Rahul Soni's blog

Never assume the obvious is true!

DW20.exe was stopping us from taking the Crash Dumps in w3wp.exe! How to disable it?

DW20.exe was stopping us from taking the Crash Dumps in w3wp.exe! How to disable it?

  • Comments 30

While I was working on this issue today, I was thinking of this old adage... "When the going gets tough, the tough get going!".

It looked pretty simple initially, and the issue was that the IIS worker process, W3WP.exe was crashing when the users tried browsing specific pages. I have seen a lot of crash issues so far, and we know that the Post-Production debugging can be quite tricky at times.

Basically, the w3wp.exe was always doing the same stuff before it crashed. I was happy since we had a pattern to this crash and the solution wasn't very far away since we were able to reproduce the error on demand. The w3wp.exe was showing High CPU for about a min, and then just crashed. Immediately it flashed that is it a StackOverFlow? The high CPU issue could be because of quite a few reasons, and one of them could be loops that never end. But normally they just make the CPU usage high and stay there. They don't crash the process. Although, StackOverFlow can!

We had a theory, and we needed to prove/disprove it. So, we decided to take a crash dump using Debug Diagnostic Tool. Normally, it is pretty easy, you set up a crash rule and once the crash happens, the tool generates a dump itself. Here is where the problem kicked in... Crash Rule was setup and w3wp.exe was crashing, but dumps were not generated. We checked the Event Logs and found that it was indeed a crash and an event log entry like the following was being logged each time the process crashed.

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 1000    -> Signifies Crash!
Date: 25/01/2007
Time: 17:48:53
User: N/A
Computer: SomeBox
Description:
Faulting application w3wp.exe, version 6.0.3790.1830, stamp 42435be1, faulting module kernel32.dll, version 5.2.3790.2756, stamp 44c60f39, debug? 0, fault address 0x00015e02.

Looking into the Task Manager we found an interesting stuff. Whenever there was a Crash we could see the process called DW20.exe kick in and it would spike the CPU, and then it would die. We wanted to get this out of the picture but boy oh boy... I will remember this day :o) And hence the song which I was referring to! I felt as if DW stands for Doctor Watson and I started changing the stuff which were of no importance. Silly me!

In fact, this guy DW20.exe is called Windows Error Reporting tool and was trying to do something when the error was happening on the server. We tried hard to remove and thought of renaming it, but somehow I don't seem like workarounds much. So the search continued and I landed up on a KB http://support.microsoft.com/kb/841477. We tried creating all the registry entries but nothing changed. Now what?

KBs after KB but unfortunately, I couldn't get the answer I was looking for. We tried atleast 6 different things and nothing worked. I don't want to bore you by telling you what didn't work, so let me take you to the solution now!

1. Go to Control Panel.
2. Click System.
3. Go to the Advanced tab.
4. Click Error Reporting.

 
5. Click the "Disable Error Reporting" radio box

Once we were done with that, DW20.exe stopped kicking in and we were able to collect the Crash Dumps. And after that, it was pretty easy. We checked the dumps and found that the issue is happening because of a Stack Overflow as we guessed!! Wow :o) Another issue resolved!!

Honestly, after fixing it, I felt as if I was a tough guy and persisted with this issue. But I also know that if I was aware of this button, I would have fixed it much earlier. Sometimes, small things like this, cause big problems and today I realize it once again... that no matter how much you learn, you just can't get enough.

Hope this helps!

Cheers,
Rahul

Share this post : email it! | bookmark it! | digg it! | reddit! | kick it! | live it!
  • You've been kicked (a good thing) - Trackback from DotNetKicks.com

  • Thanks for this article... In my WCF services when exceptions are thrown the app pool the services are running in shuts down and it kicks off 2-5 of these dreaded DW20.exe's, all of which spike the CPU and use up 100-200 megs of ram each...

    Especially when running in a Virtual PC this is a big ouch!! Hoping that disabling it will do the trick for me...

  • Sure Justin!

    Just wanted to let you know that if you still see crashes you may like to debug it using Debug Diagnostics as per http://blogs.msdn.com/rahulso/archive/2006/03/02/what-is-a-crash-technically-in-asp-net-and-what-to-do-if-it-happens.aspx!

    -Rahul

  • Hi

    I have gone through some of your blogs. And this one in particular interests me because we are facing this weird problem that I am unable to understand.

    We have a ASP .NET 2.0 web application, using ASP .NET Ajax Extensions, installed on Windows Server 2003 + IIS 6.0. As soon as I load the Login page of this application (just visit the page URL, do not actually log into the application), w3wp.exe shoots up to 100% of CPU usage. I am not able to figure out why? All that is happening are the dlls getting loaded.

    Most of the posts related to that say that this will happen because of some infinite loop. But I don't think there is any infinit loop anywhere in our application's DLL.

    Have you seen such a situation? Can you provide some helpful links? Anything on this front will be great!

    Thanks in advance,

    Arati

  • Hi Arati,

    High CPU can be caused due to quite a lot of reasons, and infinite loops are just one of them.

    The best way to go about is to take a few hang dumps when the CPU is at 100% and analyze the dumps to see where the problem resides.

    I would suggest to open a new MS ticket to get the issue resolved, since the analysis will require you to capture those dumps and send it over to us for analysis. You can use Debug Diagnostics Tool as well and try to solve it yourself.

    Debug Diagnostics - http://www.microsoft.com/downloads/details.aspx?familyid=9BFA49BC-376B-4A54-95AA-73C9156706E7&displaylang=en

    MS Support Incident -

    http://support.microsoft.com/default.aspx?scid=fh;EN-US;offerprophone&sd=msdn#faq607

    Hope that helps.

    Rahul

  • Hi Rahul

    Thanks for a prompt reply. I used IIS State (from IIS 6.0 Resource Toolkit) and from the IIS dump saw that one particular thread in our application was taking up a lot of time. After cleaning up that class, things seem to work fine now.

    Thanks for the help,

    Arati

  • No problem Arati and thanks for the update :-)It is great to know that everything is working fine now.

    Enjoy!

    Rahul

  • Hi Rahul,

    This blog sheds light on the application crash problem we are having. Our environment: ASP.NET 1.1, IIS 6.0, Windows Server 2003. We ran IIS Diagnostics tool and tried to analyze the reports. I'm posting the highlights of the report

    1. In w3wp__PID__2308__Date__07_11_2007__Time_03_03_51PM__317__First chance exception 0XE0434F4D.dmp the assembly instruction at kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0xe0434f4d) on thread 15

    2.MSHTML!PLAINRELEASE+8BIn w3wp__PID__2308__Date__07_11_2007__Time_03_14_08PM__47__Second_Chance_Exception_C0000005.dmp the assembly instruction at mshtml!PlainRelease+8b in C:\WINDOWS\system32\mshtml.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to read from memory location 0x11ac0624 on thread 52

    Any information to help resolve this issue is greatly appreciated.

  • Hello eGrantsguy,

    Looking at this, I was quite surprised to see MSHTML being there in your w3wp.exe. Are you automating IE objects??

  • Hi Rahul,

    We are not directly automating IE objects. We use ABCPdf.NET to dynamically generate PDFs from URLs. Don't know if it is automating.

    Here is IIS dump which points to ABCPdf.NET

    Thread 52 - System ID 5668

    Entry point   ABCpdfCE6!NTransform_Skew+c7ba0

    Create time   7/11/2007 3:14:01 PM

    Time spent in user mode   0 Days 0:0:3.156

    Time spent in kernel mode   0 Days 0:0:0.156

    Function     Arg 1     Arg 2     Arg 3   Source

    mshtml!PlainRelease+8b     11ac0620     00000000     11feff80    

    ABCpdfCE6!NTransform_Skew+cc165     00000000     00000000     00000000    

    MSHTML!PLAINRELEASE+8BIn w3wp__PID__2308__Date__07_11_2007__Time_03_14_08PM__47__Second_Chance_Exception_C0000005.dmp the assembly instruction at mshtml!PlainRelease+8b in C:\WINDOWS\system32\mshtml.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to read from memory location 0x11ac0624 on thread 52

    Module Information

    Image Name: C:\WINDOWS\system32\mshtml.dll   Symbol Type:  PDB

    Base address: 0x7d0e0000   Time Stamp:  Fri May 06 21:19:07 2005  

    Checksum: 0x00304d9c   Comments:  

    COM DLL: True   Company Name:  Microsoft Corporation

    ISAPIExtension: False   File Description:  Microsoft (R) HTML Viewer

    ISAPIFilter: False   File Version:  6.00.3790.2440 (srv03_sp1_gdr.050506-1520)

    Managed DLL: False   Internal Name:  MSHTML

    VB DLL: False   Legal Copyright:  © Microsoft Corporation. All rights reserved.

    Loaded Image Name:  mshtml.dll   Legal Trademarks:  

    Mapped Image Name:     Original filename:  MSHTML.DLL

    Module name:  mshtml   Private Build:  

    Single Threaded:  False   Product Name:  Microsoft® Windows® Operating System

    Module Size:  2.98 MBytes   Product Version:  6.00.3790.2440

    Symbol File Name:  c:\symcache\mshtml.pdb\3FCBFD7777A3457B8AB2DFE3AE6F50212\mshtml.pdb   Special Build:  &

  • It seems like something caused by ABCpdfCE6 which in turn is trying to do something with mshtml.dll.

    Since it is something non-microsoft related (http://support.microsoft.com/dllhelp/?dlltype=file&l=55&alpha=ABCpdfCE6.dll&S=1), I can only suggest to get the latest version of the ABCpdfCE6.dll and check out if the issue gets corrected.

    Thanks,

    Rahul

  • Thank you for posting this article.

    We were having this issue on our Symantec Enterprise Vault - File System Archiving server and this stopped the dw20.exe from occuring after we rebooted.

  • I am glad to know Brian!

  • Well... this seems to be a good answer to my DW20 hanging problems.

    Unfortunately, it doesn't work for me.

    "my" DW20 process is fired by a devenv.com that I run to automatically build some of my projects. Up until just a few hours ago, everything was just dandy. (and it's been up and running for almost one year).

    Now, the DW20 process shows up on the same build over and over again. I really don't know what else I can do to make it dissapear.

    Any suggestions?

  • Well... this seems to be a good answer to my DW20 hanging problems.

    Unfortunately, it doesn't work for me.

    "my" DW20 process is fired by a devenv.com that I run to automatically build some of my projects. Up until just a few hours ago, everything was just dandy. (and it's been up and running for almost one year).

    Now, the DW20 process shows up on the same build over and over again. I really don't know what else I can do to make it dissapear.

    Any suggestions?

Page 1 of 2 (30 items) 12
Leave a Comment
  • Please add 4 and 8 and type the answer here:
  • Post