none
mscorwks.dll causes Windows-Service crash RRS feed

  • Question

  • Hello

    Our Windows-Service application crashed 3 times the last 4 months in different intervals. EventLog says:

    server.exe, version 3.2.9.2, stamp 4bd6ecf0, faulting module mscorwks.dll, version 2.0.50727.3603, stamp 4a7cd88e, debug? 0, fault address 0x0010969f.For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    There is no more information about the crash than this EventLog entry.
    Windows-Service is stopped, resp. the process isn't running any more.

    OS: Microsoft Windows Server 2003 R2
    .Net Framework: 3.5 SP1
    Windows-Service logs on with specific account

    Is there a possibility to obtain the source code line out of the stamp address provided in the EventLog message?
    Any clues how to get more details about past and forthcoming crashes?

    Thanks for help!

    Wednesday, September 15, 2010 5:45 AM

All replies

  • Hi,

    Thanks for your post. For process crashes, we could use dump analysis to find the cause. Below are some resources which could be helpful.

    1. Crash Dump Analysis article on MSDN

    2. A series of introduction article for dump analysis

    3. Getting full user mode dumps automatically when your process crashes

    4. A hands-on video tutorial - Debugging Crash Dumps with Tess Ferrandez and VS2010


    Please mark the right answer at the right time.
    Thanks,
    Sam
    • Edited by SamAgain Thursday, September 16, 2010 2:01 AM refine
    Thursday, September 16, 2010 1:59 AM
  • Hi

    Thank you for the provided links with information about creating and debugging crash dumps.
    Because an installation of such tools is not practicable on clients site, and the time of next occurrence is undetermined, your links will not solve our problem (at the moment).

    Regarding the analysis of the already happened crashes:

    What do the stamps (server.exe, version 3.2.9.2, stamp 4bd6ecf0 / mscorwks.dll, version 2.0.50727.3603) in the EventLog exactly mean?
    What does the faulting address (fault address 0x0010969f) in the EventLog exactly mean?
    Is there a link between these addresses and the source code?

    Thanks & regards,
    Domi

    Wednesday, September 22, 2010 1:20 PM
  • I have the same issue with windows service. In EventLog I can see two records about an issue:

    1. With title = ".NET Runtime" with details = ".NET Runtime version 2.0.50727.4952 - Fatal Execution Engine Error (000007FEF94EFA42) (80131506)"

    2. Title = "Application Error", details:

    Faulting application name: MyService.exe, version: 1.0.0.0, time stamp: 0x4b69a17a

    Faulting module name: mscorwks.dll, version: 2.0.50727.4952, time stamp: 0x4bebe78c

    Exception code: 0xc0000005

    Fault offset: 0x00000000001c3275

    Faulting process id: 0x%9

    Faulting application start time: 0x%10

    Faulting application path: %11

    Faulting module path: %12

    Report Id: %13

     

    I think that there can be issue with memory. Could somebody assist on this issue?

    Sunday, November 7, 2010 2:41 PM
  • Hello

    Since my question is not answered yet, I want to ask again:

    What do the stamps (server.exe, version 3.2.9.2, stamp 4bd6ecf0 / mscorwks.dll, version 2.0.50727.3603) in the EventLog exactly mean?
    What does the faulting address (fault address 0x0010969f) in the EventLog exactly mean?
    Is there a link between these addresses and the source code?

    Thanks & regards,
    Domi

     

    Wednesday, December 22, 2010 8:21 AM