Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have windows 2003 server which has suddenly stopped working at around 8:03 PM. The windows event logged the message:

An administrator has requested a recycle of all worker processes in application pool 'Pool_XYZ'.

And after that

A process serving application pool 'Pool_XYZ' exceeded time limits during shut down. The process id was '870072'.

Those two messages were repeating every 5 minutes.

I did IISREST and I can see inetinfo.exe running. When I try to access the site, browser returns the same page if the server was not running. There are no w3wp.exe processes (that should be used as app pool hosts). There are no error messages in the vent log. If I telne to port 80, the server disconnects as soon as I press the first characters. There are no requests logged after 8:03 PM in iis log files.

Any ideas on what could be wrong? I have restarted the services multiple times but it does not help.

share|improve this question
Make sure the application pool is not disabled. – Chris McKeown Oct 4 '13 at 21:56
They are not. I can start them and stop them through inetmgr (but no w3wp.exe is launched). I am also able to create a new site on a new port (88) and do the telnet localhost 88. but it imediatelly disconnects. – matra Oct 4 '13 at 22:04
Check %SystemRoot%\System32\LogFiles\HTTPERR\ for indications that HTTP.SYS is rejecting the connections for some reason. – Chris McKeown Oct 4 '13 at 22:08
Chris thanks, there were errors like "2013-10-04 18:01:29 - - - - - - - - - 5_Connections_Refused -". This could be caoused by;EN-US;934878, but on the other hand, there was plenty of memory available. – matra Oct 4 '13 at 22:26
Ah, see my comment on Simon's reply – Chris McKeown Oct 4 '13 at 22:28

I suspect there's an issue with one of the [external] DLLs being loaded into the worker process. These come about with use of extensions (ASP.NET, ISAPI extensions, Etc.).

My recommendation would be to use Microsoft's SysInternals ProcessMonitor to see what the server is doing when you attempt to start IIS / browse to it. Set your filter to ProcessName = w3wp.exe and see what happens.

You may need to disable certain extensions, re-install them, Etc.

Another situation that I've seen cause a [sort of] similar issue was where a piece of malware had hooked port 80, and was proxying in-front of IIS. A sort of MITM attack if you like.

share|improve this answer
Thanks for the suggestions, but I was already forced to restart the server, which solved the problem. Your theory on MITM can not hold, because I was able to create another site on port 88, and that side had the same problems. – matra Oct 4 '13 at 22:23
+1 I suspect you may have a memory leak with an external DLL - your Connections_Refused lines in HTTPSYS.log suggest that this might be the case. Also see here – Chris McKeown Oct 4 '13 at 22:29
Glad you got it sorted... – Simon Catlin Oct 4 '13 at 22:37

I have "solved" the problem by restarting the server. Of course the server did not agree on being restarted, and was stuck during the shutdown. I had to initiate another restart through remote machine with iisreset machinename /reboot

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.