Frequent IIRF and w3wp crashes

Topics: User Forum
Feb 14, 2012 at 6:39 PM

I'm brand new to iirf, and today unleashed it on a website that takes a lot of traffic. About every 15-20 minutes, the app will crash bringing the website down. I worked around it by allowing more than one worker process on the site application pool. That helped keep the site up, but the event log is still racking up the errors.

IIS6/Win2003 Server 32 bit

I don't know what info to post - because of traffic, the iirf logs are enormous. If anyone can help me, let me know what info I need to post and I'll do it.


Here's a shot of the Exception event in the IIRF logfile, with logging level set to 1

Tue Feb 14 12:57:42 -  6796 - EXCEPTION
Tue Feb 14 12:57:42 -  6796 - SymInit: Symbol-SearchPath: 'C:\Program Files\Ionic Shade\IIRF 2.1\;.;c:\windows\system32\inetsrv;c:\windows\system32\inetsrv;C:\WINDOWS;C:\WINDOWS\system32;SRV*C:\websymbols*;', symOptions: 530, UserName: 'NETWORK SERVICE'
Tue Feb 14 12:57:42 -  6796 - OS-Version: 5.2.3790 (Service Pack 2) 0x112-0x3
Tue Feb 14 12:57:42 -  6796 - Stack trace:
7C8415F7 module(ntdll): (filename not available): RtlSecondsSince1970ToTime
1001A773 module(IIRF): (filename not available): Iirf_EvaluateRules
1000B17A module(IIRF): (filename not available): TerminateFilter
1000CC8A module(IIRF): (filename not available): Iirf_EvaluateRules
1000A746 module(IIRF): (filename not available): Iirf_GetVersion
1000AF84 module(IIRF): (filename not available): HttpFilterProc
5A3988A4 module(w3core): (filename not available): (function-name not available)
5A3C14A6 module(w3core): (filename not available): UlW3Start
5A3A4DBE module(w3core): (filename not available): W3_FILE_INFO_CACHE::GetFileInfo
5A3A14F1 module(w3core): (filename not available): W3_FILE_INFO_CACHE::GetFileInfo
5A392274 module(w3core): (filename not available): (function-name not available)
5A3965FA module(w3core): (filename not available): (function-name not available)
5A3616CF module(w3dt): (filename not available): UlAtqAllocateMemory
5A3616FA module(w3dt): (filename not available): UlAtqAllocateMemory
5A3024CE module(W3TP): (filename not available): THREAD_POOL::PostCompletion
5A3026AC module(W3TP): (filename not available): THREAD_POOL::~THREAD_POOL
5A301DA9 module(W3TP): (filename not available): (function-name not available)
77E6482F module(kernel32): (filename not available): GetModuleHandleA
77E6482F module(kernel32): (filename not available): GetModuleHandleA

Feb 15, 2012 at 6:41 PM
Edited Feb 15, 2012 at 6:42 PM

Okay, as near as I can tell, it's a massive memory leak.

If I aim a load test app at it, I can get w3wp.exe up to about 300 MB of RAM in under 10 minutes, then the app pool dies/resets.

Since the pages I'm testing in are in the bypass (don't rewrite) part of the ini, there's no rewriting happening - "DoRewrites: No Rewrite" is 99% of the log.

If I remove the IIRF DLL from the ISAPI filter on IIS, the w3wp.exe stays under 25 MB under the exact same load.

Has anyone else run into this? The ini loads with no warnings/errors, so I think I got it right. Maybe the rewriter simply can't handle a heavy load of traffic?

Mar 13, 2012 at 1:13 AM

Hmm - it's possible that it's leaking but

  • I found workitem 32399, which is a memory corruption problem related to /iirfstatus requests.  This problem does lead to crashes of w3wp.exe.  This won't ever happen in the course of serving normal requests, but if you have any requests for /iirfstatus, you could trigger the problem.  I have a code fix for this, but I've not yet released a binary.
  • If your IIRF logs are enormous, consider turning down or Off IIRF logging.  In fact this is the recommended practice - you should use IIRF logging for diagnostics, not for normal processing.




Apr 4, 2012 at 11:05 PM

I'm experiencing a similar issue.  I'm running IIS7, on windows 7, with the x86 version of Ionics.  The associated app pool has 32-bit applications enabled.