ASP.Net Core Application process failed to start due to Anti-virus scanning

Published 01-14-2021 06:46 AM 1,800 Views
Microsoft

When you host ASP.Net Core 2.x version in IIS/IIS Express, the application runs in a process separate from the IIS worker process (out-of-process) with the Kestrel server. Here you can find the detailed explanation on publishing an ASP.NET Core app to an IIS server.

 

Recently, I came across an issue where ASP.Net Core 2.x version failed to start with the error below:

 

 

Exceptions:

 

After browsing the page, the exception on the browser:

 

HTTP Error 502.5 - Process Failure

 

Common causes of this issue:

The application process failed to start

The application process started but then stopped

The application process started but failed to listen on the configured port

 

Troubleshooting steps:

Check the system event log for error messages

Enable logging the application process' stdout messages

Attach a debugger to the application process and inspect

 

In the Event Viewer logs, the error will be:

 

Event ID 1020 from Source: AspNetCoreModuleV2

 

Application '/LM/W3SVC/1/ROOT/Site' with physical root '<path>' failed to start process with commandline '<path><application>.exe ' at stage 'CreateProcessW', ErrorCode = '0x80070002', assigned port xxx, retryCounter '0'.

 

 

Root Cause:

There are many reasons when process fails to start. One of the reasons is documented here:

ASP.Net core application exe was quarantined by the Anti-virus.

 

 

Resolution:

The application runs in a process separate from the IIS worker process (out-of-process). So two processes will spawn to process the requests: IIS worker process(w3wp.exe) and Application process(dotnet.exe/Application.exe)

Both w3wp.exe and exe of the application(application.exe or dotnet.exe) must be excluded from Anti-virus scanning.

 

This article includes information about folders that need to be excluded from antivirus scanning in ASP.net applications.

%3CLINGO-SUB%20id%3D%22lingo-sub-2061026%22%20slang%3D%22en-US%22%3EASP.Net%20Core%20Application%20process%20failed%20to%20start%20due%20to%20Anti-virus%20scanning%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2061026%22%20slang%3D%22en-US%22%3E%3CP%20style%3D%22margin%3A%200in%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EWhen%20you%20host%20ASP.Net%20Core%202.x%20version%20in%20IIS%2FIIS%20Express%2C%20the%20application%20runs%20in%20a%20process%20separate%20from%20the%20IIS%20worker%20process%20(%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-style%3A%20italic%3B%20font-family%3A%20'Segoe%20UI'%3B%20font-size%3A%2012.0pt%3B%20color%3A%20%23171717%3B%20background%3A%20white%3B%22%3Eout-of-process%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E)%20with%20the%26nbsp%3BKestrel%20server.%20%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Faspnet%2Fcore%2Fhost-and-deploy%2Fiis%2F%3Fview%3Daspnetcore-2.1%26amp%3Btabs%3Daspnetcore2x%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EHere%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%20you%20can%20find%20the%20detailed%20explanation%20on%20publishing%20an%20ASP.NET%20Core%20app%20to%20an%20IIS%20server.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3ERecently%2C%20I%20came%20across%20an%20issue%20where%20ASP.Net%20Core%202.x%20version%20failed%20to%20start%20with%20the%20error%20below%3A%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%3CSPAN%20style%3D%22font-weight%3A%20bold%3B%22%3EExceptions%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EAfter%20browsing%20the%20page%2C%20the%20exception%20on%20the%20browser%3A%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3EHTTP%20Error%20502.5%20-%20Process%20Failure%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3ECommon%20causes%20of%20this%20issue%3A%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3EThe%20application%20process%20failed%20to%20start%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3EThe%20application%20process%20started%20but%20then%20stopped%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3EThe%20application%20process%20started%20but%20failed%20to%20listen%20on%20the%20configured%20port%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3ETroubleshooting%20steps%3A%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3ECheck%20the%20system%20event%20log%20for%20error%20messages%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3EEnable%20logging%20the%20application%20process'%20stdout%20messages%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2010.0pt%3B%22%3EAttach%20a%20debugger%20to%20the%20application%20process%20and%20inspect%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EIn%20the%20Event%20Viewer%20logs%2C%20the%20error%20will%20be%3A%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%3CSPAN%20style%3D%22font-weight%3A%20bold%3B%22%3EEvent%20ID%201020%20%3C%2FSPAN%3Efrom%3CSPAN%20style%3D%22font-weight%3A%20bold%3B%22%3E%20Source%3A%20AspNetCoreModuleV2%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20'Courier%20New'%3B%20font-size%3A%2011.0pt%3B%22%3EApplication%20'%2FLM%2FW3SVC%2F1%2FROOT%2FSite'%20with%20physical%20root%20'%3CPATH%3E'%20failed%20to%20start%20process%20with%20commandline%20'%3CPATH%3E%3CAPPLICATION%3E.exe%20'%20at%20stage%20'CreateProcessW'%2C%20ErrorCode%20%3D%20'0x80070002'%2C%20assigned%20port%20xxx%2C%20retryCounter%20'0'.%3C%2FAPPLICATION%3E%3C%2FPATH%3E%3C%2FPATH%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20margin-left%3A%20.375in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%3CSPAN%20style%3D%22font-weight%3A%20bold%3B%22%3ERoot%20Cause%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EThere%20are%20many%20reasons%20when%20process%20fails%20to%20start.%20One%20of%20the%20reasons%20is%20documented%20here%3A%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EASP.Net%20core%20application%20exe%20was%20quarantined%20by%20the%20Anti-virus.%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%3CSPAN%20style%3D%22font-weight%3A%20bold%3B%22%3EResolution%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%22%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EThe%20application%20runs%20in%20a%20process%20separate%20from%20the%20IIS%20worker%20process%20(%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-style%3A%20italic%3B%20font-family%3A%20'Segoe%20UI'%3B%20font-size%3A%2012.0pt%3B%20color%3A%20%23171717%3B%20background%3A%20white%3B%22%3Eout-of-process%3C%2FSPAN%3E%3CSPAN%20style%3D%22font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E).%20So%20two%20processes%20will%20spawn%20to%20process%20the%20requests%3A%20IIS%20worker%20process(w3wp.exe)%20and%20Application%20process(dotnet.exe%2FApplication.exe)%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3EBoth%20w3wp.exe%20and%20exe%20of%20the%20application(application.exe%20or%20dotnet.exe)%20must%20be%20excluded%20from%20Anti-virus%20scanning.%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200in%3B%20font-family%3A%20Calibri%3B%20font-size%3A%2011.0pt%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fiis-support-blog%2Fantivirus-exclusion-list-for-asp-net-applications-hosted-on-iis%2Fba-p%2F343006%22%20target%3D%22_blank%22%3EThis%3C%2FA%3E%20article%20includes%20information%20about%20folders%20that%20need%20to%20be%20excluded%20from%20antivirus%20scanning%20in%20ASP.net%20applications.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2061026%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EASP.Net%20Core%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎Jan 14 2021 06:46 AM
Updated by: