I am facing Frequent W3SVC (IIS crashes are at Event logs)
I tried IIS diagnostic tool and created a rule to dump the crashes

the tool generated following analysis-

----------------------------------------------------------------
In w3wp__PID__64604__Date__04_27_2010__Time_03_11_14AM__588__Second_Chance_Exception_C0000005.dmp the assembly instruction at ntdll!_SEH_prolog+1a in C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to write to memory location 0x00f80f70 on thread 5


Table Of Contents
w3wp__PID__64604__Date__04_27_2010__Time_03_11_14AM__588__Second_Chance_Exception_C0000005.dmp

Faulting Thread

Faulting Module Information




Report for w3wp__PID__64604__Date__04_27_2010__Time_03_11_14AM__588__Second_Chance_Exception_C0000005.dmp
Type of Analysis Performed Crash Analysis
Machine Name VPS629
Operating System Windows Server 2003 Service Pack 2
Number Of Processors 2
Process ID 64604
Process Image c:\WINDOWS\system32\inetsrv\w3wp.exe
System Up-Time 294 day(s) 10:47:57
Process Up-Time 0 day(s) 00:06:15


Thread 5 - System ID 42000
Entry point w3tp!THREAD_MANAGER::ThreadManagerThread
Create time 4/27/2010 3:05:00 AM
Time spent in user mode 0 Days 0:0:0.0
Time spent in kernel mode 0 Days 0:0:0.0


Function Arg 1 Arg 2 Arg 3 Source
ntdll!_SEH_prolog+1a 021a0000 00000000 00000020
IIRF!pcre_exec+b174 00000020 00000000 00000000
IIRF!pcre_exec+b4a9 00000020 00000000 1000747a
IIRF+11c8 01078718 04000000 00fbfa8c
w3core!W3_FILTER_CONTEXT::NotifyFilters+52d 04000000 00fbfa8c 00fbfa40
w3core!W3_FILTER_CONTEXT::NotifyAuthComplete+39 00fbfa8c 00fbfa40 00000208
w3core!W3_MAIN_CONTEXT::NotifyFilters+d0 04000000 00fbfa8c 00fbfa40
w3core!W3_STATE_AUTHENTICATION:oWork+950 01077ea8 00000000 00000000
w3core!W3_MAIN_CONTEXT:oWork+a6 00000000 00000000 00000000
w3core!W3_MAIN_CONTEXT::OnNewRequest+55 010773e0 010773e0 5a361650
w3dt!UL_NATIVE_REQUEST:oStateProcess+48 00268678 00268684 00fbff5c
w3dt!UL_NATIVE_REQUEST:oWork+7f 00000a8e 000000ea 010773e4
w3dt!OverlappedCompletionRoutine+1a 000000ea 00000a8e 010773e4
w3tp!THREAD_POOL_DATA::ThreadPoolThread+73 00000000 00268710 5a300000
w3tp!THREAD_POOL_DATA::ThreadPoolThread+24 00268678 00000000 00000000
w3tp!THREAD_MANAGER::ThreadManagerThread+39 00268710 00000000 00000000
kernel32!BaseThreadStart+34 5a301d70 00268710 00000000




NTDLL!_SEH_PROLOG+1AIn w3wp__PID__64604__Date__04_27_2010__Time_03_11_14AM__588__Second_Chance_Exception_C0000005.dmp the assembly instruction at ntdll!_SEH_prolog+1a in C:\WINDOWS\system32\ntdll.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to write to memory location 0x00f80f70 on thread 5

Module Information
Image Name: C:\WINDOWS\system32\ntdll.dll Symbol Type: PDB
Base address: 0x7c800000 Time Stamp: Sat Feb 17 09:02:00 2007
Checksum: 0x000bd6f9 Comments:
COM DLL: False Company Name: Microsoft Corporation
ISAPIExtension: False File Description: NT Layer DLL
ISAPIFilter: False File Version: 5.2.3790.3959 (srv03_sp2_rtm.070216-1710)
Managed DLL: False Internal Name: ntdll.dll
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights reserved.
Loaded Image Name: ntdll.dll Legal Trademarks:
Mapped Image Name: Original filename: ntdll.dll
Module name: ntdll Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating System
Module Size: 768.00 KBytes Product Version: 5.2.3790.3959
Symbol File Name: c:\symcache\ntdll.pdb\93E72E109DC84F16AA54797E4DA8C1682\ntdll.pdb Special Build: &

-----------------------------------------------------------------
What Might go wrong. Is there not a way where I can know what url caused this crash?? I mean only running some URL causes these crashes. there must be someentry in some log file corresponding to that.

whenever a url is hit it gets entered in IIS logs and If some http error comes in opening that url then I think it doesnt go to IIS log and goes to httpErr. So when some crash happens why it doesnt go to any log except system Event viewer.

Snippet of my Http.Err Log
------------------------------------------------------------
2010-04-26 05:59:25 210.80.128.183 63530 67.215.161.72 80 - - - - - Timer_ConnectionIdle -
2010-04-26 06:00:59 66.249.71.38 60922 67.215.161.72 80 HTTP/1.1 GET /LA-Montessori-School-addresses-maps-schools-in-india/India-Mumbai-Utpal-Sanghvi-School-Admission/india/add-school - 223085046 Connection_Abandoned_By_AppPool DefaultAppPool
2010-04-26 06:01:51 93.158.151.25 64097 67.215.161.72 80 - - - - - Timer_ConnectionIdle -
2010-04-26 06:02:21 59.160.18.209 57971 67.215.161.72 80 - - - - - Timer_ConnectionIdle -
2010-04-26 06:02:21 59.160.18.209 57587 67.215.161.72 80 - - - - - Timer_ConnectionIdle -
2010-04-26 06:02:31 114.143.166.86 2204 67.215.161.72 80 - - - - - Timer_ConnectionIdle -
2010-04-26 06:02:31 114.143.166.86 2205 67.215.161.72 80 - - - - - Timer_ConnectionIdle -
Connection_Abandoned_By_AppPool DefaultAppPool
-----------------------------------------------------------

I want to know two things
-1) what exactly happens when we hit some URL that causes crash (the whole flow after hitting tht url)
-2) any solution for IIS diagnostic tool analysis report I have put here

Nishant