Shavlik NetChk Protect Gana el 2009 Windows IT Pro “Editors Best Choice Award”

How to: Resolve error “Faulting application name: w3wp.exe, Faulting module name: ntdll.dll, Unable to create log file”

To save people some time the error “Faulting application name: w3wp.exe” refers to an issue with , while the error “Faulting module name: ntdll.dll” is incredibly generic it could be so many things, so you really need to gather more information to narrow down what the issue could be. But as mentioned, in the error you also get w3wp.exe so you can narrow down this to an IIS error, so if you only have a ntdll.dll error then try to narrow it down further. This particular error is linked to the error of being unable to create a log file for IIS that may manifest among other things with the following error message while opening a page:

Server Error 500 – Internal server error. There is a problem with the resource you are looking for, and it cannot be displayed.

Below is an example of the error log you would find in your Event Log:

Faulting application name: w3wp.exe, version: 7.5.7600.16385, time stamp: 0x4a5bcd2b Faulting module name: ntdll.dll, version: 6.1.7600.16559, time stamp: 0x4ba9b29c Exception code: 0xc0000374 Fault offset: 0x000cdc9b Faulting process id: 0x1808 Faulting application start time: 0x01cb87ac3802f70b Faulting application path: C:WindowsSysWOW64inetsrvw3wp.exe Faulting module path: C:WindowsSysWOW64ntdll.dll Report Id: b6fef44a-f3a3-11df-a3ad-001f29e83b6c —————————————————————————————————————— Below mentioned information events are logged at the same time in the eventviewer Fault bucket , type 0 Event Name: APPCRASH Response: Not available Cab Id: 0 Problem signature: P1: w3wp.exe P2: 7.5.7600.16385 P3: 4a5bcd2b P4: StackHash_36a0 P5: 6.1.7600.16385 P6: 4a5bdb3b P7: c0000374 P8: 000cdcbb P9: P10: Attached files: These files may be available here: C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_492df9603e11bbc5b03823f88e198723f5983146_02fd8b3f Analysis symbol: Rechecking forsolution: 0 Report Id: a8505dcf-f397-11df-b196-001f29e7b642 Report Status: 4

Now, in this particular case if you continue to look around the System event log you´ll come across this other error message which really helps you most of the time to figure out what is going on:

Log Name: System Source: -HttpEvent Date: 11/5/2013 8:10:12 PM : 15000 Task Category: None Level: Error Keywords: Classic User: N/A Computer: WebServer01.Bauzas.com Description: Unable to create log file S:WebLogsIIS Log FilesW3SVC3u_ex131106.log. Make sure that the logging directory is correct and this computer has write access to that directory. Event Xml: <Event xmlns=”<System> <Provider Name=”Microsoft-Windows-HttpEvent” Guid=”{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}” EventSourceName=”HTTP” /> <EventID Qualifiers=”49152″>15000</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime=”2013-11-06T02:10:12.757494400Z” /> <EventRecordID>5817</EventRecordID> <Correlation /> <Execution ProcessID=”4″ ThreadID=”4428″ /> <Channel>System</Channel> <Computer>WebServer01.Bauzas.com</Computer> <Security /> </System> <EventData> <Data Name=”DeviceObject”>DeviceHttpReqQueue</Data> <DataName=”LogFile”>S:WebLogsIIS Log FilesW3SVC3u_ex131106.log</Data> <Binary>000004000200300000000000983A00C0000000000000000000000000000000000000000000000000430000C0</Binary> </EventData> </Event>

As the error log implies the system is not able to create/write to the log file. Now, in my case this happened because I was playing with Network shares, Shared Configuration & so I forgot to set the right permissions for IIS to be able to write the log files that is has to the default directory:

Make sure your IIS IUSRS user has access to the log files