ntdll.dll is crashing IIS App Pool with 0xc0000008

0

I have an IIS Web App that has been consistently crashing every day after encountering a series of 0xc000008 exceptions. The error stops getting logged in event viewer after occurring 5 times, however I'm confident it stops after 5 occurrences because the IIS App Pool's Rapid-Fail Protection is configured to kick in after 5 exceptions. I am further convinced the Rapid-Fail Protection is kicking in because I have had to manually recycle/restart the App Pool everyday.

I installed DebugDiag to help trace the exceptions seen in Event Viewer but it has been just as vague as the errors in Event Viewer. At this point I have reached the edge of my very limited knowledge with IIS and ASP.NET and unfortunately haven't been able to try much because I can't get a sensible error message. I've included the error messages from each source below. Any help in understanding them or knowing where to go from here would be greatly appreciated it.

This is a MVC3 Web App written in C# using .NET Framework 4.5.2 running on Windows Server 2012 R2. All applicable windows updates have been installed.

I've enable Failed Request Tracing to hopefully get some more insight into the error.

Event Viewer Error

Faulting application name: w3wp.exe, version: 8.5.9600.16384, time stamp: 0x5215df96
Faulting module name: ntdll.dll, version: 6.3.9600.16502, time stamp: 0x52c359e8
Exception code: 0xc0000374
Fault offset: 0x00000000000f387c
Faulting process id: 0x1588
Faulting application start time: 0x01d239d9a9246e12
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 6dd5b05a-a5ce-11e6-80c5-005056bf6041
Faulting package full name: 
Faulting package-relative application ID: 

Error Analysis from DebugDiag

Report for w3wp__dataximg__PID__2168__Date__11_01_2016__Time_01_03_36PM__593__Second_Chance_Exception_C0000008.dmp

Type of Analysis Performed   Combined Crash/Hang Analysis 
Machine Name   localhost
Operating System   Windows Server 2012 
Number Of Processors   2 
Process ID   2168 
Process Image   c:\Windows\System32\inetsrv\w3wp.exe 
Command Line   c:\windows\system32\inetsrv\w3wp.exe -ap "dataximg" -v "v2.0" -l "webengine4.dll" -a \\.\pipe\iisipm21b77437-5c32-41dc-958b-556a03f34971 -h "C:\inetpub\temp\apppools\dataximg\dataximg.config" -w "" -m 0 -t 20 -ta 0 
System Up-Time   35 day(s) 23:08:46 
Process Up-Time   00:00:07 
Processor Type   X64 
Process Bitness   64-Bit 

Top 5 Threads by CPU time

Note - Times include both user mode and kernel mode for each thread 
Thread ID: 0     Total CPU Time: 00:00:00.030     Entry Point for Thread: w3wp!wmainCRTStartup 
Thread ID: 2     Total CPU Time: 00:00:00.015     Entry Point for Thread: ntdll!TppWorkerThread 
Thread ID: 1     Total CPU Time: 00:00:00.000     Entry Point for Thread: nativerd!NOTIFICATION_THREAD::ThreadProc 
Thread ID: 3     Total CPU Time: 00:00:00.000     Entry Point for Thread: ntdll!TppWorkerThread 
Thread ID: 4     Total CPU Time: 00:00:00.000     Entry Point for Thread: w3tp!THREAD_MANAGER::ThreadManagerThread 


Exception Information  
In w3wp__appimg__PID__2168__Date__11_01_2016__Time_01_03_36PM__593__Second_Chance_Exception_C0000008.dmp the assembly instruction at ntdll!KiRaiseUserExceptionDispatcher+3a in C:\Windows\System32\ntdll.dll from Microsoft Corporation has caused an unknown exception (0xc0000008) on thread 1

Module Information 

Image Name: C:\Windows\System32\ntdll.dll   Symbol Type:  PDB 
Base address: 0x00000003`00905a4d   Time Stamp:  Tue Dec 31 18:57:28 2013  
Checksum: 0x00000000`00000000   Comments:   
COM DLL: False   Company Name:  Microsoft Corporation 
ISAPIExtension: False   File Description:  NT Layer DLL 
ISAPIFilter: False   File Version:  6.3.9600.16502 (winblue_gdr.131231-1531) 
Managed DLL: False   Internal Name:  ntdll.dll 
VB DLL: False   Legal Copyright:© Microsoft Corporation. All rights reserved. 
Loaded Image Name:  ntdll.dll   Legal Trademarks:   
Mapped Image Name:     Original filename:  ntdll.dll 
Module name:  ntdll   Private Build:   
Single Threaded:  False   Product Name:  Microsoft® Windows® Operating System 
Module Size:  1.66 MBytes   Product Version:  6.3.9600.16502 
Symbol File Name:  c:\symbols\ntdll.pdb\A525CD5C71214238B761A6EFA0B3402D1\ntdll.pdb   Special Build:  & 
asp.net
iis
application-pool
asked on Stack Overflow Nov 9, 2016 by TheDude • edited Nov 9, 2016 by TheDude

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0