How to troubleshoot an IIS "Event ID: 1009" error.

re: How to troubleshoot an IIS "Event ID: 1009" error.

brian-murphy-booth — Mon, 15 Jun 2009 13:43:15 GMT

Yes, the list above includes 0x80.

re: How to troubleshoot an IIS "Event ID: 1009" error.

brian-murphy-booth — Fri, 02 Jan 2009 14:51:34 GMT

Venkat,

Exit code 0x3 is most likely ERROR_PATH_NOT_FOUND. To understand why this is happening it is best to know "who" (what DLL) called ExitProcess using that code. The only way to get the "who" is to get a memory DMP of w3wp.exe using something like DebugDiag.

re: How to troubleshoot an IIS "Event ID: 1009" error.

Ethan — Wed, 24 Dec 2008 16:10:13 GMT

This is absolutely the best post I've seen on the error condition you describe, Brian. Specifically, it helped me on a sysprepped VM. After the computer rename, I had to modify metabase permissions to get a web site to run with a unique identity. I sincerely hope that Microsoft takes your post as an excellent example of how to enable the technical community to resolve problems on their own. Imagine how much time and effort it would save the end-user and how much money it would save Microsoft with common PSS calls.

Thanks again!

Ethan Wilansky

re: How to troubleshoot an IIS "Event ID: 1009" error.

Venkat — Sun, 03 Aug 2008 20:11:07 GMT

Hi,

In my application server, I recieved a warning from source W3SVC with an Event ID of 1009. It had a description of "A process serving application pool 'SUCA' terminated unexpectedly. The process ID was '9845'. the exit code was '0x3'. "

Everytime I try to access the pages hosted on this application, i get this error message and the page does not load. In this application website, i have a Webgate ISAPI filter (webgate.dll - used for SSO - Oracle product, Oblix) loaded. When i remove the filter, the application works just fine but if i reload the filter, i start getting this error.

what would this mean? An error with the webgate or an error with IIS 6.0? I tried to look up the reasons for the exit code 0x3 and was not able to find it anywhere. Any help in this regard is highly appreciated.

re: How to troubleshoot an IIS "Event ID: 1009" error.

brian-murphy-booth — Fri, 25 Jul 2008 16:36:21 GMT

Dan

The 0xe0434f4d exception is a generic code that .NET uses to notify the OS that an "exception" occurred. I think technically a .NET exception isn't really an exception so .NET calls kernel32!RaiseException and passes that generic code. The real goal is to allow debuggers to hear that exception and will pause the host process if applicable so we can figure out what's going on and fix the problem. With that in mind... if your process is exiting with 0xe0434f4d that means .NET called RaiseException but also decided that the underlying exception type is was serious enough to warrant closing the process. In ASP.NET this usually only happens when there is a stack overflow. Or... if you are using .NET 2.0 and an exception occurred on a thread not directly under the control of ASP.NET, instead of doing "ExitThread" (v1.1 behavior) after the exception, it does "ExitProcess". Regardless of the actual root of the problem, you will want to get a crash dump using DebugDiag. And you will need to add the kernel32!ExitProcess breakpoint.

re: How to troubleshoot an IIS "Event ID: 1009" error.

Dan — Fri, 06 Jun 2008 11:41:02 GMT

Getting tons of W3SVC 1009 errors all with exit code of "0xe0434f4d", along with some W3SVC 1013 errors.

Our users are experiencing unresponsive page loads, but is sporadic per user (since we are on a 2-server load balanced cluster) and it only seems to affect one server at a time. The unresponsiveness will last 20min to 2hrs...most of the time we are recycling the "problem server" to correct the problem.

Is troubleshooting these 1009 and 1013 errors the right track?

Does anyone have info on the exit code of "0xe0434f4d"?

re: How to troubleshoot an IIS "Event ID: 1009" error.

brian-murphy-booth — Tue, 27 May 2008 13:13:31 GMT

Steven,

In my experience, I have encountered an exit code 0x0 when a debugger was attaching to w3wp.exe, then exiting. Typically a debugger exiting will terminate the host process as well. As the debugger exited on my machine, an exit code of 0 was being logged.

re: How to troubleshoot an IIS "Event ID: 1009" error.

Steven — Fri, 16 May 2008 14:52:28 GMT

I am having the same issue but with an exit code of 0x0. Any thoughts?

re: How to troubleshoot an IIS "Event ID: 1009" error.

brian-murphy-booth — Thu, 21 Feb 2008 13:53:41 GMT

Rob,

Anybody can call "ExitProcess" and pass whatever number they want to the function. Let's say I decide that my app will have 3 possible exit codes. 0 means success perhaps... and 1 means warning... and maybe 2 means error. It's all up to what I want to put in there. So maybe that 0x1 means nothing to anybody except the code that used it. But if Microsoft code called ExitProcess then we'd probably pick a code that makes sense (in theory anyway... right?) Most likely 0x1 is this: ERROR_INVALID_FUNCTION

What you'd probably need to do to troubleshoot that code is find out "who" is calling ExitProcess. If you install DebugDiag 1.1, setup a crash rule that includes the breakpoint of kernel32!ExitProcess then I think you'd catch that. Keep in mind, however, that with a debugging breakpoint of ExitProcess you're goign to get DMPs for things that you don't care about such as AppPool recycles or when restarting IIS. After you have your DMPs you can do a "Crash/Hang Analysis" on it and an MHT report will be generated. Look for the callstack that is doing ExitProcess and then at which DLL called into ExitProcess and that might give some insight into the problem.

Debugging is a skill that takes years to learn. If you get that far and can't make sense of what you see in the report then opening a support incident with Microsoft would get you the rest of the way.

re: How to troubleshoot an IIS "Event ID: 1009" error.

Ed Grant — Fri, 25 Jan 2008 22:10:41 GMT

This is very useful in understanding reasons for 1009s. We were getting 1009 events in the system log from a worker process. The application is Livelink 9.7 with IIS 6.0 as the web server.

The w3wp.exe process constantly died with exit code 0x2 and eventually exit code 0xffffffff which was fatal. This means that the process was unable to load a dependency which proved to be a corrupt registry entry.

re: How to troubleshoot an IIS "Event ID: 1009" error.

Chris Osterdock — Fri, 30 Nov 2007 23:07:13 GMT

Completely awesome! - Server was patched to SP1 however the dll wasn't listed as being patched - I applied SP2 and the problem went away - thanks!!

re: How to troubleshoot an IIS "Event ID: 1009" error.

Rob — Wed, 14 Nov 2007 13:02:08 GMT

Have you any information on the exit code of 0x1?

re: How to troubleshoot an IIS "Event ID: 1009" error.

Jay — Thu, 30 Aug 2007 12:45:06 GMT

Excellent post!! Had permissions issue in the IIS meta database it turns out. Thanks alot saved me hours of searching for this permissions issue!!. Cheers, Jay