IIS worker process uses w3wp.exe file to process client requests. It is a Windows process which handles requests received by the web server. Each worker process serves for a specific application pool and each application pool has at least one instance of w3wp.exe.
In some cases, w3wp.exe may crash with the error code 0xc0000374 in Event Viewer:
Event ID 1000 Faulting application name: w3wp.exe Faulting module name: ntdll.dll Exception code: 0xc0000374
This issue could be result of the slow performance of an application.
The first step would be running DebugDiag tool to collect crash dump. The crash dump should tell the root cause of the issue. In my case, it was a heap corruption:
To solve a heap corruption, try these:
DebugDiag logs provide a valuable information to narrow down the issue. However, some causes such as heap corruptions may require a further analysis. WinDbg is a useful tool to troubleshoot heap corruption issues.
In another case, the stack trace showed
MicrosoftInstrumentationEngine_x64 which points a bug. In order to solve this issue, you should uninstall Microsoft Monitoring Agent (SCOM agent) and restart the machine. If you need to install it back, install it by using the command provided by Microsoft:
msiexec /i MonAgent.msi NOAPM=1
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.