I have windows 2003 server which has suddenly stopped working at around 8:03 PM. The windows event logged the message:

An administrator has requested a recycle of all worker processes in application pool 'Pool_XYZ'.

And after that

A process serving application pool 'Pool_XYZ' exceeded time limits during shut down. The process id was '870072'.

Those two messages were repeating every 5 minutes.

I did IISREST and I can see inetinfo.exe running. When I try to access the site, browser returns the same page if the server was not running. There are no w3wp.exe processes (that should be used as app pool hosts). There are no error messages in the vent log. If I telne to port 80, the server disconnects as soon as I press the first characters. There are no requests logged after 8:03 PM in iis log files.

Any ideas on what could be wrong? I have restarted the services multiple times but it does not help.

  • Make sure the application pool is not disabled. Oct 4 '13 at 21:56
  • They are not. I can start them and stop them through inetmgr (but no w3wp.exe is launched). I am also able to create a new site on a new port (88) and do the telnet localhost 88. but it imediatelly disconnects.
    – matra
    Oct 4 '13 at 22:04
  • Check %SystemRoot%\System32\LogFiles\HTTPERR\ for indications that HTTP.SYS is rejecting the connections for some reason. Oct 4 '13 at 22:08
  • Chris thanks, there were errors like "2013-10-04 18:01:29 - - - - - - - - - 5_Connections_Refused -". This could be caoused by support.microsoft.com/default.aspx?scid=kb;EN-US;934878, but on the other hand, there was plenty of memory available.
    – matra
    Oct 4 '13 at 22:26
  • Ah, see my comment on Simon's reply Oct 4 '13 at 22:28

I suspect there's an issue with one of the [external] DLLs being loaded into the worker process. These come about with use of extensions (ASP.NET, ISAPI extensions, Etc.).

My recommendation would be to use Microsoft's SysInternals ProcessMonitor to see what the server is doing when you attempt to start IIS / browse to it. Set your filter to ProcessName = w3wp.exe and see what happens.

You may need to disable certain extensions, re-install them, Etc.

Another situation that I've seen cause a [sort of] similar issue was where a piece of malware had hooked port 80, and was proxying in-front of IIS. A sort of MITM attack if you like.

  • Thanks for the suggestions, but I was already forced to restart the server, which solved the problem. Your theory on MITM can not hold, because I was able to create another site on port 88, and that side had the same problems.
    – matra
    Oct 4 '13 at 22:23
  • +1 I suspect you may have a memory leak with an external DLL - your Connections_Refused lines in HTTPSYS.log suggest that this might be the case. Also see here Oct 4 '13 at 22:29
  • Glad you got it sorted... Oct 4 '13 at 22:37

I have "solved" the problem by restarting the server. Of course the server did not agree on being restarted, and was stuck during the shutdown. I had to initiate another restart through remote machine with iisreset machinename /reboot

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.