|
Home > Archive > IIS Server > February 2004 > Event ID: 7031 Source Service Control Manager
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
Event ID: 7031 Source Service Control Manager
|
|
| CQL User 2004-01-30, 6:36 am |
| I am running IIS 5.0 on a Windows 2000 standard server with Service Pack 4.
I get the following error message:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 1/30/2004
Time: 12:53:17 PM
User: N/A
Computer: FOO
Description:
The IIS Admin Service service terminated unexpectedly. It has done this 6
time(s). The following corrective action will be taken in 1 milliseconds:
Run the configured recovery program.
I've read alot of the posts out on the net. Most of them indicate the
virus/worm problem, however, I've taken all the steps to fix it. I've even
downloaded software to verify I don't have it. So, that aside, I've also
turned off WebDAV and did the registry fix. I also put all my webs in
isolated mode. Last, I run FileMon to find out what's calling the resets.
I do NOT see a pattern to loads or otherwise. After I physically reset the
server, it can take up to 24 hours before I will see it do a reset. After
the 10th time, I have to reboot the server.
Watching FileMon, I see that a DrWatson log is generated before every reset.
The DrWatson is:
Application exception occurred:
App: inetinfo.exe (pid=1232)
When: 1/3/2004 @ 12:51:21.359
Exception number: c0000005 (access violation)
Any ideas how to fix the problem?
Thanks
| |
| [Tony Devere] 2004-02-01, 5:34 pm |
| Hello foo,
Good troubleshooting steps... the only problem is that without knowing the
cause of the crash - they are just shots in the dark... but still good
troubleshooting for what information you had...
Moving on... can you post the last exception that dr. watson showed for
inetinfo.exe
Depending on how fast you'd like this problem resolved, it may be best to
open a case with our support staff...
I have a few questions for you to move forward...
When did this start happening?
What changed before this?\
What kind of setup do you have there? How many sites? What are you doing
with the sites? Any 3rd party ISAPI's? More information about the web sites
and machine in question.
Thank you,
Tony DeVere [MSFT]
Microsoft IIS
Newsgroup Support
tdevere@online.microsoft.com
"Please do not send email directly to this alias. This is our online
account name for newsgroup participation only."
This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use. © 2001 Microsoft Corporation. All rights
reserved.
| |
| [Tony Devere] 2004-02-02, 8:34 pm |
| I didn't find anything useful in the drwatson.log file... I think we're
missing symbols...
Did you find a user.dmp file? If so send it up here..
Also, you should install the debugging tools for windows... you're going to
need to generate a crash dump of this problem and it's likely going to take
opening a case with our support to get that done...
Thank you,
Tony DeVere [MSFT]
Microsoft IIS
Newsgroup Support
tdevere@online.microsoft.com
"Please do not send email directly to this alias. This is our online
account name for newsgroup participation only."
This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use. © 2001 Microsoft Corporation. All rights
reserved.
| |
| [Tony Devere] 2004-02-02, 9:34 pm |
| Everything still goes with the last e-mail ... but the drWatson.log file
did appear differently to me the second time I looked at it.. I found one
interesting thread - I missed this before:
State Dump for Thread Id 0x67c
eax=02bb9000 ebx=01779b18 ecx=10014366 edx=02bb7009 esi=00cae810
edi=01779ad8
eip=10002750 esp=0223fac4 ebp=fffffffe iopl=0 nv up ei pl nz na po
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000206
function: TerminateFilter
10002739 b001 mov al,0x1
1000273b 5b pop ebx
1000273c c3 ret
1000273d 90 nop
1000273e 90 nop
1000273f 90 nop
10002740 8b442404 mov eax,[esp+0x4]
ss:02a599ab=00000000
10002744 83ec0c sub esp,0xc
10002747 8d5001 lea edx,[eax+0x1]
ds:033d2ee6=????????
1000274a 8d9b00000000 lea ebx,[ebx]
ds:01779b18=54534f50
FAULT ->10002750 8a08 mov cl,[eax]
ds:02bb9000=??
10002752 40 inc eax
10002753 84c9 test cl,cl
10002755 75f9 jnz 10007b50
10002757 53 push ebx
10002758 2bc2 sub eax,edx
1000275a 55 push ebp
1000275b 8bd0 mov edx,eax
1000275d 8b44241c mov eax,[esp+0x1c]
ss:02a599ab=00000000
10002761 56 push esi
10002762 57 push edi
10002763 89542414 mov [esp+0x14],edx
ss:02a599ab=00000000
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
FFFFFFFE 00000000 00000000 00000000 00000000 00000000 !TerminateFilter
From this function call !TerminateFilter I know we crashed trying to
terminate an ISAPI filter... it's unclear which one from this dump, but I
think you can guess which one is the most likely cuprit... IISRewrite
If you can test without this filter, I'd do so - then if it still fails...
let's look at the logs then.
If you can't test without the filter... you'll really need to open a case
with us to prove which filter - or you can try going directly to the most
likely cause :
http://www.qwerksoft.com/products/iisrewrite/
Thank you,
Tony DeVere [MSFT]
Microsoft IIS
Newsgroup Support
tdevere@online.microsoft.com
"Please do not send email directly to this alias. This is our online
account name for newsgroup participation only."
This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use. © 2001 Microsoft Corporation. All rights
reserved.
|
|
|
|
|