RE: Event id 7031 on Win2k SP3
From: Farida Bharmal (farida@online.microsoft.com)
Date: 08/18/02
- Next message: Farida Bharmal: "RE: IIS site certificate"
- Previous message: Don Thimsen: "Event id 7031 on Win2k SP3"
- In reply to: Don Thimsen: "Event id 7031 on Win2k SP3"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: farida@online.microsoft.com (Farida Bharmal) Date: Sun, 18 Aug 2002 14:55:39 GMT
If IIS is shuting down unexpectedly, it means that there is access violation (AV) (Dr. Watson) occuring. This may be due to the following
reasons:
1. application that is running on IIS is causing AV. (Most likely cause)
2. Some virus is causing the server to restart (this may not be true in your case)
3. Some 3rd party products on the server is causing it to shutdown.
Check for Dr. Watson logs and Dr. Watson memory dumps. They are by default located in C:\Documents and Settings\All Users
\Documents\DrWatson. (Dr. Watson logs and user.dmp files)
You can use a tool called adplus to debug what in your application is causing the AV. This can be downloaded from
www.microsoft.com/ddk/debugging.
The following article describes how to troubleshoot Crashes:
Q286350 HOWTO: Use Autodump+ to Troubleshoot "Hangs" and "Crashes"
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q286350
However, reading the dumps requires some training and if one is not familiar with it, I would suggest that they open a case with Microsoft
Support. Some engineer will work on the issue until it is resolved.
Thank You
Farida Bharmal
Newsgroup IIS Support
This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use. © 2001 Microsoft Corporation. All rights reserved.
Please do not send email directly to this alias. This is our online account name for newsgroup participation only.
--------------------
| From: "Don Thimsen" <don@DTSsoftware.com>
| Subject: Event id 7031 on Win2k SP3
| Date: Sun, 18 Aug 2002 09:23:53 -0400
| Lines: 45
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2600.0000
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
| Message-ID: <Oxx$SprRCHA.4048@tkmsftngp08>
| Newsgroups: microsoft.public.inetserver.iis.security
| NNTP-Posting-Host: 24.162.226.9
| Path: cpmsftngxa08!cpmsftngxa07!tkmsftngp01!tkmsftngp08
| Xref: cpmsftngxa08 microsoft.public.inetserver.iis.security:9511
| X-Tomcat-NG: microsoft.public.inetserver.iis.security
|
| I recently checked our event logs and found occasion
| groups of 7031 errors (happens about twice a day):
|
|
|
| The IIS Admin Service service terminated unexpectedly. It has done this 2
| time(s).
| The following corrective action will be taken in 1 milliseconds: Run the
| configured
| recovery program.
|
| The FTP Publishing Service service terminated unexpectedly. It has done this
| 2 time(s).
| The following corrective action will be taken in 0 milliseconds: No action
|
| The Network News Transport Protocol (NNTP) service terminated unexpectedly.
| It has done this 2 time(s). The following corrective action will be taken in
| 0 milliseconds:
| No action.
|
| The World Wide Web Publishing Service service terminated unexpectedly. It
| has done
| this 2 time(s). The following corrective action will be taken in 0
| milliseconds: No action.
|
|
|
|
| My first concern was the code red or nimda virus, but I don't see any
| evidence of
| either. IIS logs just show a restart occurring. I don't see any buffer
| overrun
| attacks at the time of the 7031 events. The system seems to recover and run
| normally...
|
| The Win2k server is current at SP3 and all critical update patches.
| I've been on vacation for the past month. Is there anything new I
| should know about???
|
| TIA,
| Don
|
|
|
|
|
Thank You
Farida Bharmal
DSM IIS Support
This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use. © 2001 Microsoft Corporation. All rights reserved.
Please do not send email directly to this alias. This is our online account name for newsgroup participation only.
- Next message: Farida Bharmal: "RE: IIS site certificate"
- Previous message: Don Thimsen: "Event id 7031 on Win2k SP3"
- In reply to: Don Thimsen: "Event id 7031 on Win2k SP3"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
