Generating IIS hang dumps when a certain event is
triggered in the event viewer
I was working with one of my customer where he had a problem
with his website running on a Windows 2003 Server 64 bit and worker processes
are running in the 64-bit mode. He was getting "A process serving
application pool 'DefaultAppPool' failed to respond to a ping" event in
his event viewer. This is a typical hang scenario where the worker process fails
to respond to the ping from the W3SVC.
You can use the DebugDiag tool to troubleshoot problems like
this and it is well explained in this knowledge base article - http://support.microsoft.com/kb/919792.
And, there is version of DebugDiag tool which is available to take hang dumps of
the all IIS processes. If it was a 32-bit version, I would've advised the
customer to use DebugDiag 1.1 and configure a hang rule for all IIS related
So, here in the 64 bit OS, we are left with only option of
using the ADPlus.vbs which comes with the Debugging Tools for Windows.
For my customer, the problem was really sporadic and one can't
just monitor the server for event to occur and use ADPlus.vbs to generate hang
dump. I was thinking how to help him. There came the savior - EventTriggers.
This nice utility available with Windows 2003 Server allows the user to create a
trigger for a specific event ID which would fire up another script (.bat or .cmd
or anything you would like to execute). Below is the detailed steps to create
I've given the commands written inside the .cmd files here
itself. Feel free to use them if you would like to.
eventtriggers /Create /TR
"AutoGeneratex64_IIS_dumps" /EID 1010 /L SYSTEM /T ERROR /TK
cscript.exe "C:\Program Files\Debugging Tools
for Windows\ADPlus.vbs" -hang -iis -o C:\AutoDumpGeneratex64 -quiet
So, whenever the event ID 1010 occurs (in our case), the
dumpiis.cmd would be called. We can also try to write a .vbs file which might
send an email when an event occurs. You can replace the dumpiis.cmd with your