Windows Server 2019 Std - w3wp.exe randomnly faulting on module ntdll.dll

Question

Windows Server 2019 Std - w3wp.exe randomnly faulting on module ntdll.dll

Paolo Aimetti 1

we have the same Classic ASP application running on 5 different servers with no issue except on a specific machine where since the last few days we started seeing errors:

A trappable error (C0000005) occurred in an external object. The script cannot continue running.

and then checking in the events log we see

Faulting application name: w3wp.exe, version: 10.0.17763.1, time stamp: 0xcfdb13d8
Faulting module name: ntdll.dll, version: 10.0.17763.2686, time stamp: 0x3c398a4b
Exception code: 0xc0000374
Fault offset: 0x00000000000fa979
Faulting process id: 0x2c74
Faulting application start time: 0x01d8de2fe02a4873
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: defd2bc0-c487-4276-8884-6095ba4f8d91
Faulting package full name:
Faulting package-relative application ID:

the ASP application uses CDOSYS and ADODB as the only external components; in a first incident the problem was specifically connected to CDOSYS as most attempts to send an email were failing with the error above; after a windows update and a reboot the problem disappeared but today is coming up again and most likely no longer connected with CDOSYS.

I see an event referring to crash dumps done for this error but I'm not sure which file to eventually attach to this post.

Fault bucket 2026183799972224358, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: w3wp.exe
P2: 10.0.17763.1
P3: cfdb13d8
P4: StackHash_a773
P5: 10.0.17763.2686
P6: 3c398a4b
P7: c0000374
P8: PCH_DF_FROM_ntdll+0x00000000000A0544
P9:
P10:

Attached files:
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3497.tmp.mdmp
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3582.tmp.WERInternalMetadata.xml
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3593.tmp.xml
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3591.tmp.csv
\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER3592.tmp.txt

These files may be available here:
\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_w3wp.exe_9a5d4cd281d22916d88353d1de2eb94323cfdf_98baeb8b_323e367b

Analysis symbol:
Rechecking for solution: 0
Report Id: defd2bc0-c487-4276-8884-6095ba4f8d91
Report Status: 268435456
Hashed bucket: 17b95b3a2a0424f1cc1e736e4efedd66
Cab Guid: 0

any help is appreciated.

thanks

Paolo Aimetti 1 Reputation point

2022-10-13T15:50:51.873+00:00

I forgot to say the problem is seen only on the server where the IIS application pool has been set Maximum Worker Process = 2, for all the other servers running the same app and not having this problem the Maximum Worker Process was left at 1.
Yurong Dai-MSFT 2,846 Reputation points Microsoft External Staff

2022-10-14T09:10:45.033+00:00

Hi @Paolo Aimetti ,
The problem is that w3wp.exe randomly fails on module ntdll.dll, and even if you are familiar with IIS, if you don't know how to analyze crash dumps, you may not be able to dig deep. I suggest you open a case via: https://support.microsoft.com, involve the Microsoft support team, and provide the IIS crash dump you captured for analysis.
Paolo Aimetti 1 Reputation point

2022-10-14T10:46:57.883+00:00

Thanks for the suggestion, I would love to have help from the support but apparently they do not serve our country ( Barbados ); I went through the steps to post a support requests several times and it all ends saying:

The current region or country does not have support plans available for purchase.

Our server is hosted by OVH/Canada so we pay for Windows Server and all other MS products a monthly rent, not sure if that entitles us for any support?

any hint on how to get support would be appreciated.

thanks
Paolo
Yurong Dai-MSFT 2,846 Reputation points Microsoft External Staff

2022-10-17T08:56:02.477+00:00

Hi @Paolo Aimetti ,
When you set the IIS applicationpool Maximum Worker Process to 1 on this server, do you still have the same error?
Paolo Aimetti 1 Reputation point

2022-10-23T15:08:08.65+00:00

I have waited a couple of days before following your suggestion; during this time the error has been showing only 3/4 times every 24h; on Friday 21st at 5am I changed the Maximum Workers Processes from 2 to 1; nothing changed, the error has been showing at the same pace until yesterday around 5pm when a LARGE number of errors have been logged until this morning; all these errors are related the use of the system module that sends email through SMTP ( CODSYS ) by a scheduled job that runs every few minutes to send messages stored in a queue; this morning I've just looked at logs and tested the same email sending function which now works fine again, I didn't change any setting, didn't restart IIS or the server but no more error since 9am/last 2h.

I'm quite sure there is nothing wrong in our program as 1) the code sending emails has been working fine for long time and it works fine between these error "storms" with no change in program or settings 2) we have the same exact program running on other 3 servers for few years we have and never seen this type of errors ( external object ).

I would really like to post the crash dump to MS and have their word but Im not sure how to get support for a windows server product that is rented from a hosting company..

my only other option is to move all systems from to a server that does not show the problem and reinstall windows from scratch.

I will wait to see if you have anything to suggest
thanks again
Paolo

Your answer

Paolo Aimetti 1 Reputation point

2022-10-13T15:50:51.873+00:00

I forgot to say the problem is seen only on the server where the IIS application pool has been set Maximum Worker Process = 2, for all the other servers running the same app and not having this problem the Maximum Worker Process was left at 1.
Yurong Dai-MSFT 2,846 Reputation points Microsoft External Staff

2022-10-14T09:10:45.033+00:00

Hi @Paolo Aimetti ,
The problem is that w3wp.exe randomly fails on module ntdll.dll, and even if you are familiar with IIS, if you don't know how to analyze crash dumps, you may not be able to dig deep. I suggest you open a case via: https://support.microsoft.com, involve the Microsoft support team, and provide the IIS crash dump you captured for analysis.
Paolo Aimetti 1 Reputation point

2022-10-14T10:46:57.883+00:00

Thanks for the suggestion, I would love to have help from the support but apparently they do not serve our country ( Barbados ); I went through the steps to post a support requests several times and it all ends saying:

The current region or country does not have support plans available for purchase.

Our server is hosted by OVH/Canada so we pay for Windows Server and all other MS products a monthly rent, not sure if that entitles us for any support?

any hint on how to get support would be appreciated.

thanks
Paolo
Yurong Dai-MSFT 2,846 Reputation points Microsoft External Staff

2022-10-17T08:56:02.477+00:00

Hi @Paolo Aimetti ,
When you set the IIS applicationpool Maximum Worker Process to 1 on this server, do you still have the same error?
Paolo Aimetti 1 Reputation point

2022-10-23T15:08:08.65+00:00

I have waited a couple of days before following your suggestion; during this time the error has been showing only 3/4 times every 24h; on Friday 21st at 5am I changed the Maximum Workers Processes from 2 to 1; nothing changed, the error has been showing at the same pace until yesterday around 5pm when a LARGE number of errors have been logged until this morning; all these errors are related the use of the system module that sends email through SMTP ( CODSYS ) by a scheduled job that runs every few minutes to send messages stored in a queue; this morning I've just looked at logs and tested the same email sending function which now works fine again, I didn't change any setting, didn't restart IIS or the server but no more error since 9am/last 2h.

I'm quite sure there is nothing wrong in our program as 1) the code sending emails has been working fine for long time and it works fine between these error "storms" with no change in program or settings 2) we have the same exact program running on other 3 servers for few years we have and never seen this type of errors ( external object ).

I would really like to post the crash dump to MS and have their word but Im not sure how to get support for a windows server product that is rented from a hosting company..

my only other option is to move all systems from to a server that does not show the problem and reinstall windows from scratch.

I will wait to see if you have anything to suggest
thanks again
Paolo

Share via

Windows Server 2019 Std - w3wp.exe randomnly faulting on module ntdll.dll

Your answer