on IIS7

I have migrated my c# asp.net web application from .net 3.5 to .net 4.0 and also changed the IIS7 application pool it runs to be Integrated rather than classic. The site runs fine but I have found the following warning been recorded in the server event log:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 26/09/2011 11:19:10
Event time (UTC): 26/09/2011 10:19:10
Event ID: 5e750da6db8544feaede11ed88c072f6
Event sequence: 2
Event occurrence: 1
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/3/ROOT-2-129615059474458846
Trust level: Full
Application Virtual Path: /
Application Path: << REMOVED >>
Machine name: << REMOVED >>
Process information:
Process ID: 5864
Process name: w3wp.exe
Account name: << REMOVED >>\app_user
Exception information:
Exception type: NullReferenceException
Exception message: Object reference not set to an instance of an object.
at System.Web.HttpApplication.set_AsyncResult(HttpAsyncResult value)
at System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext context, AsyncCallback cb, Object extraData)
at System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr)
Request information:
Request URL: http://127.0.0.1/dummy.context
Request path: /dummy.context
User host address: 127.0.0.1
User:
Is authenticated: False
Authentication Type:
Thread account name: << REMOVED >>\app_user
Thread information:
Thread ID: 22
Thread account name: << REMOVED >>\app_user
Is impersonating: False
Stack trace: at System.Web.HttpApplication.set_AsyncResult(HttpAsyncResult value)
at System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext context, AsyncCallback cb, Object extraData)
at System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr)
Custom event details:
Any ideas what may be causing this as I am stumped as to what it might be?
(tech difficulty: I'm having trouble to add a comment to yr question but it seems I can add it as an ansewer)
I am experiencing the same error. In this link https://jira.springsource.org/browse/SPRNET-1456 they say it's a bug that "won't be fixed"
I had this error and looked in the Event Viewer. Among several other errors, I had this one and another (which was an Information) :
Information 14/11/2011 13:54:04 Windows Error Reporting 1001 None
details:
Fault bucket , type 0
Event Name: CLR20r3
Response: Not available
Cab Id: 0
Problem signature:
P1: w3wp.exe
P2: 7.5.7601.17514
P3: 4ce7afa2
P4: mscorlib
P5: 4.0.0.0
P6: 4e1823db
P7: f5
P8: 9
P9: System.StackOverflowException
P10:
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_426513163e392f7b5e2712abb67e65a456d0f5_015c843b
Analysis symbol:
Rechecking for solution: 0
Report Id: b8a9aec0-0ebf-11e1-86d9-001d927c2d4c
Report Status: 0
So it was a stackoverflow. I guess that the error you see is just an artifact of another error. You should try to investigate for this other error. I don't say it will be a stackoverflow like mine, but it could be something else.

Resources