Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have one IIS 8 server where the w3logsvc dies at midnight UTC (we're Central Time, so we're UTC -6). I have to manually start the service to get it back running again. I have the logging set to use local time for rollover, but it can't be a coincidence that UTC midnight is when it just dies.

I set the recovery tab to auto-restart whenever it encounters an error and I got event logs this time (prior to this, there was nothing obvious in the event logs).

Faulting application name: svchost.exe_w3logsvc, version: 6.3.9600.16384, time stamp: 0x5215dfe3
Faulting module name: ntdll.dll, version: 6.3.9600.16408, time stamp: 0x523d5305
Exception code: 0xc00000fd
Fault offset: 0x0000000000040be2
Faulting process id: 0xa28
Faulting application start time: 0x01cf1704f5a4a298
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 9d61c791-a654-11e3-80c6-00221984bb5f
Faulting package full name: 
Faulting package-relative application ID: 

It's followed up by the following informational entry:

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: svchost.exe_w3logsvc
P2: 6.3.9600.16384
P3: 5215dfe3
P4: ntdll.dll
P5: 6.3.9600.16408
P6: 523d5305
P7: c00000fd
P8: 0000000000040be2
P9: 
P10: 

Attached files:
C:\Windows\Temp\WER787E.tmp.appcompat.txt
C:\Windows\Temp\WER78BE.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_w3lo_2df7dcf5e5ba3c8080ab2339dd605cd45c5f92d8_a8a234c3_cab_30dc78cb\memory.hdmp
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_w3lo_2df7dcf5e5ba3c8080ab2339dd605cd45c5f92d8_a8a234c3_cab_30dc78cb\triagedump.dmp

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_svchost.exe_w3lo_2df7dcf5e5ba3c8080ab2339dd605cd45c5f92d8_a8a234c3_cab_30dc78cb

Analysis symbol: 
Rechecking for solution: 0
Report Id: 9d61c791-a654-11e3-80c6-00221984bb5f
Report Status: 4
Hashed bucket: 

I haven't found anything on Google to explain what might be causing this to fail and there doesn't seem to be anything else here on ServerFault. I have two other IIS 8 servers where this doesn't happen where the settings are the same (as far as I can tell).

share|improve this question
    
I have a similar (perhaps same) issue and this seems to sum it up pretty well: support.microsoft.com/kb/2982169 –  Edward Sampson Nov 20 at 5:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.