Iis error 5002 - Исправление ошибок и поиск оптимальных решений проблем

User521316655 posted

Hi Team,

In our web server, some of the sites are down and Application Pools continually failing. If I start the Application Pools, again go down. While checking event viewer getting Event ID : 5011, 5009 and 5002, event log details as
below.Please help me to resolve the issue. Thank you.
I am facing this issue after applying windows patches.

1. Event ID: 5011 :-

Log Name: System

Source: Microsoft-Windows-WAS

Date: 11/28/2015 7:53:14 AM

Event ID: 5011

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: System1

Description:

A process serving application pool ‘www.site1.com’ suffered a fatal communication error with the Windows Process Activation Service. The process id was ‘22244’. The data field contains the error number.

Event Xml:

<Channel>System</Channel>

<Computer>System1</Computer>

</System>

</EventData>

</Event>

2. Event ID: 5009 :-

Log Name: System

Source: Microsoft-Windows-WAS

Date: 11/28/2015 7:53:40 AM

Event ID: 5009

Task Category: None

Level: Warning

Keywords: Classic

User: N/A

Computer: System1

Description:

A process serving application pool ‘www.site2.com’ terminated unexpectedly. The process id was ‘25584’. The process exit code was ‘0x0’.

Event Xml:

<Channel>System</Channel>

<Computer>System1</Computer>

</System>

</EventData>

</Event>

3. Event ID: 5002 :-

Log Name: System

Source: Microsoft-Windows-WAS

Date: 11/28/2015 8:47:40 AM

Event ID: 5002

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: System1

Description:

Application pool ‘www.site3.com’ is being automatically disabled due to a series of failures in the process(es) serving that application pool.

Event Xml:

<Channel>System</Channel>

<Computer>System1</Computer>

</System>

</Binary>

</EventData>

</Event>

Источник

I was able to work through this issue, however I wanted to post on here because of how long I had to search to finally figure out the issue.

I had copied an IIS installation from one server to a new one and set up all of the sites. Everything seemed to be working, however one of the applications would fail after very few calls were made to it.

The Event Log shows an Error 5002:

Application pool '{appPoolName}' is being automatically disabled due to a series 
of failures in the process(es) serving that application pool.

I was sent all over my server settings to look at folder permissions and this was not the issue. I was also sent to Microsoft’s Page Not Found page numerous times to download a Debug Diagnostics tool. (Not sure this tool exists for 2008 R2)

Reference

SteveC

2713 gold badges8 silver badges21 bronze badges

asked Dec 6, 2012 at 23:36

I was finally able to track down this page which pointed me in the direction of the loadBalancerCapabilities.

If you are behind a load balancer and it is HTTP aware this setting should be set to HttpLevel (default), however if your load balancer is not HTTP aware you need to set it to TcpLevel.

Also you will want to make sure that your load balancer is not set to filter by Bytes/Packets but by Destination/Session Established. Once I made these changes I fired up the app pool and pounded it with requests and had no more errors.

Also just for search/record the load balancer that I was using was a:

Syswan Technologies Duolinks SW24 Dual WAN Load Balancer

answered Dec 6, 2012 at 23:36

jon3lazejon3laze

1411 gold badge2 silver badges8 bronze badges

Источник

I am running an ASP.NET 3.5 web application on IIS 7 on Windows Server 2008.

I received the following error earlier this afternoon:

HTTP Error 503. The service is unavailable.

I looked in the Event logs and discovered that:

A process serving application pool 'Classic .NET AppPool' suffered a fatal communication error with the Windows Process Activation Service. The process id was '3328'. The data field contains the error number.

Here is the full details of that event:

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          18/09/2009 14:58:31
Event ID:      5011
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      computername
Description:
A process serving application pool 'Classic .NET AppPool' suffered a fatal communication error with the Windows Process Activation Service. The process id was '3328'. The data field contains the error number.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{5 .. 0}" EventSourceName="WAS" />
    <EventID Qualifiers="32768">5011</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-09-18T13:58:31.000Z" />
    <EventRecordID>23552</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>computername</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AppPoolID">Classic .NET AppPool</Data>
    <Data Name="ProcessID">3328</Data>
    <Binary>6D000780</Binary>
  </EventData>
</Event>

This resulted in:

Application pool 'Classic .NET AppPool' is being automatically disabled due to a series of failures in the process(es) serving that application pool.

Here is the full details of that event:

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          18/09/2009 15:03:05
Event ID:      5002
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      computername
Description:
Application pool 'Classic .NET AppPool' is being automatically disabled due to a series of failures in the process(es) serving that application pool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{5 .. 0}" EventSourceName="WAS" />
    <EventID Qualifiers="49152">5002</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2009-09-18T14:03:05.000Z" />
    <EventRecordID>23557</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>computername</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AppPoolID">Classic .NET AppPool</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

Concluding in the: HTTP Error 503. The service is unavailable.

Would someone please help me to identify how this happened and what I need to do to prevent it from happening in the future.

Источник

В некоторых случаях ваша система может генерировать эту ошибку с идентификатором события ошибки 5002. Эта ошибка может иметь множество причин.

ПК работает медленно?

1. Загрузите ASR Pro с веб-сайта

2. Установите его на свой компьютер.

3. Запустите сканирование, чтобы найти вредоносные программы или вирусы, которые могут скрываться в вашей системе.

Улучшите скорость своего компьютера сегодня, загрузив это программное обеспечение — оно решит проблемы с вашим ПК. г.

ж.Обычно здесь возникает ошибка, когда вы хотите, чтобы репликация DFS на рынке эффективно устанавливала обратную ссылку удаленного вызова процедур (RPC) для связи с вашими близкими. Это также может быть вызвано блокировкой RPC на любом брандмауэре между партнерами и / или, возможно, любой ошибкой DNS.

грамм.

идентификатор события	5002
Источник	Microsoft -Windows-WAS
Описание	Пул приложений “% 1” автоматически вызывается при оценке ошибок при развертывании, отключение одного или нескольких типов лечения этот пул приложений.
Информация о событии	Согласно Microsoft: Причина: Это событие регистрируется, когда пул размещения автоматически закрывается в количестве количество ошибок или несколько новых процессов измеряют этот пул приложений. Решение: Выполните отладку нашего приложения и перезапустите программное обеспечение пула. Чтобы восстановить отключенный пул реестра, следуйте этим идеям: Устраните проблемы с приложением, запущенным непосредственно на рабочем задании. Приложение может запрашивать отладку и повторную отладку. Стили. Перезапустите пул приложений. У вас должны быть администраторы или особые права для выполнения этой процедуры. Перезагрузите приложение billiard: 1. Нажмите «Пуск», «Панель управления», возможно, «Администрирование». 2. Щелкните правой кнопкой мыши Диспетчер информации служб Интернета (IIS) и выберите Запуск от имени администратора. рядом. В разделе «Развертывание для подключений» выберите этот компьютер для подключения к Интернету и часто выбирайте папку Пулы приложений ниже. 4. В нашем собственном представлении функций выберите пул приложений, который вы хотите перезапустить. 5. Щелкните приложения правой кнопкой мыши, которые, в свою очередь, при запуске выбирают пул. Проверка: Вы должны быть членом Администратора или иметь соответствующие привилегии для выполнения этого действия g. Чтобы убедиться, что коллекция приложений запущена: 1. Нажмите Пуск, нажмите, Панель управления, затем Администрирование. 2. Щелкните правой кнопкой мыши «Перейти к справке и советнику IIS» и выберите «Запуск от имени администратора». 3. В сегменте «Подключения» разверните узел сервера и выберите Пулы приложений. 4. В представлении функций столбец состояния пула методов означает «Запущен», когда пул компьютерных программ работает.
Справочные ссылки	Microsoft-Windows-WAS Event ID 5002

Немедленное перехватывание угроз

Мы работаем с вами, чтобы помочь вам быстро распознать киберугрозы и предотвратить атаки до того, как они нанесут ущерб.

Это событие регистрируется, когда пул приложений мгновенно скомпрометирован из-за серии сбоев только во всех процессах, обслуживающих этот пул приложений. Чтобы восстановить ранее отключенный пул приложений, выполните следующие действия: Устраните все обстоятельства в приложении, которое не участвовало в рабочем процессе.

Была ошибка 5002?

Путаница с кодом ошибки 5002, похоже, указывает на то, что, к сожалению, разрешение вашего инструмента в настоящее время обычно не поддерживается для Интернета, в который вы продолжаете играть. Чаще всего это может произойти, если ваше устройство получило замену прошивки, которая обычно вызвана изменением пользовательского интерфейса, которое производитель / продавец также может позаботиться о том, чтобы вы сделали это по своему усмотрению.

Было 5002 iis?

Веб-сайты и веб-установки зависят от доступности пулов инструментов Internet Information Services (IIS). Устраните все проблемы с приложениями, которые вернули этот процесс к работе. Приложение придется отлаживать и повторно тестировать.

Troubleshooting Error Event ID 5002
오류 이벤트 ID 5002 문제 해결
Problemen Oplossen Fout Gebeurtenis-ID 5002
Rozwiązywanie Problemów Z Błędem O Identyfikatorze Zdarzenia 5002
Felsökning Felhändelse -ID 5002
Risoluzione Dei Problemi Con ID Evento 5002
Solução De Problemas Com ID De Evento De Erro 5002
Dépannage De L’ID D’événement D’erreur 5002
Solución De Problemas Con ID De Evento De Error 5002
Fehlerbehebung Ereignis-ID 5002

г.

Источник

Event ID 5002 — IIS Application Pool Availability

Updated: January 20, 2010

Applies To: Windows Server 2008

Web sites and Web applications depend on the availability of Internet Information Services (IIS) application pools. IIS application pools in turn depend on the Windows Process Activation Service (WAS). If WAS is not running or errors occur during the startup or shutdown of an application pool, Web sites and Web applications may not be available.

Event Details

Product:	Internet Information Services
ID:	5002
Source:	Microsoft-Windows-WAS
Version:	7.0
Symbolic Name:	WAS_EVENT_RAPID_FAIL_PROTECTION
Message:	Application pool ‘%1’ is being automatically disabled due to a series of failures in the process(es) serving that application pool.

Resolve
Debug the application and restart the application pool

To recover an application pool that has been disabled, follow these steps:

Correct any problems in the application that was running in the worker process. The application may have to be debugged and retested.
Restart the application pool.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To restart the application pool:

Click Start, click Control Panel, and then click Administrative Tools.
Right-click Internet Information Services (IIS) Manager and select Run as administrator.
In the Connections pane, expand the computer node for the Web server and select the Application Pools folder underneath it.
In Features View, select the application pool you want to restart.
Right-click the application pool and select Start.

Verify

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that an application pool has started:

Click Start, click Control Panel, and then click Administrative Tools.
Right-click Internet Information Services (IIS) Manager and select Run as administrator.
In the Connections pane, expand the server node and select Application Pools.
In Features View, the Status column for the application pool will indicate Started if the application pool has started.

Related Management Information

IIS Application Pool Availability

Internet Information Services (IIS) 7.0

Источник

Introduction

Suddenly this Monday, the PC hosting the bug tracker site jumped from Win10 1611 to 1709.

At the end of the upgrade process, the site was not available anymore.
IIS seemed up and running, but something occurred and put the site offline.

Looking at the event log, I saw swarms of the following errors:

Error 2307 – IIS-W3SVC-WP

The worker process for application pool ‘DefaultAppPool’ encountered an error ‘Cannot read configuration file’ trying to read configuration data from file ‘\?<EMPTY>’, line number ‘0’. The data field contains the error code.

Error 5002 – WAS

Application pool ‘DefaultAppPool’ is being automatically disabled due to a series of failures in the process(es) serving that application pool.

Error 5189 – WAS

The Windows Process Activation Service failed to generate an application pool config file for application pool ‘DefaultAppPool’. The error type is ‘5’. To resolve this issue, please ensure that the applicationhost.config file is correct and recommit the last configuration changes made. The data field contains the error number.

Error 5203 – WAS

A process serving application pool ‘DefaultAppPool’ reported a failure trying to read configuration during startup. The process id was ‘6240’. Please check the Application Event Log for further event messages logged by the worker process on the specific error. The data field contains the error number.

Warning 9009 – IIS-APPHOSTSVC

The Application Host Helper Service encountered an error trying to delete the history directory ‘C:inetpubhistoryCFGHISTORY_0000000012’. The directory will be skipped and ignored. Note that the directory may still get deleted in the future if the service restarts. The data field contains the error number.

‘DefaultAppPool’ is my IIS configuration, and it seemed to be correct.

The Resolution

After some investigation on the web, I found that it is a known problem and that it probably involves this folder:

C:inetpubtempappPoolsDefaultAppPool

I discovered that for unknown reasons, ‘DefaultAppPool’ was a corrupted shortcut into the ‘appPools’ folder.

To fix it, you need to:

open a Command Prompt with administrative access rights
stop IIS service

iisreset /stop

delete or rename ‘DefaultAppPool‘ shortcut. If you tried to access to IIS site, this folder may be locked by some other system account. To work around this, reboot and repeat the process without engaging IIS.
(optional) delete everything you can, from this folder:

C:inetpubhistory

reboot

In my case, IIS began working again.

Post Mortem Analysis

It seems that:

when the system starts, ‘C:inetpubtempappPoolsDefaultAppPool‘ isn’t present.
at the first site page request, ISS creates it
if an error occurs, it isn’t able to fix it by itself.

Post Views: 10,262

Источник

title	author	description	ms.date	ms.assetid	msc.legacyurl	msc.type
Troubleshooting 502 Errors in ARR	rick-anderson	IIS Failed Request Tracing Network Monitor Winhttp Tracing This material is provided for informational purposes only. Microsoft makes no warranties, express…	04/09/2012	f419b76c-aea0-4b3c-b206-2ae31ee2436c	/learn/extensions/troubleshooting-application-request-routing/troubleshooting-502-errors-in-arr	authoredcontent

by Richard Marr

Tools Used in this Troubleshooter:

IIS Failed Request Tracing
Network Monitor
Winhttp Tracing

This material is provided for informational purposes only. Microsoft makes no warranties, express or implied.

HTTP 502 — Overview

When working with IIS Application Request Routing (ARR) deployments, one of the errors that you may see is «HTTP 502 — Bad Gateway». The 502.3 error means that — while acting as a proxy — ARR was unable to complete the request to the upstream server and send a response back to the client. This can happen for multiple reasons — for example: failure to connect to the server, no response from the server, or the server took too long to respond (time out). If you are able to reproduce the error by browsing the web farm from the controller, and detailed errors are enabled on the server, you may see an error similar to the following:

Figure 1 (Click image to expand)

The root cause of the error will determine the actions you should take to resolve the issue.

502.3 Timeout Errors

The error code in the screenshot above is significant because it contains the return code from WinHTTP, which is what ARR uses to proxy the request and identifies the reason for the failure.

You can decode the error code with a tool like err.exe. In this example, the error code maps to ERROR_WINHTTP_TIMEOUT. You can also find this information in the IIS logs for the associated website on the ARR controller. The following is an excerpt from the IIS log entry for the 502.3 error, with most of the fields trimmed for readability:

`sc-status`	`sc-substatus`	`sc-win32-status`	`time-taken`
`502`	`3`	`12002`	`29889`

The win32 status 12002 maps to the same ERROR_WINHTTP_TIMEOUT error reported in the error page.

What exactly timed-out?

We investigate this a bit further by enabling Failed Request Tracing on the IIS server. The first thing we can see in the failed request trace log is where the request was sent to in the ARR_SERVER_ROUTED event. The second item I have highlighted is what you can use to track the request on the target server, the X-ARR-LOG-ID. This will help if you are tracing the target or destination of the HTTP request:

77.	ARR_SERVER_ROUTED	RoutingReason=»LoadBalancing», Server=»192.168.0.216″, State=»Active», TotalRequests=»3″, FailedRequests=»2″, CurrentRequests=»1″, BytesSent=»648″, BytesReceived=»0″, ResponseTime=»15225″ 16:50:21.033
78.	GENERAL_SET_REQUEST_HEADER	HeaderName=»Max-Forwards», HeaderValue=»10″, Replace=»true» 16:50:21.033
79.	GENERAL_SET_REQUEST_HEADER	HeaderName=»X-Forwarded-For», HeaderValue=»192.168.0.204:49247″, Replace=»true» 16:50:21.033
80.	GENERAL_SET_REQUEST_HEADER	HeaderName=»X-ARR-SSL», HeaderValue=»», Replace=»true» 16:50:21.033
81.	GENERAL_SET_REQUEST_HEADER	HeaderName=»X-ARR-ClientCert», HeaderValue=»», Replace=»true» 16:50:21.033
82.	GENERAL_SET_REQUEST_HEADER	HeaderName=»X-ARR-LOG-ID», HeaderValue=»dbf06c50-adb0-4141-8c04-20bc2f193a61″, Replace=»true» 16:50:21.033
83.	GENERAL_SET_REQUEST_HEADER	HeaderName=»Connection», HeaderValue=»», Replace=»true» 16:50:21.033

The following example shows how this might look on the target server’s Failed Request Tracing logs; you can validate that you have found the correct request by matching up the «X-ARR-LOG_ID» values in both traces.

185.	GENERAL_REQUEST_HEADERS Headers=»Connection: Keep-Alive Content-Length: 0 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US Host: test Max-Forwards: 10 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0) X-Original-URL: /time/ X-Forwarded-For: 192.168.0.204:49247 X-ARR-LOG-ID: dbf06c50-adb0-4141-8c04-20bc2f193a61
<multiple entries skipped for brevity>
345.	GENERAL_FLUSH_RESPONSE_END BytesSent=»0″, ErrorCode=»An operation was attempted on a nonexistent network connection. (0x800704cd)» 16:51:06.240

In the above example, we can see that the ARR server disconnected before the HTTP response was sent. The timestamp for GENERAL_FLUSH_RESPONSE_END can be used as a rough guide to find the corresponding entry in the IIS logs on the destination server.

`date`	`time`	`s-ip`	`cs-method`	`cs-uri-stem`	`cs-uri-query`	`s-port`	`cs-username`	`sc-status`	`sc-substatus`	`sc-win32-status`	`time-taken`
`2011-07-18`	`16:51:06`	`92.168.0.216`	`GET`	`/time/`	`-`	`80`	`-`	`200`	`0`	`64`	`45208`

Note that IIS on the destination server logged an HTTP 200 status code, indicating that the request completed successfully. Also note that the win32 status has changed to 64, which maps to ERROR_NETNAME_DELETED. This generally indicates that the client (ARR being the ‘client’ in this case) had disconnected before the request completed.

What happened?

Only the ARR server is reporting a timeout, so that is where we should look first.

In the IIS log entry from the ARR server, we can see that the time-taken is very close to 30 seconds, but the member server log shows that it took 45 seconds (45208 ms) to send the response. This suggests that ARR is timing the request out, and if we check the proxy timeout in the server farm’s proxy settings, we will see that it is set to 30 seconds by default.

So in this case we can clearly see that the ARR timeout was shorter than the execution of the request. Therefore, you would want to investigate whether this execution time was normal or whether you would need to look at why the request was taking longer than expected. If this execution time was expected and normal, increasing the ARR timeout should resolve the error.

Other possible reasons for ERROR_WINHTTP_TIMEOUT include:

ResolveTimeout: This occurs if name resolution takes longer than the specified timeout period.
ConnectTimeout: This occurs if it takes longer than the specified timeout period to connect to the server after the name resolved.
SendTimeout: If sending a request takes longer than this time-out value, the send operation is canceled.
ReceiveTimeout: If a response takes longer than this time-out value, the request is canceled.

Looking at the first two examples, ResolveTimeout and ConnectTimeout, the troubleshooting methodology outlined above would not work. This is because you would not see any traffic on the target server and therefore would not know the error code. Thus in this case of ResolveTimeout or ConnectTimeout you would want to capture a WinHTTP trace for additional insight. See the WinHTTP/WEBIO Tracing section of this troubleshooter as well as the following blogs for additional examples on troubleshooting and tracing:

502.3 Bad Gateway «The operation timed out» with IIS Application Request Routing (ARR)
Winhttp Tracing Options for Troubleshooting with Application Request Routing

502.3 Connection Termination Errors

502.3 errors are also returned when the connection between ARR and the member server is disconnected mid-stream. To test this type of problem, create a simple .aspx page that calls Response.Close(). In the following example there is a directory called «time» which is configured with a simple aspx page as the default document of that directory. When browsing to the directory, ARR will display this error:

Figure 2 (Click image to expand)

The error 0x80072efe corresponds to ERROR_INTERNET_CONNECTION_ABORTED. The request can be traced to the server that actually processed it using the same steps used earlier in this troubleshooter, with one exception; while Failed Request Tracing on the destination server shows the request was processed on the server, the associated log entry does not appear in the IIS logs. Instead, this request is logged in the HTTPERR log as follows:

[!code-consoleMain]

The built-in logs on the destination server do not provide any additional information about the problem, so the next step would be to gather a network trace from the ARR server. In the example above, the .aspx page called Response.Close() without returning any data. Viewing this in a network trace would show that a Connection: close HTTP header was coming from the destination server. With this information you could now start an investigation into why the Connection: close header was sent.

The error below is another example of an invalid response from the member server:

Figure 3 (Click image to expand)

In this example, ARR started to receive data from the client but something went wrong while reading the request entity body. This results in the 0x80072f78 error code being returned. To investigate further, use Network Monitor on the member server to get a network trace of the problem. This particular error example was created by calling Response.Close() in the ASP.net page after sending part of the response and then calling Response.Flush(). If the traffic between the ARR server and the member servers is over SSL, then WinHTTP tracing on Windows Server 2008 or WebIO tracing on Windows Server 2008 R2 may provide additional information. WebIO tracing is described later in this troubleshooter.

502.4 No appropriate server could be found to route the request

The HTTP 502.4 error with an associated error code of 0x00000000 generally indicates that all the members of the farm are either offline, or otherwise unreachable.

Figure 4 (Click image to expand)

The first step is to verify that the member servers are actually online. To check this, go to the «servers» node under the farm in the IIS Manager.

Figure 5 (Click image to expand)

Servers that are offline can be brought back online by right-clicking on the server name and choosing «Add to Load Balancing». If you cannot bring the servers back online, verify the member servers are reachable from the ARR server. The «trace Messages» pane on the «servers» page may also provide some clues about the problem. If you are using Web Farm Framework (WFF) 2.0, you may receive this error if the application pool restarts. You will need to restart the Web Farm Service to recover.

WinHTTP/WebIO Tracing

Usually, Network Monitor will provide you with the information you need to identify exactly what is timing out, however there are times (such as when the traffic is SSL encrypted) that you will need to try a different approach. On Windows 7 and Windows Server 2008R2 you can enable WinHTTP tracing using the netsh tool by running the following command from an administrative command prompt:

[!code-consoleMain]

Then, reproduce the problem. Once the problem is reproduced, stop the tracing by running the following command from the command prompt:

[!code-consoleMain]

The stop command will take a few seconds to finish. When it is done, you will find a net.etl file and a net.cab file in C:temp. The .cab file contains event logs and additional data that may prove helpful in analyzing the .etl file.

To analyze the log, open it in Netmon 3.4 or later. Make sure you have set up your parser profile as described here. Scroll through the trace until you find the w3wp.exe instance where ARR is running by correlating with the «UT process name» column. Right click on w3wp and choose «Add UT Process name to display filter». This will set the display filter similar to:

[!code-consoleMain]

You can further filter the results by changing it to the following:

[!code-consoleMain]

You will need to scroll through the output until you find the timeout error. In the example below, a request timed out because it took more than 30 seconds (ARR’s default timeout) to run.

336	2:32:22 PM	7/22/2011	32.6380453	w3wp.exe (1432)	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:32:23.123 ::sys-recver starts in _INIT state
337	2:32:22 PM	7/22/2011	32.6380489	w3wp.exe (1432)	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:32:23.123 ::current thread is not impersonating
340	2:32:22 PM	7/22/2011	32.6380584	w3wp.exe (1432)	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:32:23.123 ::sys-recver processing WebReceiveHttpResponse completion (error-cdoe = ? (0x5b4), overlapped = 003728F0))
341	2:32:22 PM	7/22/2011	32.6380606	w3wp.exe (1432)	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:32:23.123 ::sys-recver failed to receive headers; error = ? (1460)
342	2:32:22 PM	7/22/2011	32.6380800	w3wp.exe (1432)	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:32:23.123 ::ERROR_WINHTTP_FROM_WIN32 mapped (?) 1460 to (ERROR_WINHTTP_TIMEOUT) 12002
343	2:32:22 PM	7/22/2011	32.6380829	w3wp.exe (1432)	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:32:23.123 ::sys-recver returning ERROR_WINHTTP_TIMEOUT (12002) from RecvResponse()
344	2:32:22 PM	7/22/2011	32.6380862	w3wp.exe (1432)	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:32:23.123 ::sys-req completes recv-headers inline (sync); error = ERROR_WINHTTP_TIMEOUT (12002)

In this next example, the content server was completely offline:

42	2:26:39 PM	7/22/2011	18.9279133	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:26:39.704 ::WinHttpReceiveResponse(0x11d23d0, 0x0)	{WINHTTP_MicrosoftWindowsWinHttp:4, NetEvent:3}
43	2:26:39 PM	7/22/2011	18.9279633	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:26:39.704 ::sys-recver starts in _INIT state	{WINHTTP_MicrosoftWindowsWinHttp:4, NetEvent:3}
44	2:26:39 PM	7/22/2011	18.9280469	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:26:39.704 ::current thread is not impersonating	{WINHTTP_MicrosoftWindowsWinHttp:4, NetEvent:3}
45	2:26:39 PM	7/22/2011	18.9280776	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:26:39.704 ::sys-recver processing WebReceiveHttpResponse completion (error-cdoe = WSAETIMEDOUT (0x274c), overlapped = 003728F0))	{WINHTTP_MicrosoftWindowsWinHttp:4, NetEvent:3}
46	2:26:39 PM	7/22/2011	18.9280802	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:26:39.704 ::sys-recver failed to receive headers; error = WSAETIMEDOUT (10060)	{WINHTTP_MicrosoftWindowsWinHttp:4, NetEvent:3}
47	2:26:39 PM	7/22/2011	18.9280926	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:26:39.704 ::ERROR_WINHTTP_FROM_WIN32 mapped (WSAETIMEDOUT) 10060 to (ERROR_WINHTTP_TIMEOUT) 12002	{WINHTTP_MicrosoftWindowsWinHttp:4, NetEvent:3}
48	2:26:39 PM	7/22/2011	18.9280955	WINHTTP_MicrosoftWindowsWinHttp	WINHTTP_MicrosoftWindowsWinHttp:12:26:39.704 ::sys-recver returning ERROR_WINHTTP_TIMEOUT (12002) from RecvResponse()	{WINHTTP_MicrosoftWindowsWinHttp:4, NetEvent:3}

Other Resources

ERR.EXE
Winhttp Error Codes
Failed Request Tracing
Winhttp Tracing
Network Monitor

Источник

I’d like to preface this post by saying I’ve performed many SCCM/SUP installs and never had an issue like this before.

We recently decided to rebuild our WSUS server and been having nothing but problems, and believe the issue may reside with IIS itself but I’m not quite sure. Our WSUS environment is not complex at all, it’s a single server that connections directly to Microsoft without proxy settings.

Please let me know if any other logs or information would be helpful. Any help or suggestions would be greatly appreciated!

Environment Details
Type: Single Primary Site Server
SCCM Version: SCCM R2 SP1 CU1 (5.0.8239.1203)
OS Version: Server 2012 R2 (WSUS and SCCM)
Hardware: Hosted on vmWare ESX6.0 (6 Cores, 12GB RAM)
WSUS DB: Default

Timeline of Events

Built WSUS Server
Installed WSUS and IIS Roles
Installed all applicable updates
Installed SUP Site System Roll on WSUS
1. Verified role was successfully installed
Started WSUS Sync
1. Sync starts successfully

This is when things start going awry.
The following Informational Log will be logged in the WSUS Event Log five or six times:

A worker process serving application pool 'WsusPool' has requested a recycle because it reached its private bytes 
memory limit.

Then this Error message is logged in the WSUS Event Log:

Application pool 'WsusPool' is being automatically disabled due to a series of failures in the process(es) serving 
that application pool.

Here are the full details of the WSUS WAS Event Log:

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          9/16/2015 3:57:28 PM
Event ID:      5002
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      xxx-wsus.xxxxxxxxxx.org
Description:
Application pool 'WsusPool' is being automatically disabled due to a series of failures in the process(es) serving that application pool.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />
    <EventID Qualifiers="49152">5002</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-09-16T20:57:28.000000000Z" />
    <EventRecordID>4099</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>xxx-wsus.xxxxxxxxxx.org</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AppPoolID">WsusPool</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          9/16/2015 3:56:28 PM
Event ID:      5117
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      xxx-wsus.xxxxxxxxxx.org
Description:
A worker process serving application pool 'WsusPool' has requested a recycle because it reached its private bytes memory limit.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />
    <EventID Qualifiers="16384">5117</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-09-16T20:56:28.000000000Z" />
    <EventRecordID>4098</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>xxx-wsus.xxxxxxxxxx.org</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AppPoolID">WsusPool</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          9/16/2015 3:55:28 PM
Event ID:      5117
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      xxx-wsus.xxxxxxxxxx.org
Description:
A worker process serving application pool 'WsusPool' has requested a recycle because it reached its private bytes memory limit.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />
    <EventID Qualifiers="16384">5117</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-09-16T20:55:28.000000000Z" />
    <EventRecordID>4097</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>xxx-wsus.xxxxxxxxxx.org</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AppPoolID">WsusPool</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          9/16/2015 3:54:28 PM
Event ID:      5117
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      xxx-wsus.xxxxxxxxxx.org
Description:
A worker process serving application pool 'WsusPool' has requested a recycle because it reached its private bytes memory limit.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />
    <EventID Qualifiers="16384">5117</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-09-16T20:54:28.000000000Z" />
    <EventRecordID>4096</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>xxx-wsus.xxxxxxxxxx.org</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AppPoolID">WsusPool</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          9/16/2015 3:53:28 PM
Event ID:      5117
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      xxx-wsus.xxxxxxxxxx.org
Description:
A worker process serving application pool 'WsusPool' has requested a recycle because it reached its private bytes memory limit.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />
    <EventID Qualifiers="16384">5117</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-09-16T20:53:28.000000000Z" />
    <EventRecordID>4095</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>xxx-wsus.xxxxxxxxxx.org</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="AppPoolID">WsusPool</Data>
    <Binary>
    </Binary>
  </EventData>
</Event>

We can see the final error in the above Event Log occurs at 3:57:28 PM which then causes the WSUS Sync to fail soon after. Here is the wsyncmgr.log for that same time period:

Synchronizing update b15b5258-cf26-4a7e-8697-18691f416d35 - Security Update for Windows Server 2008 R2 for Itanium-based Systems (KB2544893)	SMS_WSUS_SYNC_MANAGER	9/16/2015 3:56:53 PM	11048 (0x2B28)
Synchronizing update 1330db53-75ff-4d87-9270-6a5449a67ad7 - Security Update for Windows Server 2008 R2 x64 Edition (KB2544893)	SMS_WSUS_SYNC_MANAGER	9/16/2015 3:57:41 PM	11048 (0x2B28)
sync: SMS synchronizing updates, processed 969 out of 6795 items (14%), ETA in 01:29:23	SMS_WSUS_SYNC_MANAGER	9/16/2015 3:57:55 PM	11048 (0x2B28)
Synchronizing update 356293c8-36ff-40f7-bb26-8b5d4822c5e8 - Security Update for Windows Server 2008 x64 Edition (KB2544893)	SMS_WSUS_SYNC_MANAGER	9/16/2015 3:57:56 PM	11048 (0x2B28)
Failed to sync update 356293c8-36ff-40f7-bb26-8b5d4822c5e8. Error: The request failed with HTTP status 503: Service Unavailable. Source: Microsoft.UpdateServices.Internal.ApiRemoting.ExecuteSPGetInstallableItems	SMS_WSUS_SYNC_MANAGER	[b]9/17/2015 3:57:56 PM[/b]	14800 (0x39D0)

Once the above errors occur the WSUS IIS App Pool is wrecked. The App Pool stops and while it can be restarted it’ll eventually crash again and the WSUS console cannot be opened nor can SCCM reconnect.

Finally here is the WCM.Log showing SCCM trying to reconnect to WSUS:

Supported WSUS version found	SMS_WSUS_CONFIGURATION_MANAGER	9/16/2015 4:02:48 PM	9808 (0x2650)
Attempting connection to WSUS server: xxx-wsus.xxxxxxxxxx.org, port: 8530, useSSL: False	SMS_WSUS_CONFIGURATION_MANAGER	9/16/2015 4:02:48 PM	9808 (0x2650)
System.Net.WebException: The request failed with HTTP status 503: Service Unavailable.~~   at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)~~   at Microsoft.SystemsManagementServer.WSUS.WSUSServer.ConnectToWSUSServer(String ServerName, Boolean UseSSL, Int32 PortNumber)	SMS_WSUS_CONFIGURATION_MANAGER	9/16/2015 4:02:48 PM	9808 (0x2650)
Remote configuration failed on WSUS Server.	SMS_WSUS_CONFIGURATION_MANAGER	9/16/2015 4:02:48 PM	9808 (0x2650)
STATMSG: ID=6600 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_WSUS_CONFIGURATION_MANAGER" SYS=xxx-sccm1.xxxxxxxxxx.org SITE=xxx PID=13904 TID=9808 GMTDATE=Wed Sep 16 21:02:48.489 2015 ISTR0="xxx-wsus.xxxxxxxxxx.org" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0	SMS_WSUS_CONFIGURATION_MANAGER	9/16/2015 4:02:48 PM	9808 (0x2650)

As seen above SCCM cannot connect to WSUS because the App Pool is down.

Notes

I’ve attempted this role installation multiple times with the same results
I’ve tried this Role install three times on fresh WSUS servers
The App Pool crashes appear to happen at anytime during any phase of the synchronization
I’ve tried disabling Private Memory Limit on the App Pool
Next Steps

I think next I’m going to enable logging and debugging on IIS to see if I can get more details on what’s happening. If anyone has any other ideas or suggestions, please let me know.

a

Источник