Udostępnij za pośrednictwem

DW20.exe was stopping us from taking the Crash Dumps in w3wp.exe! How to disable it?

  • Artykuł

While I was working on this issue today, I was thinking of this old adage... "When the going gets tough, the tough get going!".

It looked pretty simple initially, and the issue was that the IIS worker process, W3WP.exe was crashing when the users tried browsing specific pages. I have seen a lot of crash issues so far, and we know that the Post-Production debugging can be quite tricky at times.

Basically, the w3wp.exe was always doing the same stuff before it crashed. I was happy since we had a pattern to this crash and the solution wasn't very far away since we were able to reproduce the error on demand. The w3wp.exe was showing High CPU for about a min, and then just crashed. Immediately it flashed that is it a StackOverFlow? The high CPU issue could be because of quite a few reasons, and one of them could be loops that never end. But normally they just make the CPU usage high and stay there. They don't crash the process. Although, StackOverFlow can!

We had a theory, and we needed to prove/disprove it. So, we decided to take a crash dump using Debug Diagnostic Tool. Normally, it is pretty easy, you set up a crash rule and once the crash happens, the tool generates a dump itself. Here is where the problem kicked in... Crash Rule was setup and w3wp.exe was crashing, but dumps were not generated. We checked the Event Logs and found that it was indeed a crash and an event log entry like the following was being logged each time the process crashed.

Event Type: Error
Event Source: .NET Runtime 2.0 Error Reporting
Event Category: None
Event ID: 1000 -> Signifies Crash!
Date: 25/01/2007
Time: 17:48:53
User: N/A
Computer: SomeBox
Description:
Faulting application w3wp.exe, version 6.0.3790.1830, stamp 42435be1, faulting module kernel32.dll, version 5.2.3790.2756, stamp 44c60f39, debug? 0, fault address 0x00015e02.

Looking into the Task Manager we found an interesting stuff. Whenever there was a Crash we could see the process called DW20.exe kick in and it would spike the CPU, and then it would die. We wanted to get this out of the picture but boy oh boy... I will remember this day :o) And hence the song which I was referring to! I felt as if DW stands for Doctor Watson and I started changing the stuff which were of no importance. Silly me!

In fact, this guy DW20.exe is called Windows Error Reporting tool and was trying to do something when the error was happening on the server. We tried hard to remove and thought of renaming it, but somehow I don't seem like workarounds much. So the search continued and I landed up on a KB https://support.microsoft.com/kb/841477. We tried creating all the registry entries but nothing changed. Now what?

KBs after KB but unfortunately, I couldn't get the answer I was looking for. We tried atleast 6 different things and nothing worked. I don't want to bore you by telling you what didn't work, so let me take you to the solution now!

1. Go to Control Panel.
2. Click System.
3. Go to the Advanced tab.
4. Click Error Reporting.

 
5. Click the "Disable Error Reporting" radio box

Once we were done with that, DW20.exe stopped kicking in and we were able to collect the Crash Dumps. And after that, it was pretty easy. We checked the dumps and found that the issue is happening because of a Stack Overflow as we guessed!! Wow :o) Another issue resolved!!

Honestly, after fixing it, I felt as if I was a tough guy and persisted with this issue. But I also know that if I was aware of this button, I would have fixed it much earlier. Sometimes, small things like this, cause big problems and today I realize it once again... that no matter how much you learn, you just can't get enough.

Hope this helps!

Cheers,
Rahul

Share this post : email it! | bookmark it! | digg it! | reddit! | kick it! | live it!

Comments

  • Anonymous
    March 29, 2007
    You've been kicked (a good thing) - Trackback from DotNetKicks.com

  • Anonymous
    April 02, 2007
    Thanks for this article... In my WCF services when exceptions are thrown the app pool the services are running in shuts down and it kicks off 2-5 of these dreaded DW20.exe's, all of which spike the CPU and use up 100-200 megs of ram each... Especially when running in a Virtual PC this is a big ouch!! Hoping that disabling it will do the trick for me...

  • Anonymous
    April 02, 2007
    Sure Justin! Just wanted to let you know that if you still see crashes you may like to debug it using Debug Diagnostics as per http://blogs.msdn.com/rahulso/archive/2006/03/02/what-is-a-crash-technically-in-asp-net-and-what-to-do-if-it-happens.aspx! -Rahul

  • Anonymous
    June 12, 2007
    Hi I have gone through some of your blogs. And this one in particular interests me because we are facing this weird problem that I am unable to understand. We have a ASP .NET 2.0 web application, using ASP .NET Ajax Extensions, installed on Windows Server 2003 + IIS 6.0. As soon as I load the Login page of this application (just visit the page URL, do not actually log into the application), w3wp.exe shoots up to 100% of CPU usage. I am not able to figure out why? All that is happening are the dlls getting loaded. Most of the posts related to that say that this will happen because of some infinite loop. But I don't think there is any infinit loop anywhere in our application's DLL. Have you seen such a situation? Can you provide some helpful links? Anything on this front will be great! Thanks in advance, Arati

  • Anonymous
    June 12, 2007
    The comment has been removed

  • Anonymous
    June 22, 2007
    Hi Rahul Thanks for a prompt reply. I used IIS State (from IIS 6.0 Resource Toolkit) and from the IIS dump saw that one particular thread in our application was taking up a lot of time. After cleaning up that class, things seem to work fine now. Thanks for the help, Arati

  • Anonymous
    June 23, 2007
    No problem Arati and thanks for the update :-)It is great to know that everything is working fine now. Enjoy! Rahul

  • Anonymous
    July 12, 2007
    Hi Rahul, This blog sheds light on the application crash problem we are having. Our environment: ASP.NET 1.1, IIS 6.0, Windows Server 2003. We ran IIS Diagnostics tool and tried to analyze the reports. I'm posting the highlights of the report

  1. In w3wp__PID__2308__Date__07_11_2007__Time_03_03_51PM__317__First chance exception 0XE0434F4D.dmp the assembly instruction at kernel32!RaiseException+53 in C:WINDOWSsystem32kernel32.dll from Microsoft Corporation has caused an unknown exception (0xe0434f4d) on thread 15 2.MSHTML!PLAINRELEASE+8BIn w3wp__PID__2308__Date__07_11_2007__Time_03_14_08PM__47__Second_Chance_Exception_C0000005.dmp the assembly instruction at mshtml!PlainRelease+8b in C:WINDOWSsystem32mshtml.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to read from memory location 0x11ac0624 on thread 52 Any information to help resolve this issue is greatly appreciated.

  • Anonymous
    July 12, 2007
    Hello eGrantsguy, Looking at this, I was quite surprised to see MSHTML being there in your w3wp.exe. Are you automating IE objects??

  • Anonymous
    July 13, 2007
    Hi Rahul, We are not directly automating IE objects. We use ABCPdf.NET to dynamically generate PDFs from URLs. Don't know if it is automating. Here is IIS dump which points to ABCPdf.NET Thread 52 - System ID 5668 Entry point   ABCpdfCE6!NTransform_Skew+c7ba0 Create time   7/11/2007 3:14:01 PM Time spent in user mode   0 Days 0:0:3.156 Time spent in kernel mode   0 Days 0:0:0.156 Function     Arg 1     Arg 2     Arg 3   Source mshtml!PlainRelease+8b     11ac0620     00000000     11feff80     ABCpdfCE6!NTransform_Skew+cc165     00000000     00000000     00000000     MSHTML!PLAINRELEASE+8BIn w3wp__PID__2308__Date__07_11_2007__Time_03_14_08PM__47__Second_Chance_Exception_C0000005.dmp the assembly instruction at mshtml!PlainRelease+8b in C:WINDOWSsystem32mshtml.dll from Microsoft Corporation has caused an access violation exception (0xC0000005) when trying to read from memory location 0x11ac0624 on thread 52 Module Information Image Name: C:WINDOWSsystem32mshtml.dll   Symbol Type:  PDB Base address: 0x7d0e0000   Time Stamp:  Fri May 06 21:19:07 2005   Checksum: 0x00304d9c   Comments:   COM DLL: True   Company Name:  Microsoft Corporation ISAPIExtension: False   File Description:  Microsoft (R) HTML Viewer ISAPIFilter: False   File Version:  6.00.3790.2440 (srv03_sp1_gdr.050506-1520) Managed DLL: False   Internal Name:  MSHTML VB DLL: False   Legal Copyright:  © Microsoft Corporation. All rights reserved. Loaded Image Name:  mshtml.dll   Legal Trademarks:   Mapped Image Name:     Original filename:  MSHTML.DLL Module name:  mshtml   Private Build:   Single Threaded:  False   Product Name:  Microsoft® Windows® Operating System Module Size:  2.98 MBytes   Product Version:  6.00.3790.2440 Symbol File Name:  c:symcachemshtml.pdb3FCBFD7777A3457B8AB2DFE3AE6F50212mshtml.pdb   Special Build:  &

  • Anonymous
    July 13, 2007
    It seems like something caused by ABCpdfCE6 which in turn is trying to do something with mshtml.dll. Since it is something non-microsoft related (http://support.microsoft.com/dllhelp/?dlltype=file&l=55&alpha=ABCpdfCE6.dll&S=1), I can only suggest to get the latest version of the ABCpdfCE6.dll and check out if the issue gets corrected. Thanks, Rahul

  • Anonymous
    April 21, 2008
    Thank you for posting this article. We were having this issue on our Symantec Enterprise Vault - File System Archiving server and this stopped the dw20.exe from occuring after we rebooted.

  • Anonymous
    April 21, 2008
    I am glad to know Brian!

  • Anonymous
    August 20, 2008
    Well... this seems to be a good answer to my DW20 hanging problems. Unfortunately, it doesn't work for me. "my" DW20 process is fired by a devenv.com that I run to automatically build some of my projects. Up until just a few hours ago, everything was just dandy. (and it's been up and running for almost one year). Now, the DW20 process shows up on the same build over and over again. I really don't know what else I can do to make it dissapear. Any suggestions?

  • Anonymous
    August 20, 2008
    Well... this seems to be a good answer to my DW20 hanging problems. Unfortunately, it doesn't work for me. "my" DW20 process is fired by a devenv.com that I run to automatically build some of my projects. Up until just a few hours ago, everything was just dandy. (and it's been up and running for almost one year). Now, the DW20 process shows up on the same build over and over again. I really don't know what else I can do to make it dissapear. Any suggestions?

  • Anonymous
    November 10, 2008
    The comment has been removed

  • Anonymous
    December 15, 2008
    Hello Baciu & Steven, Sorry for the late response. Did you try renaming... C:Program FilesCommon FilesMicrosoft SharedDWDW20.exe I am not recommending this for ever. I just wanted to see if renaming this key stops the spawning of DW20.exe. Rahul

  • Anonymous
    December 15, 2008
    in fact... searching your machine for DW20.exe would be a better idea. Do NOT delete this file. For the time being, please try renaming and see if it helps. Even if it doesn't help, the problem would come on surface (maybe some kind of crash or something unexpected that is kicking this guy in). Renaming DW20.exe should get us a bit closer to the real bad guy. Thanks, Rahul

  • Anonymous
    January 23, 2009
    The comment has been removed

  • Anonymous
    February 16, 2009
    renaming DW20.exe worked for me (when all other attempts failed)

  • Anonymous
    February 24, 2009
    The comment has been removed

  • Anonymous
    February 24, 2009
    Hello Steve, I was thinking why not just rename DW20.exe?

  • Anonymous
    May 19, 2009
    Nachdem es mir nun schon zum wiederholten Male passiert ist denke ich, man könnte mal eine kurze Blog

  • Anonymous
    May 21, 2009
    Thanks, that was great.  I knew from past experience that Dr. Watson was a useless piece of software, and have had so many problems with it killing my computer.  Previously my only option was to remove that executable so that it wouldn't run.  Now I have a more permanent solution.

  • Anonymous
    May 27, 2009
    Thanks so much!  I didn't know about this screen.  I used regmon to determine the registry keys set if you disable error reporting and uncheck "but notify me" They are: HKLMSoftwareMicrosoftPCHealthErrorReportingAllOrNone = 1 HKLMSoftwareMicrosoftPCHealthErrorReportingShowUI = 0 HKLMSoftwareMicrosoftPCHealthErrorReportingDoReport = 0 HKLMSoftwareMicrosoftPCHealthErrorReportingIncludeKernelFaults = 1

  • Anonymous
    June 25, 2009
    The comment has been removed

  • Anonymous
    July 07, 2009
    The comment has been removed

  • Anonymous
    July 19, 2009
    The comment has been removed

  • Anonymous
    January 27, 2010
    Rahul, Thanks for writing this blog post. We're currently dealing with very similar issue. Our application works perfectly on a lot of systems, but one of customer systems has the same issue - the "The faulting application - w3wp.exe... faulting module kernel32.dll..." You wrote in the end of the article that when you narrowed down the issue it was Stack Overflow. Would you please comment if the Stack Overflow was in managed or unmanaged code and, if you know, what was the reason for working process to crash?

  • Anonymous
    January 27, 2010
    Hi Denis, I don't remember whether it was managed or unmanaged, but it shouldn't really matter. Once you get rid of this process, you should configure crash dump and analyze the dump to get the root cause.