Share via

Troubleshooting with Exception Monitor

  • Article

 

Aaron Barth
Microsoft Corporation

Updated August 2000

Contents

Introduction
Background
Exception Monitor Features
Installing Exception Monitor
Starting a Monitoring Session
Select Application State
Select Process Options
Select Session Options
Understanding the Windows Debugger (WinDBG)
Understanding the Session Status Page
Understanding the Manual Trip
Conclusion

Introduction

This article provides an overview of Exception Monitor, a diagnostic tool that Microsoft Technical Support uses to solve complex issues with Microsoft® Internet Information Server (IIS) and Microsoft Windows® DNA applications. The article also provides step-by-step instructions for using Exception Monitor to diagnose issues in your particular environment.

Learning to use Exception Monitor effectively can help you troubleshoot common IIS errors, such as:

  • IIS exits or the system generates a Dr. Watson error log for an application or service.
  • The service exits abnormally.
  • The browser returns an ASP 0115 error.
  • The browser returns a Server Application Error message.
  • The browser returns a Server Too Busy error.

You can learn more about these IIS errors through Microsoft Knowledge Base articles. However, any one of these errors may be caused by site-specific conditions unique to your installation. More often than not, IIS errors result from an application or component, rather than an IIS bug. Because organizations use IIS and Windows DNA applications as the foundation on which they build their individual Web applications, each IIS site is potentially different. Recognizing these variations, Exception Monitor gives you detailed information about an exception, allowing you to target the specific cause.

Where do these site-specific differences originate? Some Web applications use Active Server Pages (ASP) technology to connect to ODBC-compliant databases. Others contain compiled business objects (COM objects) running within IIS. These COM objects, also called Active Server Components, can be written in many languages, including Microsoft C++, Microsoft Visual Basic® (VB), Java, Delphi, Powerbuilder, and others. Some organizations develop COM objects in-house, while others purchase them from a third party. Together, each technology interacts to form an organization's unique Web environment. More important, any one of these components may cause IIS errors.

System administrators and developers can use Exception Monitor to diagnose errors within their unique IIS installation. Once you determine the cause of an error, you can contact the developer or vendor of the dynamic-link library (DLL) and provide them with concrete information for resolving the exception.

Background

To really understand the significance of Exception Monitor, let's look more closely at some common exceptions. Many IIS errors are caused by exceptions that occur within IIS process space (Inetinfo.exe). The most common error is the 0xC0000005 exception, resulting from an access violation. Access violations occur when a DLL within the IIS process tries to access memory that is not allocated or tries to free memory that already has been freed.

What about when the Web server stops without your input? This can be caused either by an access violation or another type of exception within IIS. Another common IIS issue, the ASP 0115 exception, also is raised to the browser and the IIS log when an access violation occurs.

Again, there is usually no one cause of any of these exceptions, as each site uses different components in its Web applications. For example, when an ASP 0115 error occurs, the browser and IIS log may display:

error 'ASP 0115'
Unexpected error
/<Web Name>/<ASP file name>.asp
A trappable error occurred in an external object. The script cannot continue running.

When the error displays on the returned ASP page, you know:

  1. The page that caused the problem.
  2. An exception occurred in an external object.

If knowing the page that caused the problem is enough information for you to diagnose the exception, then you don't need to go any further. However, assuming you need more information, take a look at the rest of the error message. It indicates that an exception occurred in an external object, but which object?

Diagnosing problems with an external object is more difficult. You could remove all calls to external objects on the page and see if it fails. However, this usually is not feasible since removing all Server.CreateObject statements in an ASP page leaves your page with intrinsic objects only (for example, Application, Session, Request, and Response). ASP considers any object that it creates with a Server.CreateObject statement to be an external object. The power of an ASP originates in its ability to create an instance of any COM object. If you remove all calls to external objects, you lose the benefit of an ASP.

Exception Monitor Features

As demonstrated above, there are limitations when diagnosing exceptions strictly based on the error message returned to the browser and IIS log. By attaching to the IIS process and reporting what is happening, Exception Monitor greatly improves diagnostic capabilities within the IIS environment. Specifically, Exception Monitor provides:

  • An explanation of the type of exception that occurred.
  • The thread where the exception occurred.
  • The DLLs that executed functions on that thread.

This information may not solve every problem in all instances. However, it usually provides more information than before. It narrows the scope of the exception and allows you to focus on a specific ODBC driver or component called by the ASP.

Installing Exception Monitor

Installing Exception Monitor requires that you meet the minimum system requirements and obtain the correct executable (.exe) files for the IIS version and processor architecture installed at your site. First verify that you meet the system requirements and then use one of the links below to download the correct executable file.

Minimum System Requirements

To run Exception Monitor, you must meet the following minimum system requirements:

  • Windows NT® 4.0 Service Pack 4 or later with Windows Script Host

-or-

  • Windows 2000

Download Exception Monitor version 6.1 (still available)

To install Exception Monitor

  1. Run the Dbgplus.exe file.

**Note:   **Extraction of files from Dbgplus.exe requires approximately 13 megabytes (MB) of disk space.

  1. In the Microsoft Debugging Tools License Agreement dialog box, click Yes.

  2. In Microsoft Debugging Tools Directory (Figure 1), browse for or type a location for Exception Monitor, and click OK.

Figure 1. Microsoft Debugging Tools—directory prompt

  1. If the directory does not exist, the system displays the Microsoft Debugging Tools Confirmation window. Click Yes to confirm and wait for installation to complete. Click OK when you are prompted that installation is complete.

To start Exception Monitor

  • Click the Start button, then point to Programs. Point to the folder that contains Debugging Tools/Exception Monitor, the click Exception Monitor.

Starting a Monitoring Session

When you first start Exception Monitor, the Exception Monitoring Wizard presents the Welcome dialog box. This provides a brief description of the tool's function and provides a starting point for beginning the exception monitoring process. Use the table below as a reference:

To: Do this: Notes
View existing log files from previous sessions in the \Debuggers\em\logs directory Click View Log Files.

Select a log to analyze using the Exception Monitor Log File Analyzer.

 Enabled only when log files are present.
Run Exception Monitor Click Next.

This presents the Select Application State dialog box.

  
Run demonstration Click Next.

This presents the Select Application State dialog box.

  

Select Application State

When you click Next in the Welcome dialog box, Exception Monitor prompts you to select the application state to monitor. You can monitor a service or application that currently is running or a service that is stopped. Use the table below as a reference:

To: Do this: Notes
Monitor a running service or application Click Monitor a running Service or Application.

Click Next.

This presents the Process Options dialog box.

 With this option selected, only running services or applications display in the Process Options dialog box.
Start and monitor a stopped service Click Start and select Monitor a Service that is not currently running.

Click Next.

This presents the Process Options dialog box.

 With this option selected, only stopped services or applications display in the Process Options dialog box.
Run demonstration Click Monitor a running service or application.

Click Next.

This presents the Process Options dialog box.

 With this option selected, only running services or applications display in the Process Options dialog box.

Select Process Options

When you click Next in the Select Application State dialog box, Exception Monitor prompts you to select the type of service or application to monitor. Use the table below as a reference:

To: Do this: Notes
Monitor services Select Service.

Note: If you select COM+ Application/MTS Package/IIS (Pooled/Out Of Process) when you click Next, the system presents the Select Out of Process dialog box, where you select from a list of COM+ Applications / MTS Packages. The COM+ Applications / MTS Packages are listed by their Application / Package name.

Select the desired service in the running service drop down list.

Click Next.

This generally presents the Session Options dialog box.

 If the following registry values meet the listed exception criteria, the service will not appear in the running service drop down list:

Note: If you select COM+ Application/MTS Package/IIS (Pooled/Out Of Process) when you click Next, the system presents the Select Out of Process dialog box, where you select from a list of COM+ Applications / MTS Packages. The COM+ Applications / MTS Packages are listed by their Application / Package name.

Key:

HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\ <Service ShortName>\ImagePath.

Exceptions:

services.exe

lsass.exe

svchost.exe

winlogon.exe

csrss.exe

Contain: "/" (forward slash)

Key:

HKEY_LOCAL_MACHINE \SYSTEM\ CurrentControlSet \Services\ <Service Short Name>

Exceptions:

<Short Service Name> contains a space

There are two "special" service entries that may appear in the drop down list of running services, depending on whether you install Internet Information Service or not:

Microsoft Internet Information Service (In Process)

COM+ Application / MTS Package / IIS (Pooled / Out Of Process) Applications
Monitor other application Select Other Application.

This presents the Select Out of Process dialog box, where you select from a list of Win32 processes running on the machine. The processes are listed by their executable name and process id.

Click Next.

 Select this option if the process or application that you want to monitor is not a running service or COM+ application, and is a Win 32 process.
Run demonstration Select Service.

This presents the Session Options dialog box.

Select Microsoft Internet Information Service (In Process) from the drop down list.

Click Next.

  

Select Session Options

When you click Next in Process Options, Exception Monitor prompts you to select the type of monitoring session (automatic or manual) you would like to perform. Use the table below as a reference:

To: Do this: Notes
Perform automatic monitoring session Select Automatic.

Select Enable Recursive Mode.

This restarts the monitoring process immediately after the service restarts. This option is useful when you want to continuously restart a service after an exception occurs. The recursive mode continues until you disable it (see To Disable Recursive Mode in next subsection).

Select Notify Admin and replace COMPUTERNAME with the user name or computer name to be notified.

This automatically sends a NET SEND to the specified computer name or user name.

OR:

If SMTP service is installed on the same machine, Exception Monitor can send an e-mail notification of an exception and attach the Debugger Log (DBG) file from the session.

To enable the email notification feature, change COMPUTERNAME to User@Domain.com. When Exception Monitor detects "@" in the notify admin field, it sends an e-mail with an attached log to that user.

Click Next.

This presents the Start Monitoring dialog box.

 Use this option to automatically execute debugger commands and create a log when default exceptions occur.
To perform manual monitoring session Select Manual.

Click Next.

This presents the Manual Sessions Option dialog box used to configure the remote connectivity options for the session.

 Use this option to perform diagnosis of a monitoring session from a remote location. Typically, a technical support organization will instruct you to use this option.
Run demonstration Select Automatic.

Click Next.

This presents the Start Monitoring dialog box.

  

To Disable Recursive Mode

When you select Enable Recursive Mode in Session Options, Exception Monitor continuously restarts the monitoring process immediately after the service restarts. The recursive mode continues until you disable it. Exception Monitor provides three ways to disable the recursive mode:

  1. Through a GUI:

    • Restart the wizard by executing em.exe. If recursive mode is enabled, the system prompts you with the Recursive Mode dialog box.
    • Select Yes to disable the recursive mode

  2. Through a Command Line:

    • Change directory to the <Exception Monitor Install Directory>\Debuggers\bin\em directory

    • Type cscript.exe em.vbs /r

      This displays the following output:

    C:\Program Files\DebuggersEM\bin\em>cscript em.vbs /r
Microsoft ® Windows Script Host Version 5.1 for Windows
Copyright (C) Microsoft Corporation 1996-1999. All rights reserved.

9/29/1999 10:44:03 AM : EM: Starting EM.vbs
9/29/1999 10:44:03 AM : EM: Number of Arguments= 1
9/29/1999 10:44:03 AM : EM: Start REGINSTALLDIR C:\Program Files\Debuggers\bin\em
9/29/1999 10:44:03 AM : EM: Start WINDBGINSTALLDIR C:\Program Files\Debuggers
9/29/1999 10:44:03 AM : EM: Start WINDBGBINDIR C:\Program Files\Debuggers\bin\
9/29/1999 10:44:03 AM : EM: recursive = TRUE 0
9/29/1999 10:44:03 AM : EM: SetRecursive()
9/29/1999 10:44:03 AM : EM: origRecursive:0
Setting Recursive Flag in Registry HKLM\SOFTWARE\Microsoft\em\Recursive = 1 ....

  3. Through the registry:

    • Change the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\em\Recursive from "1" to "0".

Start Monitoring Session

When you select Automatic and click Next in Session Options, Exception Monitor displays the Start Monitoring dialog box. Use the table below as a reference:

To: Do this: Notes
Run monitoring session

  • Select Run This Monitoring Session.

    This starts the monitoring session and launches the Windows Debugger window.

 See next section for a full description of the Windows Debugger window.
View session status

  • Click Next.

    This presents the Session Status dialog box, where you can view existing log files and stop running Exception Monitor sessions without leaving the wizard.

 See next section for a full description of the Session Status dialog box.
Run demonstration
  1. Select Run This Monitoring Session.
  2. Wait for the Windows Debugger window to display and attach to the process.
  3. Click Next.
  

Understanding the Windows Debugger (WinDBG)

When you select Run This Monitoring Session in Start Monitoring, Exception Monitor starts the session and launches Windows Debugger or WinDBG. Exception Monitor instructs WinDBG to attach to the selected service or process and it configures WinDBG to perform a list of commands when it encounters exceptions.

Figure 2. Windows Debugger (WinDBG)

Below is the full output from the WinDBG window:

> .attach 500
Module Load: C:\WINNT\SYSTEM32\spoolsv.exe (symbol loading deferred)
Thread Create: Process=0, Thread=0
Thread Create: Process=0, Thread=1
Thread Create: Process=0, Thread=2
Thread Create: Process=0, Thread=3
Thread Create: Process=0, Thread=4
Thread Create: Process=0, Thread=5
Thread Create: Process=0, Thread=6
Thread Create: Process=0, Thread=7
Thread Create: Process=0, Thread=8
Module Load: C:\WINNT\SYSTEM32\ntdll.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\msvcrt.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\kernel32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\advapi32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\rpcrt4.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\gdi32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\user32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\spoolss.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\ws2_32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\ws2help.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\msafd.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\rasadhlp.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\rtutils.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\localspl.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\ole32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\version.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\lz32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\secur32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\sfc.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\sfcfiles.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\winspool.drv (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\netapi32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\netrap.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\samlib.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\wldap32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\dnsapi.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\wsock32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\cnbjmon.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\pjlmon.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\tcpmon.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\usbmon.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\comctl32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\msfaxmon.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\WSPWSP.DLL (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\wshtcpip.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\rnr20.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\winrnr.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\win32spl.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\clbcatq.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\oleaut32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\inetpp.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\icmp.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\rsabase.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\userenv.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\crypt32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\msasn1.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\shell32.dll (symbol loading deferred)
Module Load: C:\WINNT\SYSTEM32\shlwapi.dll (symbol loading deferred)
Thread Create: Process=0, Thread=9
Process attached is stopped
> .logappend C:\Program Files\Debuggers\bin\em\config\500\EM_500-123449-929-1999.dbl
> !load C:\DebuggersEM\bin\emdbg.dll
Debugger extension library [C:\Program Files\Debuggers\bin\emdbg] loaded
> !emdbg.tag Exception Monitor 7.0.0.0
Exception Monitor 7.0.0.0

> .opt IgnoreAll on
> .opt BrowseOnSymError off
> sxe c0000005 /C".source C:\Program Files\Debuggers\bin\em\config\500\Access_Violation.ecx"
> sxe 0 /C".source C:\Program Files\Debuggers\bin\em\config\500\Manual_Trip.ecx"
> g

Note the following:

  • At the top of the output, notice the .attach 500 command. This command attaches the debugger to the process with the Process Id of 500.
  • Towards the bottom of the output, notice several sxe commands. These commands inform the debugger what to do when it encounters certain exceptions. The sxe commands are:
  • sxe c0000005 /C".source C:\Program Files\Debuggers\bin\em\config\500\Access_Violation.ecx"
  • sxe 0 /C".source C:\Program Files\Debuggers\bin\em\config\500\Manual_Trip.ecx"
  • For more information about Exception Monitor and how it configures WinDBG, refer to the Technical Notes Section in the Exception Monitor help file.

Understanding the Session Status Page

When you select Next in the Start Monitoring dialog box, Exception Monitor displays the Session Status dialog box below. The dialog box presents the status of multiple Exception Monitor sessions. You also can view existing log files and stop running Exception Monitor sessions without leaving the wizard.

Figure 3. Session Status

Notice the Status for Automatic Sessions list boxes with the following contents:

  • LogFile: The name of the log file.
  • Process ID: The process ID for the process that was monitoring when the log was written.
  • Start Time: The time that the log was started.
  • End Time: The time when the monitoring session was tripped (manually or by an exception).
  • Exception: The type of exception listed in the log file (usually Access Violation or Manual).

The Session Status dialog box also allows you to perform several actions:

To: Do this: Notes
View log Click View Log.

This displays the Log File Analyzer and passes the log file name in the command line.

 See the next section for a full description of the Log File Analyzer.
Stop/create log Click Stop/Create Log.

This causes the debugger to manually trip the monitoring session without user input in the command line and displays the Manual Trip dialog box

OR

Type !emdbg.trip in the Windows Debugger window when you want to trip the monitoring session and generate a log.

 See section below for a full description of the Manual Trip dialog box.
Refresh status Click Refresh Status.

This refreshes the status window with current information.

  
Run demonstration Select the Running_ <Process ID> line from the Automatic Sessions window and click Stop/Create Log.

This causes a scrolling WinDBG window and command windows to open and close. When the WinDBG window closes, notice the IIS process that was being monitored now restarts.

Click Refresh Status, select the log entry with the most recent start time and click View Log.

This displays the Log File Analyzer and opens your Exception Monitor log file.

 See the next section for a full description of the Log File Analyzer.

Understanding the Log File Analyzer (Preview)

When you select View Log from the Session Status dialog box, Exception Monitor displays the Log File Analyzer (Figure 4).

Figure 4. Log File Analyzer

For more information on ReadLogs and analysis of Exception Monitor log file, refer to the companion article Analyzing Logs from IIS Exception Monitor.

Understanding the Manual Trip

When you initiate a manual trip of a monitoring session by selecting Stop/Create Log from the Session Status dialog or typing !emdbg.trip in a command line, Exception Monitor stops monitoring and displays the Manual Trip dialog box below.

Figure 5. Manual Trip dialog box

Conclusion

Microsoft Technical Support uses Exception Monitor successfully to solve many issues with IIS and Windows DNA applications. Although the tool cannot address every exception, it provides more information on the status of a failure than the server's logging mechanisms.

Keep in mind that you should use the tool primarily when the server crashes and the IIS and event logs do not contain enough information to solve the problem.

Aaron Barth is a Technical Lead for the Solution Integration Team at Microsoft. The Solution Integration Engineering team troubleshoots and diagnoses complex issues with Windows DNA applications by using the Exception Monitor and other debugging tools.