(Exchange 2003, SP1, Windows 2003, IIS)
Over the past few weeks the IISAdmin service on my exchange server keeps
crashing causing other services such as smtp, web etc to fail as well. It
crashes every few days or could go for a week without crashing. please help!
this is driving me insane! below are the event logs. i've checked the
metabase and that works fine and i don't believe that a i could recieve so
many corrupt mail messages that could possibly make the service fail. i have
a mail gateway (win2k3 iis6.0 smtp) that forwards all mail to exchange, so i
think it would crash that mail server first rather than iis on exchange....

Event Type: Warning
Event Source: W3SVC
Event Category: None
Event ID: 1012
Date:  9/8/2004
Time:  2:05:26 PM
User:  N/A
Computer: SRVEXCH1
Description:
A process serving application pool 'DefaultAppPool' exceeded time limits
during start up. The process id was '4064'.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: b4 05 07 80               ´..?

----------

Event Type: Error
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1000
Date:  9/8/2004
Time:  10:22:02 PM
User:  N/A
Computer: SRVEXCH1
Description:
Faulting application inetinfo.exe, version 6.0.3790.0, stamp 3e8000f7,
faulting module ntdll.dll, version Event Type: Error
Event Source: Microsoft Exchange Server
Event Category: None
Event ID: 1000
Date:  9/8/2004
Time:  10:22:02 PM
User:  N/A
Computer: SRVEXCH1
Description:
Faulting application inetinfo.exe, version 6.0.3790.0, stamp 3e8000f7,
faulting module ntdll.dll, version 5.2.3790.0, stamp 3e802494, debug? 0,
fault address 0x00006c86.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00   A.p.p.l.
0008: 69 00 63 00 61 00 74 00   i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00   i.o.n. .
0018: 46 00 61 00 69 00 6c 00   F.a.i.l.
0020: 75 00 72 00 65 00 20 00   u.r.e. .
0028: 20 00 69 00 6e 00 65 00    .i.n.e.
0030: 74 00 69 00 6e 00 66 00   t.i.n.f.
0038: 6f 00 2e 00 65 00 78 00   o...e.x.
0040: 65 00 20 00 36 00 2e 00   e. .6...
0048: 30 00 2e 00 33 00 37 00   0...3.7.
0050: 39 00 30 00 2e 00 30 00   9.0...0.
0058: 20 00 33 00 65 00 38 00    .3.e.8.
0060: 30 00 30 00 30 00 66 00   0.0.0.f.
0068: 37 00 20 00 69 00 6e 00   7. .i.n.
0070: 20 00 6e 00 74 00 64 00    .n.t.d.
0078: 6c 00 6c 00 2e 00 64 00   l.l...d.
0080: 6c 00 6c 00 20 00 35 00   l.l. .5.
0088: 2e 00 32 00 2e 00 33 00   ..2...3.
0090: 37 00 39 00 30 00 2e 00   7.9.0...
0098: 30 00 20 00 33 00 65 00   0. .3.e.
00a0: 38 00 30 00 32 00 34 00   8.0.2.4.
00a8: 39 00 34 00 20 00 66 00   9.4. .f.
00b0: 44 00 65 00 62 00 75 00   D.e.b.u.
00b8: 67 00 20 00 30 00 20 00   g. .0. .
00c0: 61 00 74 00 20 00 6f 00   a.t. .o.
00c8: 66 00 66 00 73 00 65 00   f.f.s.e.
00d0: 74 00 20 00 30 00 30 00   t. .0.0.
00d8: 30 00 30 00 36 00 63 00   0.0.6.c.
00e0: 38 00 36 00 0d 00 0a 00   8.6.....

-----------

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date:  9/8/2004
Time:  10:22:47 PM
User:  N/A
Computer: SRVEXCH1
Description:
Faulting application inetinfo.exe, version 6.0.3790.0, faulting module
ntdll.dll, version 5.2.3790.0, fault address 0x00006c86.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 69 6e 65   ure  ine
0018: 74 69 6e 66 6f 2e 65 78   tinfo.ex
0020: 65 20 36 2e 30 2e 33 37   e 6.0.37
0028: 39 30 2e 30 20 69 6e 20   90.0 in
0030: 6e 74 64 6c 6c 2e 64 6c   ntdll.dl
0038: 6c 20 35 2e 32 2e 33 37   l 5.2.37
0040: 39 30 2e 30 20 61 74 20   90.0 at
0048: 6f 66 66 73 65 74 20 30   offset 0
0050: 30 30 30 36 63 38 36      0006c86

-------------
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date:  9/8/2004
Time:  2:25:08 PM
User:  N/A
Computer: SRVEXCH1
Description:
The IIS Admin Service service terminated unexpectedly.  It has done this 4
time(s).  The following corrective action will be taken in 1 milliseconds:
Run the configured recovery program.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

[ Post a follow-up to this message ]

What are your recovery settings (in Services MMC) for the IISAdmin service
(go to the IISAdmin service, double click and choose the Recovery tab)?  I
believe ntdll.dll is used in memory management.  Memory Leak?  You may have
to call MS.  Are you running other applications other than Exchange that use
IIS?

-Walt

"Gabe Matteson" <gmatteson@inquery.biz.nospam> wrote in message
news:OiR%23R1jlEHA.3896@tk2msftngp13.phx.gbl...
> (Exchange 2003, SP1, Windows 2003, IIS)
> Over the past few weeks the IISAdmin service on my exchange server keeps
> crashing causing other services such as smtp, web etc to fail as well. It
> crashes every few days or could go for a week without crashing. please
help!
> this is driving me insane! below are the event logs. i've checked the
> metabase and that works fine and i don't believe that a i could recieve so
> many corrupt mail messages that could possibly make the service fail. i
have
> a mail gateway (win2k3 iis6.0 smtp) that forwards all mail to exchange, so
i
> think it would crash that mail server first rather than iis on
exchange....
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1012
> Date:  9/8/2004
> Time:  2:05:26 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> A process serving application pool 'DefaultAppPool' exceeded time limits
> during start up. The process id was '4064'.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: b4 05 07 80               ´..?
>
> ----------
>
> Event Type: Error
> Event Source: Microsoft Exchange Server
> Event Category: None
> Event ID: 1000
> Date:  9/8/2004
> Time:  10:22:02 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> Faulting application inetinfo.exe, version 6.0.3790.0, stamp 3e8000f7,
> faulting module ntdll.dll, version Event Type: Error
> Event Source: Microsoft Exchange Server
> Event Category: None
> Event ID: 1000
> Date:  9/8/2004
> Time:  10:22:02 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> Faulting application inetinfo.exe, version 6.0.3790.0, stamp 3e8000f7,
> faulting module ntdll.dll, version 5.2.3790.0, stamp 3e802494, debug? 0,
> fault address 0x00006c86.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 00 70 00 70 00 6c 00   A.p.p.l.
> 0008: 69 00 63 00 61 00 74 00   i.c.a.t.
> 0010: 69 00 6f 00 6e 00 20 00   i.o.n. .
> 0018: 46 00 61 00 69 00 6c 00   F.a.i.l.
> 0020: 75 00 72 00 65 00 20 00   u.r.e. .
> 0028: 20 00 69 00 6e 00 65 00    .i.n.e.
> 0030: 74 00 69 00 6e 00 66 00   t.i.n.f.
> 0038: 6f 00 2e 00 65 00 78 00   o...e.x.
> 0040: 65 00 20 00 36 00 2e 00   e. .6...
> 0048: 30 00 2e 00 33 00 37 00   0...3.7.
> 0050: 39 00 30 00 2e 00 30 00   9.0...0.
> 0058: 20 00 33 00 65 00 38 00    .3.e.8.
> 0060: 30 00 30 00 30 00 66 00   0.0.0.f.
> 0068: 37 00 20 00 69 00 6e 00   7. .i.n.
> 0070: 20 00 6e 00 74 00 64 00    .n.t.d.
> 0078: 6c 00 6c 00 2e 00 64 00   l.l...d.
> 0080: 6c 00 6c 00 20 00 35 00   l.l. .5.
> 0088: 2e 00 32 00 2e 00 33 00   ..2...3.
> 0090: 37 00 39 00 30 00 2e 00   7.9.0...
> 0098: 30 00 20 00 33 00 65 00   0. .3.e.
> 00a0: 38 00 30 00 32 00 34 00   8.0.2.4.
> 00a8: 39 00 34 00 20 00 66 00   9.4. .f.
> 00b0: 44 00 65 00 62 00 75 00   D.e.b.u.
> 00b8: 67 00 20 00 30 00 20 00   g. .0. .
> 00c0: 61 00 74 00 20 00 6f 00   a.t. .o.
> 00c8: 66 00 66 00 73 00 65 00   f.f.s.e.
> 00d0: 74 00 20 00 30 00 30 00   t. .0.0.
> 00d8: 30 00 30 00 36 00 63 00   0.0.6.c.
> 00e0: 38 00 36 00 0d 00 0a 00   8.6.....
>
> -----------
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date:  9/8/2004
> Time:  10:22:47 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> Faulting application inetinfo.exe, version 6.0.3790.0, faulting module
> ntdll.dll, version 5.2.3790.0, fault address 0x00006c86.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74   Applicat
> 0008: 69 6f 6e 20 46 61 69 6c   ion Fail
> 0010: 75 72 65 20 20 69 6e 65   ure  ine
> 0018: 74 69 6e 66 6f 2e 65 78   tinfo.ex
> 0020: 65 20 36 2e 30 2e 33 37   e 6.0.37
> 0028: 39 30 2e 30 20 69 6e 20   90.0 in
> 0030: 6e 74 64 6c 6c 2e 64 6c   ntdll.dl
> 0038: 6c 20 35 2e 32 2e 33 37   l 5.2.37
> 0040: 39 30 2e 30 20 61 74 20   90.0 at
> 0048: 6f 66 66 73 65 74 20 30   offset 0
> 0050: 30 30 30 36 63 38 36      0006c86
>
> -------------
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7031
> Date:  9/8/2004
> Time:  2:25:08 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> The IIS Admin Service service terminated unexpectedly.  It has done this 4
> time(s).  The following corrective action will be taken in 1 milliseconds:
> Run the configured recovery program.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>

[ Post a follow-up to this message ]

NTDLL is indeed used for memory management, but a crash is usually caused by
someone either:
a) passing a bad (e.g. NULL) pointer to the API's or
b) memory being corrupted

We may be able to identify the problem using IISState:

iisstate -p <pid of inetinfo.exe> -sc <enter>


Pat

"Walter Holm" <walt.holm@walterholm.net> wrote in message
news:uk6mg0nlEHA.3988@tk2msftngp13.phx.gbl...
> What are your recovery settings (in Services MMC) for the IISAdmin service
> (go to the IISAdmin service, double click and choose the Recovery tab)?  I
> believe ntdll.dll is used in memory management.  Memory Leak?  You may
> have
> to call MS.  Are you running other applications other than Exchange that
> use
> IIS?
>
> -Walt
>
> "Gabe Matteson" <gmatteson@inquery.biz.nospam> wrote in message
> news:OiR%23R1jlEHA.3896@tk2msftngp13.phx.gbl... 
> help! 
> have 
> i 
> exchange.... 
>
>

[ Post a follow-up to this message ]

Thank you for the reply!!
The only other services running on the machine is IHateSpam Server Edition
for Exchange 2003 (only uses and smtp event sink, no service installed) and
Symantec Mail Security for Exchange 2003 v4.5. I took a look at the ram
usage and it's ranges from 1.2 to 1.6gb used. as for the memory being
corrupted, could it be due to a bad ram chip? iissate... i've heard of that,
where might i aquire it? thanks again for the reply!


"Gabe Matteson" <gmatteson@inquery.biz.nospam> wrote in message
news:OiR%23R1jlEHA.3896@tk2msftngp13.phx.gbl...
> (Exchange 2003, SP1, Windows 2003, IIS)
> Over the past few weeks the IISAdmin service on my exchange server keeps
> crashing causing other services such as smtp, web etc to fail as well. It
> crashes every few days or could go for a week without crashing. please
> help! this is driving me insane! below are the event logs. i've checked
> the metabase and that works fine and i don't believe that a i could
> recieve so many corrupt mail messages that could possibly make the service
> fail. i have a mail gateway (win2k3 iis6.0 smtp) that forwards all mail to
> exchange, so i think it would crash that mail server first rather than iis
> on exchange....
>
> Event Type: Warning
> Event Source: W3SVC
> Event Category: None
> Event ID: 1012
> Date:  9/8/2004
> Time:  2:05:26 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> A process serving application pool 'DefaultAppPool' exceeded time limits
> during start up. The process id was '4064'.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: b4 05 07 80               ´..?
>
> ----------
>
> Event Type: Error
> Event Source: Microsoft Exchange Server
> Event Category: None
> Event ID: 1000
> Date:  9/8/2004
> Time:  10:22:02 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> Faulting application inetinfo.exe, version 6.0.3790.0, stamp 3e8000f7,
> faulting module ntdll.dll, version Event Type: Error
> Event Source: Microsoft Exchange Server
> Event Category: None
> Event ID: 1000
> Date:  9/8/2004
> Time:  10:22:02 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> Faulting application inetinfo.exe, version 6.0.3790.0, stamp 3e8000f7,
> faulting module ntdll.dll, version 5.2.3790.0, stamp 3e802494, debug? 0,
> fault address 0x00006c86.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 00 70 00 70 00 6c 00   A.p.p.l.
> 0008: 69 00 63 00 61 00 74 00   i.c.a.t.
> 0010: 69 00 6f 00 6e 00 20 00   i.o.n. .
> 0018: 46 00 61 00 69 00 6c 00   F.a.i.l.
> 0020: 75 00 72 00 65 00 20 00   u.r.e. .
> 0028: 20 00 69 00 6e 00 65 00    .i.n.e.
> 0030: 74 00 69 00 6e 00 66 00   t.i.n.f.
> 0038: 6f 00 2e 00 65 00 78 00   o...e.x.
> 0040: 65 00 20 00 36 00 2e 00   e. .6...
> 0048: 30 00 2e 00 33 00 37 00   0...3.7.
> 0050: 39 00 30 00 2e 00 30 00   9.0...0.
> 0058: 20 00 33 00 65 00 38 00    .3.e.8.
> 0060: 30 00 30 00 30 00 66 00   0.0.0.f.
> 0068: 37 00 20 00 69 00 6e 00   7. .i.n.
> 0070: 20 00 6e 00 74 00 64 00    .n.t.d.
> 0078: 6c 00 6c 00 2e 00 64 00   l.l...d.
> 0080: 6c 00 6c 00 20 00 35 00   l.l. .5.
> 0088: 2e 00 32 00 2e 00 33 00   ..2...3.
> 0090: 37 00 39 00 30 00 2e 00   7.9.0...
> 0098: 30 00 20 00 33 00 65 00   0. .3.e.
> 00a0: 38 00 30 00 32 00 34 00   8.0.2.4.
> 00a8: 39 00 34 00 20 00 66 00   9.4. .f.
> 00b0: 44 00 65 00 62 00 75 00   D.e.b.u.
> 00b8: 67 00 20 00 30 00 20 00   g. .0. .
> 00c0: 61 00 74 00 20 00 6f 00   a.t. .o.
> 00c8: 66 00 66 00 73 00 65 00   f.f.s.e.
> 00d0: 74 00 20 00 30 00 30 00   t. .0.0.
> 00d8: 30 00 30 00 36 00 63 00   0.0.6.c.
> 00e0: 38 00 36 00 0d 00 0a 00   8.6.....
>
> -----------
>
> Event Type: Error
> Event Source: Application Error
> Event Category: (100)
> Event ID: 1000
> Date:  9/8/2004
> Time:  10:22:47 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> Faulting application inetinfo.exe, version 6.0.3790.0, faulting module
> ntdll.dll, version 5.2.3790.0, fault address 0x00006c86.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
> Data:
> 0000: 41 70 70 6c 69 63 61 74   Applicat
> 0008: 69 6f 6e 20 46 61 69 6c   ion Fail
> 0010: 75 72 65 20 20 69 6e 65   ure  ine
> 0018: 74 69 6e 66 6f 2e 65 78   tinfo.ex
> 0020: 65 20 36 2e 30 2e 33 37   e 6.0.37
> 0028: 39 30 2e 30 20 69 6e 20   90.0 in
> 0030: 6e 74 64 6c 6c 2e 64 6c   ntdll.dl
> 0038: 6c 20 35 2e 32 2e 33 37   l 5.2.37
> 0040: 39 30 2e 30 20 61 74 20   90.0 at
> 0048: 6f 66 66 73 65 74 20 30   offset 0
> 0050: 30 30 30 36 63 38 36      0006c86
>
> -------------
> Event Type: Error
> Event Source: Service Control Manager
> Event Category: None
> Event ID: 7031
> Date:  9/8/2004
> Time:  2:25:08 PM
> User:  N/A
> Computer: SRVEXCH1
> Description:
> The IIS Admin Service service terminated unexpectedly.  It has done this 4
> time(s).  The following corrective action will be taken in 1 milliseconds:
> Run the configured recovery program.
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>

[ Post a follow-up to this message ]

Gabe,

If you haven't found out the answer to this yet...  this is a known
problem with I Hate Spam.  We ran into this as well.  We had 2
customers with almost identical configurations using I Hate Spam
(Win2003, Exch2003, etc).  One worked fine, the other didn't.  The
version at the site that was working fine was 1.5.190 and the bad one
was 1.5.205...  I don't know which build the problem appears...   Here
is a link at SunBelt's site that acknowledges the problem, but they
have no answer yet.

http://support.sunbelt-software.com...r />
cm9kX2x2b
 DE9fmFueX4mcF9wcm9kX2x2bDI9fmFueX4mcF9zb
3J0X2J5PWRmbHQmcF9wYWdlPTE*&p_li=


Hope this helps

-Scot




"Gabe Matteson" <gmatteson@inquery.biz.nospam> wrote in message news:<O9dRqeqlEHA.748@TK2MSF
TNGP15.phx.gbl>...[vbcol=seagreen]
> Thank you for the reply!!
> The only other services running on the machine is IHateSpam Server Edition
> for Exchange 2003 (only uses and smtp event sink, no service installed) an
d
> Symantec Mail Security for Exchange 2003 v4.5. I took a look at the ram
> usage and it's ranges from 1.2 to 1.6gb used. as for the memory being
> corrupted, could it be due to a bad ram chip? iissate... i've heard of tha
t,
> where might i aquire it? thanks again for the reply!
>
>
> "Gabe Matteson" <gmatteson@inquery.biz.nospam> wrote in message
> news:OiR%23R1jlEHA.3896@tk2msftngp13.phx.gbl... 

[ Post a follow-up to this message ]

I have the same issue with the same software running. I also have
Blackberry Enterprise running. 1.5GB of RAM in the system. Have the
/3gb etc in the boot.ini.








"Gabe Matteson" <gmatteson@inquery.biz.nospam> wrote in message news:<O9dRqeqlEHA.748@TK2MSF
TNGP15.phx.gbl>...
> Thank you for the reply!!
> The only other services running on the machine is IHateSpam Server Edition
> for Exchange 2003 (only uses and smtp event sink, no service installed) an
d
> Symantec Mail Security for Exchange 2003 v4.5. I took a look at the ram
> usage and it's ranges from 1.2 to 1.6gb used. as for the memory being
> corrupted, could it be due to a bad ram chip? iissate... i've heard of tha
t,
> where might i aquire it? thanks again for the reply!
>

[ Post a follow-up to this message ]