我的Windows 2016 上的IIS 10定期出现crash

Question

我的Windows 2016 上的IIS 10定期出现crash

yu feng 0

我的Windows 2016 上的IIS 定期出现crash，然后iisreset 命令也无法重新启动成功

启动过程中iis默认访问页面也无法打开，但是80端口监听任务存在

必须要重启服务器才能恢复IIS的状态

任务事件中存在5009和5011的相关错误。

yu feng 0 信誉分

2026-02-25T01:21:05.99+00:00
<Event xmlns="__http://schemas.microsoft.com/win/2004/08/events/event__">

<System>

<Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />

<EventID Qualifiers="32768">5009</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2026-02-11T22:56:46.0549737Z" />

<EventRecordID>12425990</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>YF-AESReport1</Computer>

<Security />

</System>

<EventData>

<Data Name="AppPoolID">DefaultAppPool</Data>

<Data Name="ProcessID">35752</Data>

<Data Name="ExitCode">c0000354</Data>

</EventData>

</Event>
yu feng 0 信誉分

2026-02-25T01:21:29.4333333+00:00
<Event xmlns="__http://schemas.microsoft.com/win/2004/08/events/event__">

<System>

<Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />

<EventID Qualifiers="32768">5011</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2026-02-11T23:56:49.7401564Z" />

<EventRecordID>12426915</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>YF-AESReport1</Computer>

<Security />

</System>

<EventData>

<Data Name="AppPoolID">DefaultAppPool</Data>

<Data Name="ProcessID">29848</Data>

<Binary>6D000780</Binary>

</EventData>

</Event>

3 个答案

你的答案

yu feng 0 信誉分

2026-02-25T01:21:05.99+00:00

<Event xmlns="__http://schemas.microsoft.com/win/2004/08/events/event__">

<System>

<Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />

<EventID Qualifiers="32768">5009</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2026-02-11T22:56:46.0549737Z" />

<EventRecordID>12425990</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>YF-AESReport1</Computer>

<Security />

</System>

<EventData>

<Data Name="AppPoolID">DefaultAppPool</Data>

<Data Name="ProcessID">35752</Data>

<Data Name="ExitCode">c0000354</Data>

</EventData>

</Event>
yu feng 0 信誉分

2026-02-25T01:21:29.4333333+00:00

<Event xmlns="__http://schemas.microsoft.com/win/2004/08/events/event__">

<System>

<Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />

<EventID Qualifiers="32768">5011</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2026-02-11T23:56:49.7401564Z" />

<EventRecordID>12426915</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>YF-AESReport1</Computer>

<Security />

</System>

<EventData>

<Data Name="AppPoolID">DefaultAppPool</Data>

<Data Name="ProcessID">29848</Data>

<Binary>6D000780</Binary>

</EventData>

</Event>

Answer 1

yu feng

The exit code c0000354 in your WAS event logs indicates a severe structural violation such as heap corruption or a Control Flow Guard exception.

you must configure LocalDumps via Windows Error Reporting natively in the registry. Navigate to HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps and create a new key named w3wp.exe. Inside this key, create an Expandable String Value named DumpFolder specifying your desired output directory, and a DWORD Value named DumpType set to 2 to force a full dump collection at the exact moment the OS terminates the process. Alternatively, you can run Sysinternals Process Explorer as an administrator during the live hung state. By inspecting the threads of the stuck w3wp.exe process and viewing the kernel stack, you can usually identify the exact .sys driver blocking execution. I highly recommend reviewing any recent updates to third-party security agents or ISAPI filters deployed on your Windows Server 2016 environment, and you can consult Microsoft's official documentation on Windows Error Reporting for further details on native user-mode dump collection.

Hope this answer brought you some useful information.

VP

Answer 2

VPHAN 45,665 独立顾问

又见面了，余峰，

你的问题进展如何？只是跟进一下。

事件ID 5009和5011确认工作进程（w3wp.exe）意外终止或失去与Windows进程激活服务（WAS）的连接。然而，端口80监听器的持久性表明内核模式驱动 http.sys 仍然活跃，而用户模式服务则无响应。为了解决立即的死锁而不重启，你应绕过该标准 iisreset ，尝试通过管理命令提示符直接重启WAS服务 net stop was /y;如果服务卡在“停止”状态，识别 svchost.exe 正在使用的托管PID tasklist /svc /fi "services eq was" ，并用终止。 taskkill /f /pid <PID>对于根因分析，你的描述缺少应用日志中的具体异常代码（事件ID 1000）或导致故障的模块名称。请确认是否有第三方 ISAPI 过滤器或杀毒程序注入 w3wp.exe 进程，使用Microsoft调试诊断工具 2 Update 3 捕获针对特定 IIS 应用池的“崩溃”规则，是隔离故障堆栈追踪的标准程序。

如果问题已经解决，请考虑接受这个答案。如果你还有其他问题，欢迎留言。

副总统

yu feng 0 信誉分

2026-02-25T01:21:45.3866667+00:00
<Event xmlns="__http://schemas.microsoft.com/win/2004/08/events/event__">

<System>

<Provider Name="Microsoft-Windows-WAS" Guid="{524B5D04-133C-4A62-8362-64E8EDB9CE40}" EventSourceName="WAS" />

<EventID Qualifiers="32768">5011</EventID>

<Version>0</Version>

<Level>3</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="2026-02-11T23:56:49.7401564Z" />

<EventRecordID>12426915</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>YF-AESReport1</Computer>

<Security />

</System>

<EventData>

<Data Name="AppPoolID">DefaultAppPool</Data>

<Data Name="ProcessID">29848</Data>

<Binary>6D000780</Binary>

</EventData>

</Event>
yu feng 0 信誉分

2026-02-25T01:23:39.73+00:00

尝试过taskkill 但是该进程无法有效杀死，并且只能重启机器才能解决

Answer 3

你好**，余峰，**

你的描述需要更细致的细节来有效识别根本原因。具体来说，我们需要在事件ID 5009描述中嵌入精确的HRESULT代码（例如0x80070005），以及应用日志是否显示并发事件ID 1000指向故障模块，因为这些错误通常会触发“快速故障保护”功能，自动停止应用池。

期间的卡顿 iisreset 表明WAS服务本身在等待线程发布时处于死锁状态，这通常是由于非Microsoft的监控代理或过滤器驱动挂钩进进程启动所致。与其立即强制终止进程，不如先尝试通过运行 net stop was /y 管理命令提示符来优雅地关闭依赖链来清除卡住状态;如果服务仍处于“停止”状态，请识别托管该 WAS 服务的具体进程 ID tasklist /svc /fi "services eq was" ，并终止该特定 PID，以避免破坏共享通用 svchost 可执行文件的其他系统服务。

你觉得这个答案有用吗？如果你还有更多问题，欢迎留言。祝你有美好的一天！

副总统