Home/ Questions/Q 6878301
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T04:42:24+00:00

We’re having a strange cpu issue with WCF services hosted on IIS 6.0 on

  • 0

We’re having a strange cpu issue with WCF services hosted on IIS 6.0 on Windows Server 2003 SP2 x64. On some of our environments, seemingly when an app pool starts up, the svchost.exe running iissvcs will spin up to 100% cpu and stay there indefinitely (3+ days observed).

Investigation tidbits:

  • It doesn’t seem to be any specific app pool (we’re hosting 5+ WCF
    services in each their own app pool) nor happen every time.
  • The w3wp.exe process is started up, but using almost no memory / cpu – looks like very early initialization.
  • It seems strange that it’s actually svchost.exe and not w3wp.exe that’s 100%, so I’m suspecting a configuration issue. It seems to never touch our code.
  • We have 3 environments that have the issue and 1 that doesn’t. Unfortunately the environments are installed manually, so they’re not entirely identical.
  • An environment seems only to become ‘infected’ by one of our two branches. But after seeing the issue first time, even if the other branch is deployed, the issue remains.
  • The process seems to be doing no I/O, neither disk nor network.
  • Anti-virus software has been disabled from the one of the servers.

I’ve spent countless hours searching for the issue, I havn’t been able to find any related issues on SO / google.

Investigating dumps with WinDbg says that the active thread stack trace is:

00000000000afaa8 0000000077d6e4a6 ntdll!NtReadFile+0xa
00000000000afab0 000007ff7fefe89e kernel32!ReadFile+0x1e0
00000000000afb50 000007ff7fefe7cd advapi32!ScGetPipeInput+0x3e
00000000000afbc0 000007ff7fee4ec9 advapi32!ScDispatcherLoop+0xa0
00000000000afca0 0000000100002b29 advapi32!StartServiceCtrlDispatcherW+0x119
00000000000aff10 00000001000029be svchost!wmainCRTStartup+0x18a
00000000000aff50 0000000077d596ac svchost!wmainCRTStartup+0xe
00000000000aff80 0000000000000000 kernel32!BaseProcessStart+0x29

However, dumping a working svchost.exe gives the same result.

Stack traces of all threads:

I wanted to include the traces here, but since they’re rather long, I’ve put them on pastebin for the time being.

Any insight into what could be causing this – or ways to investigate further – is most welcome.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    A couple of points:

    This thread is encountering an exception while it is trying to allocate memory:

          10  Id: b8c.9bc Suspend: 0 Teb: 000007ff`fff9c000 Unfrozen
Child-SP          RetAddr           Call Site
00000000`01c1e020 00000000`77ee5a46 ntdll!RtlpUnwindPrologue+0x83
00000000`01c1e070 00000000`77ee6198 ntdll!RtlVirtualUnwind+0x4f3
00000000`01c1e0f0 00000000`77ee65d9 ntdll!RtlUnwindEx+0x155
00000000`01c1e770 00000000`77ee459d ntdll!_C_specific_handler+0xdd
00000000`01c1e800 00000000`77ee60a7 ntdll!RtlpExecuteHandlerForException+0xd
00000000`01c1e830 00000000`77ef31ed ntdll!RtlDispatchException+0x1b4
00000000`01c1eee0 00000000`77ef6409 ntdll!KiUserExceptionDispatch+0x2d
00000000`01c1f480 00000000`77ef636f ntdll!RtlpLowFragHeapAlloc+0x404
00000000`01c1f570 000007ff`7fefef84 ntdll!RtlAllocateHeap+0xc1
00000000`01c1f7c0 000007ff`6b0c9d32 advapi32!ReportEventW+0xb8
00000000`01c1f880 000007ff`6b0c9bb8 iisutil!EVENT_LOG::LogEventPrivate+0xe2
00000000`01c1f910 000007ff`6b05a58f iisutil!EVENT_LOG::LogEvent+0x148
00000000`01c1f9a0 000007ff`6b05c793 iisw3adm!CONFIG_MANAGER::CrossValidateDataObjects+0x30f
00000000`01c1fd80 000007ff`6b05c4d5 iisw3adm!CONFIG_MANAGER::FinishChangeProcessingOnConfigThread+0x1d3
00000000`01c1fe10 000007ff`6b06b780 iisw3adm!CONFIG_MANAGER::ProcessMetabaseChangeOnConfigThread+0x115
00000000`01c1fe90 000007ff`6b044f39 iisw3adm!MB_CHANGE_ITEM::ExecuteWorkItem+0x30
00000000`01c1fec0 000007ff`6b06ad7a iisw3adm!WORK_QUEUE::ProcessWorkItem+0xb9
00000000`01c1ff10 000007ff`6b05c179 iisw3adm!CHANGE_PROCESSOR::RunNotificationWorkQueue+0x9a
00000000`01c1ff50 00000000`77d6b71a iisw3adm!ChangeNotificationLauncher+0x9
00000000`01c1ff80 00000000`00000000 kernel32!BaseThreadStart+0x3a

    Thread stack 13, 16, 17 have the same problem. This looks like a heap corruption, but without the dump file it is difficult to verify. Somewhere the dynamic memory management code of the app has bugs.

    There have been several bugs with iiws3adm, so it would be best to patch the machines to the most current level. Otherwise the next step is to check for heap corruptions.

    • 0