Hi,
We've recently added our domain enterprise certificate authority to SCOM, and it's come to light there are a significant number of Application Error and Windows Error Reporting events coming from the CA web application pool.
Samples of the two events are below, but I'm out of my depth in trying to understand this, other than the error code makes it look as though there's an access issue (0xc0000005).
Has anyone come across this issue and been able to resolve it?
Cheers,
Lain
Log Name: Application
Source: Windows Error Reporting
Date: 30/04/2011 8:54:44 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: ca.domain.edu.au
Description:
Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0
Problem signature:
P1: w3wp.exe
P2: 7.5.7601.17514
P3: 4ce7afa2
P4: scrdenrl.dll_unloaded
P5: 0.0.0.0
P6: 4a5bc7f2
P7: 000007fefa982594
P8: c0000005
P9: 0000000000000008
P10:
Attached files:
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96BE.tmp.appcompat.txt
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EE.tmp.WERInternalMetadata.xml
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EF.tmp.hdmp
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER975E.tmp.mdmp
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_79ba0d5f6ccd55db47d6647c38815842357f45e_cab_018697a9
Analysis symbol:
Rechecking for solution: 0
Report Id: 6f7098e5-72c4-11e0-b71a-005056820004
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-04-30T00:54:44.000000000Z" />
<EventRecordID>8262</EventRecordID>
<Channel>Application</Channel>
<Computer>ca.domain.edu.au</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>0</Data>
<Data>BEX64</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>w3wp.exe</Data>
<Data>7.5.7601.17514</Data>
<Data>4ce7afa2</Data>
<Data>scrdenrl.dll_unloaded</Data>
<Data>0.0.0.0</Data>
<Data>4a5bc7f2</Data>
<Data>000007fefa982594</Data>
<Data>c0000005</Data>
<Data>0000000000000008</Data>
<Data>
</Data>
<Data>
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96BE.tmp.appcompat.txt
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EE.tmp.WERInternalMetadata.xml
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EF.tmp.hdmp
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER975E.tmp.mdmp</Data>
<Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_79ba0d5f6ccd55db47d6647c38815842357f45e_cab_018697a9</Data>
<Data>
</Data>
<Data>0</Data>
<Data>6f7098e5-72c4-11e0-b71a-005056820004</Data>
<Data>0</Data>
</EventData>
</Event>
Log Name: Application
Source: Application Error
Date: 30/04/2011 8:54:43 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: ca.domain.edu.au
Description:
Faulting application name: w3wp.exe, version: 7.5.7601.17514, time stamp: 0x4ce7afa2
Faulting module name: scrdenrl.dll_unloaded, version: 0.0.0.0, time stamp: 0x4a5bc7f2
Exception code: 0xc0000005
Fault offset: 0x000007fefa982594
Faulting process id: 0xf2c
Faulting application start time: 0x01cc06cfcb05cd54
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: scrdenrl.dll
Report Id: 6f7098e5-72c4-11e0-b71a-005056820004
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-04-30T00:54:43.000000000Z" />
<EventRecordID>8260</EventRecordID>
<Channel>Application</Channel>
<Computer>ca.domain.edu.au</Computer>
<Security />
</System>
<EventData>
<Data>w3wp.exe</Data>
<Data>7.5.7601.17514</Data>
<Data>4ce7afa2</Data>
<Data>scrdenrl.dll_unloaded</Data>
<Data>0.0.0.0</Data>
<Data>4a5bc7f2</Data>
<Data>c0000005</Data>
<Data>000007fefa982594</Data>
<Data>f2c</Data>
<Data>01cc06cfcb05cd54</Data>
<Data>c:\windows\system32\inetsrv\w3wp.exe</Data>
<Data>scrdenrl.dll</Data>
<Data>6f7098e5-72c4-11e0-b71a-005056820004</Data>
</EventData>
</Event>
We've recently added our domain enterprise certificate authority to SCOM, and it's come to light there are a significant number of Application Error and Windows Error Reporting events coming from the CA web application pool.
Samples of the two events are below, but I'm out of my depth in trying to understand this, other than the error code makes it look as though there's an access issue (0xc0000005).
Has anyone come across this issue and been able to resolve it?
Cheers,
Lain
Log Name: Application
Source: Windows Error Reporting
Date: 30/04/2011 8:54:44 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: ca.domain.edu.au
Description:
Fault bucket , type 0
Event Name: BEX64
Response: Not available
Cab Id: 0
Problem signature:
P1: w3wp.exe
P2: 7.5.7601.17514
P3: 4ce7afa2
P4: scrdenrl.dll_unloaded
P5: 0.0.0.0
P6: 4a5bc7f2
P7: 000007fefa982594
P8: c0000005
P9: 0000000000000008
P10:
Attached files:
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96BE.tmp.appcompat.txt
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EE.tmp.WERInternalMetadata.xml
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EF.tmp.hdmp
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER975E.tmp.mdmp
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_79ba0d5f6ccd55db47d6647c38815842357f45e_cab_018697a9
Analysis symbol:
Rechecking for solution: 0
Report Id: 6f7098e5-72c4-11e0-b71a-005056820004
Report Status: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-04-30T00:54:44.000000000Z" />
<EventRecordID>8262</EventRecordID>
<Channel>Application</Channel>
<Computer>ca.domain.edu.au</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>0</Data>
<Data>BEX64</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>w3wp.exe</Data>
<Data>7.5.7601.17514</Data>
<Data>4ce7afa2</Data>
<Data>scrdenrl.dll_unloaded</Data>
<Data>0.0.0.0</Data>
<Data>4a5bc7f2</Data>
<Data>000007fefa982594</Data>
<Data>c0000005</Data>
<Data>0000000000000008</Data>
<Data>
</Data>
<Data>
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96BE.tmp.appcompat.txt
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EE.tmp.WERInternalMetadata.xml
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER96EF.tmp.hdmp
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\WER975E.tmp.mdmp</Data>
<Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3wp.exe_79ba0d5f6ccd55db47d6647c38815842357f45e_cab_018697a9</Data>
<Data>
</Data>
<Data>0</Data>
<Data>6f7098e5-72c4-11e0-b71a-005056820004</Data>
<Data>0</Data>
</EventData>
</Event>
Log Name: Application
Source: Application Error
Date: 30/04/2011 8:54:43 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: ca.domain.edu.au
Description:
Faulting application name: w3wp.exe, version: 7.5.7601.17514, time stamp: 0x4ce7afa2
Faulting module name: scrdenrl.dll_unloaded, version: 0.0.0.0, time stamp: 0x4a5bc7f2
Exception code: 0xc0000005
Fault offset: 0x000007fefa982594
Faulting process id: 0xf2c
Faulting application start time: 0x01cc06cfcb05cd54
Faulting application path: c:\windows\system32\inetsrv\w3wp.exe
Faulting module path: scrdenrl.dll
Report Id: 6f7098e5-72c4-11e0-b71a-005056820004
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2011-04-30T00:54:43.000000000Z" />
<EventRecordID>8260</EventRecordID>
<Channel>Application</Channel>
<Computer>ca.domain.edu.au</Computer>
<Security />
</System>
<EventData>
<Data>w3wp.exe</Data>
<Data>7.5.7601.17514</Data>
<Data>4ce7afa2</Data>
<Data>scrdenrl.dll_unloaded</Data>
<Data>0.0.0.0</Data>
<Data>4a5bc7f2</Data>
<Data>c0000005</Data>
<Data>000007fefa982594</Data>
<Data>f2c</Data>
<Data>01cc06cfcb05cd54</Data>
<Data>c:\windows\system32\inetsrv\w3wp.exe</Data>
<Data>scrdenrl.dll</Data>
<Data>6f7098e5-72c4-11e0-b71a-005056820004</Data>
</EventData>
</Event>