If there's a crash, Windows will log the reason for the crash in the system event log.
Consult the troubleshooting page in the IIRF documentation for how to diagnose and correct these crashes.
One note: It is possible to crash IIS with a bad set of IIRF rules. Imagine the case where you have a RewriteRule that rewrites requests from /foo to /bar, and a RedirectRule that redirects from /bar to /foo. This is obviously an infinite logical
loop. IIRF will not detect this loop in your rewrite logic, and will not protect you from introducing such loops. Obviously much more complicated loops are possible - involving multiple rewrites, multiple redirects, and so on. If the loop
involves only Rewrites, then IIRF will detect and halt the loop at runtime; you can modify this behavior with the IterationLimit directive. But if any URL processing involves a Redirect, that implies a new URL request and IIRF cannot keep track of loops across
multiple requests. (This is described in the documentation).
If this is what is causing the problem, the symptom you will see here is IIS (w3wp.exe) consumes 100% of the CPU, and gets shutdown by the IIS subsystem, which has CPU usage thresholds configured for it. After the shutdown, further URL requests will
get 503 errors ("Server unavailable"), because w3wp.exe has been shut down.
To diagnose this, you can either closely examine the IIRF ini file for such loops, or you can view the IIRF log file and check for loops in processing. It is sometimes not obvious. It may help to simplify your IIRF ruleset when having such problems.
Add rules only when you are satisfied that the existing rules work reliably. If you add a rule and subsequently get a crash, then the last rule you added is likely the source of a loop or problem. Look closely at the logfile to figure out where
the loop occurs.
The fix for this is to revise your rule set to eliminate the loop.
Another issue that can occur is a logical or infinite loop within the regular expression itself. If you're not doing fancy back-references and counting, then this is likely not occurring, but it is possible. the fix for this is to simplify your regular
I will open a workitem to add some documentation on these problems and diagnosis to the IIRF doc set. I already mention some of this but I think the material could be expanded.