Microsoft Internet Information Services (IIS) may stop responding when an IIS process, such as Inetinfo.exe, Dllhost.exe, or W3wp.exe, stops unexpectedly.

IIS 5.0

You may experience the following symptoms in IIS 5.0:

• Events that resemble the following are logged in the System log:
  Message 1
  Event Type: Error
  Event Source: Service Control Manager
  Event Category: None
  Event ID: 7031
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  The IIS Admin Service service terminated unexpectedly. It has done this 7 time(s). The following corrective action will be taken in 0 milliseconds: No action.
  
  For more information, see Help and Support Center at http://support.microsoft.com.
  Message 2
  Event Type: Error
  Event Source: Service Control Manager
  Event Category: None
  Event ID: 7031
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  The World Wide Web Publishing Service service terminated unexpectedly. It has done this 7 time(s). The following corrective action will be taken in 0 milliseconds: No action.
  
  For more information, see Help and Support Center at http://support.microsoft.com.
• If the application protection level of the Web site is set to Medium (Pooled) or High (Isolated) and stops responding, users who browse a page on this Web site may receive an error message that resembles the following:
  The remote procedure call failed and did not execute.
  The following event message may also be logged in the System log:
  Event Type: Warning
  Event Source: W3SVC
  Event Category: None
  Event ID: 37
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  Out of process application '/LM/W3SVC/1/Root' terminated unexpectedly.
  
  For additional information specific to this message please visit the Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp.

IIS 6.0, 7.0, and 7.5

You may experience the following symptoms in IIS 6.0 or higher:

• Events that resemble the following are logged in the System log:
  Messge 1
  
  Event Type: Warning
  Event Source: W3SVC
  Event Category: None
  Event ID: 1009
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '1234'. The process exit code was '0xc0000005'.
  
  For more information, see Help and Support Center at http://support.microsoft.com.
  Message 2
  
  Event Type: Warning
  Event Source: W3SVC
  Event Category: None
  Event ID: 1011
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  A process serving application pool 'DefaultAppPool' suffered a fatal communication error with the World Wide Web Publishing Service. The process id was '1234'. The data field contains the error number.
  
  For more information, see Help and Support Center at http://support.microsoft.com.
  Data:
  0000: 6d 00 07 80
• The IIS process may disappear from Task Manager.
• You may receive one of the following Dr. Watson error messages:
  Error message 1
  
  Event Type: Information
  Event Source: Application Popup
  Event Category: None
  Event ID: 26
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  Application popup: inetinfo.exe - Application Error : The instruction at "0x01b2dc59" referenced memory at "0x00000008". The memory could not be "read". Click on OK to terminate the program
  
  For more information, see Help and Support Center at http://support.microsoft.com.
  Error message 2
  
  Event Type: Information
  Event Source: Application Popup
  Event Category: None
  Event ID: 26
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  Application popup: w3wp.exe - Application Error : The instruction at "0x7c82f350" referenced memory at "0x00000004". The memory could not be "written". Click on OK to terminate the program
  
  For more information, see Help and Support Center at http://support.microsoft.com.

When an IIS process that hosts a Web application stops unexpectedly, the system unloads the process, and all running requests are lost. To troubleshoot this scenario, you can use the Debug Diagnostic tool.

Use the Debug Diagnostics tool

You can use the Debug Diagnostic tool to generate and to analyze memory crash dumps. You want to capture a memory dump (.dmp) file before the process ends. To do this, follow these steps:

1. Download and then install the Debug Diagnostics 1.2 tool. To do this, visit the following Microsoft Web site:
   
   http://www.microsoft.com/download/en/details.aspx?id=26798 (http://www.microsoft.com/download/en/details.aspx?id=26798)
   
   
2. After you install the Debug Diagnostics tool, enable the Leave running when idle option for IIS 5.0 and IIS 5.1. To do this, follow these steps:
   1. Open the Component Services Microsoft Management Console (MMC) snap-in.
   2. Expand Component Services, expand Computers, expand My Computer, and then expand COM+ Applications
   3. Right-click any custom packages, Web sites, or Web directories, and then click Properties.
   4. Click the Advanced tab, click to select the Leave running when idle check box, and then click OK.
3. Disable the Enable debug exception catching option for IIS 5.0 and IIS 5.1. To do this, follow these steps:
   1. Open the IIS MMC snap-in.
   2. Right-click Web Sites, and then click Properties.
   3. Click the Home Directory tab, and then click Configuration.
   4. Click the Process Options tab, click to clear the Enable debug exception catching check box, and then click OK.
   5. Click OK to close the Web Sites Properties dialog box.
4. Disable Health Monitoring for IIS 6.0 and above. To do this, follow these steps: 
   1. Open the IIS MMC snap-in.
   2. Expand Application Pools.
   3. Right-click Application Pools, and then click Properties.
   4. Click the Recycling tab, and then click to clear all the Recycle worker process check boxes.
   5. Click the Performance tab, and then click to clear the Shutdown worker processes after being idle for (time in minutes) check box.
   6. Click the Health tab, click to clear the Enable rapid-fail protection and Enable pinging check boxes, and then click OK.
5. Restart IIS. To do this, click Start, click Run, type iisreset, and then click OK.

Create a crash rule in IIS 5.0 and in IIS 5.1

To create a crash rule in IIS 5.0 and in IIS 5.1, follow these steps:

1. Click Start, point to Programs, point to  Debug Diagnostics Tool, and then click Debug Diagnostics Tools 1.2.
2. Click Crash, and then click Next.
3. Select the desired Target Type, and then click Next.
4. Click Breakpoints, and then click Add Breakpoint.
5. Click ComSvcs!ComSvcsExceptionFilter.
6. In the Action Type list, click Full Userdump, and then click OK.
7. Click Save & Close, and then click Next.
8. In the Select Dump Location And Rule Name (Optional) dialog box, click Next.
9. Click to select the Activate the rule now check box, and then click Finish.

Create a crash rule in IIS 6.0 and above

To create a crash rule in IIS 6.0 and above, follow these steps:

1. Click Start, point to Programs, point to Debug Diagnostics Tool, and then click Debug Diagnostics Tools 1.2.
2. Click Crash, and then click Next.
3. Select the desired Target Type, and then click Next.
4. In the Advanced Configuration (Optional) dialog box, click Next.
5. In the Select Dump Location And Rule Name (Optional) dialog box, click Next.
6. Click to select the Activate the rule now check box, and then click Finish.

Manually obtain crash memory dump data

You can analyze crash memory dumps by manually obtaining the desired data. To do this, follow these steps:

1. Attach a debugger. To do this, follow these steps:
   1. Click Start, point to Programs, point to Debug Diagnostics Tool, and then click Debug Diagnostics Tools 1.2.
   2. Click the Processes tab.
   3. Right-click the process that you want to debug, and then click Attach Debugger.
2. In the Debug Diagnostics Tool window, notice that the Status for the new rule is Active. Additionally, the Userdump Count increases every time that a memory dump file is created.
3. Analyze the memory dump file by clicking the Advanced Analysis tab and then clicking Add Data Files.
4. When the .dmp file is added, click Crash/Hang Analyzers in the Available Analysis Scripts list, and then click Start Analysis.
5. When the analysis is finished, a .mht report is created in the C:\Program Files\DebugDiag\Reports folder and is displayed in Microsoft Internet Explorer together with the results and recommendations. 
6. If you use custom DLLs, you can add the Symbol Search Path For Analysis and the Symbol Search Path for Debugging settings to custom PDB files. To do this, follow these steps:
   1. On the Tools menu, click Options And Settings.
   2. Configure the Symbol Search Path For Analysis or Symbol Search Path for Debugging settings, and then click OK.