Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having an issue with an IIS application (details of environment at the end of the message).

The web site works great most of the time and I cannot reproduce any error in our test system. On the live system however with on averare of 5-15 requests per second I have a problem with that some requests (about 0.05%) will take over 300 seconds to complete. The other requests complete withing 5-10 seconds.

It seem like if all the errornous requests end up with a Timer_EntityBody error in the error log. I have never seen this as an end user but I guess that they will receive some kind of error message.

I am trying to find out what can be causing this errornous behaviour. Any ideas are welcome. I have read something about that there can be an MTU issue if ICMP and MTU protocols are blocked in the firewall. Does that sound reasonable? I have also read about updating to IIS 7 should do the trick. Does it sound reasonable?

I think that the problem has another cause but I have no idea of what. I have tried running hte perormance monitor, monitoring for database locks and active transaction counts. I can see some of these in the perfmon log for the MSSQL server (another machine) for example:

  • Active transactions is sometimes peaking and sometimes for long periods
  • Lock waits per seconds is sometimes peaking
  • Transactions per second is sometimes peaking
  • Page IO Latch wait is sometimes peaking
  • Lock wait time (ms) is sometimes peaking

But I cannot see that any of these correlate to the errors in the IIS error log.

On the IIS server machine I can also see with perfmon that some values peak a few times during a day:

  • Request execution time
  • Avg disk queue length

I can neither see that any of these correlate to the errors in the IIS error log.

In the below code I have anonymized by replacing some parts with HIDDEN The following can be seen in the access log

2010-10-01 08:35:05 W3SVC1301873091 **HIDDEN** POST /**HIDDEN**/Modules/BalanceModule.aspx - 80 - **HIDDEN** Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C;+.NET4.0E) ASP.NET_SessionId=**HIDDEN** 400 0 64 0 2241 127799

At the same time the following can be seen in the error log:

2010-10-01 08:35:05 **HIDDEN** 1999 **HIDDEN** 80 HTTP/1.0 POST /**HIDDEN**/Modules/BalanceModule.aspx - 1301873091 Timer_EntityBody Test+Pool

I can tell the following about the environment:

Server: Windows Server 2003 x64 SP2 running on VMWare
HTTP Server: IIS v6.0 with ASP.NET 2.0.50727
Antivirus: Trend Micro OfficeScan (Is it a good idea to have this on a server?)
share|improve this question

Without more details it is not likely updating to IIS 7 will help. Any recommendation to upgrade when you have a problem tends to be a guess given by someone who doesn't want to spend time really troubleshooting.

Also, with the MTU issue - I've seen problems with a mismatch between network layer configurations (using Windows 2008 two machines were having trouble syncing their connections due to different sliding window defitions). But that should affect all your users, not just some.

The antivirus is neither inherently good or inherently bad; depends on whether you have files uploading/downloading to/from your server. It probably doesn't have an impact on this particular problem, though.

This might apply in your situation:

This seems likely because you do have the Request execution time showing increases.

Lastly, being as you are running on VMWare, one issue that crops up from time to time is that the disk IO is not properly managed - you might want to check with whoever is hosting your VM to see if they see disk IO increasing overall where your VM is stored or just on your machine. It could be the delays are occurring because someone else's machine on your shared storage is eating up IO bandwidth (which delays reads/writes by the web server overall, which could increase the counters you saw...).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.