I have windows 2003 server which has suddenly stopped working at around 8:03 PM. The windows event logged the message:
An administrator has requested a recycle of all worker processes in
application pool 'Pool_XYZ'.
And after that
A process serving application pool 'Pool_XYZ' exceeded time limits
during shut down. The process id was '870072'.
Those two messages were repeating every 5 minutes.
I did IISREST and I can see inetinfo.exe running. When I try to access the site, browser returns the same page if the server was not running. There are no w3wp.exe processes (that should be used as app pool hosts). There are no error messages in the vent log. If I telne to port 80, the server disconnects as soon as I press the first characters. There are no requests logged after 8:03 PM in iis log files.
Any ideas on what could be wrong? I have restarted the services multiple times but it does not help.
Best Answer
I suspect there's an issue with one of the [external] DLLs being loaded into the worker process. These come about with use of extensions (ASP.NET, ISAPI extensions, Etc.).
My recommendation would be to use Microsoft's SysInternals ProcessMonitor to see what the server is doing when you attempt to start IIS / browse to it. Set your filter to ProcessName = w3wp.exe and see what happens.
You may need to disable certain extensions, re-install them, Etc.
Another situation that I've seen cause a [sort of] similar issue was where a piece of malware had hooked port 80, and was proxying in-front of IIS. A sort of MITM attack if you like.