IIS IIS failure problem (connections_refused) analysis and processing

This article has been written for a long time, but it has not reproduced the problem at that time, or because the importance of business, the pressure of complaints are temporarily dealt with. This problem has been repeated several times in a city Web server in a few days, just to make an end of this case.

A few months ago, there was an important Web server (Windows Server2003 + IIS6.0) in which clients were unable to access sites on the Web server, and the error message was "the page could not be displayed." Logging on to the server checks out that IIS does not stop running and that the services are working properly, but you cannot access the pages on the site (including static pages). In fact, this problem has often occurred before, basically the processing methods are through the restart of the Web server to solve, as for why to deal with this, and there is no specific arguments and basis, mostly by virtue of personal experience, so this solution can only relieve the pressure of complaints, not fundamentally solve the problem.

So, let's take a closer look at this problem and find out the root of the problem and try to achieve the root causes.

First of all, it must be to analyze the IIS log on the problem server, I found that during the period when the site was inaccessible, a large number of "connections_refused" errors were recorded in the Httperr log

This problem occurs by default if the available non-paged pool memory is low 20mb,http.sys service stops receiving new connections. This also explains why restarting IIS is useless and can only be resolved by restarting the Web server to free up memory resources.
There are also Microsoft's official solutions online:
1. Enter the registry and find the following:
Hkey_local_machine\system\currentcontrolset\services\http\parameters;
2. New DWORD value, enter name "Enableaggressivememoryusage";
3. The modified value is 1;
4. Restart the HTTP service:
Perform separately under DOS
net stop http/y
Iisreset/restart

I follow the above instructions to configure, but there is no effect can not be verified, can only observe the server after the subsequent operation. This approach is a step closer to restarting the Web server than before, at least one step closer to knowing the cause of the problem than the blind restart restart. So the real reason for the problem. What is causing the non-paged pool memory to continue to grow to less than 20M?
To analyze this problem, the first thing to understand is the core memory concept in Windows systems: Core memory is the memory space that Windows allocates to the system kernel or drive, and paging memory is virtual memory, which means that this part of memory can be replaced to a hard disk, but nonpaged memory is not replaceable to the hard disk, Can only exist in the physical memory, often used for some software or system driver use. If the paging memory is infinite, reaching a threshold can cause system problems. On 32-bit Windows, this threshold cannot exceed 256MB, or the operating system becomes very unstable.
To open the Task manager for your own system, you can see in the performance key:

As shown in the figure above, this is the number of paging and nonpaged memory that I use at the current time on my computer, which is normal.
Let's look at the recent problem of the machine for 2 consecutive days, 2 failures in memory usage, nonpaged memory has jumped to more than 230 m

OK, no more nonsense, this time you need to use the core memory leak detection Tool Poolmon. With this tool, let's look at what software or program on the Web server is causing the memory leak, resulting in an insufficient number of paged memory. Poolmon is a DOS-like command-line execution program that basically completes the detection operation we only need 2 instructions: P-sorted tag list through paging, non-paged, blending, etc. 3 modes; B-sort the maximum byte usage for the label. As the following illustration shows: All the nonpaged memory entries in the operating system are displayed and sorted in descending order of byte size. We find the tag item that is in the front and the number of bytes increasing, locating the process and the driver file according to tag. For example, we would like to look at the current consumption of 90M non-paged memory thre entry, in DOS input:
findstr/s/m/l "Thre" C:\windows\system32\drivers\*.sys

As shown in the figure above, we see that the system-driven and antivirus drivers occupy the thre. This machine last poisoned, so later under the rising and 360 guards to detox. Rising is out of the name of the consumption of paging memory large, 360 of the guards themselves have been infected with the virus, so I basically locked the 2 software, first uninstall, and then restart the server, download 360 guards and 360 antivirus again after the detoxification observation server performance and memory consumption. From the last reboot so far, run more than 10 days, the total paging memory consumption remained within 50M, although there is a small increase, but still normal. So, based on the analysis above, we can locate the real problem that is causing the IIS failure. This problem is largely due to anti-virus software programs or some system drivers.
This is largely due to the lack of non-paged memory due to antivirus programs or some system drivers because non-paged memory is typically a kernel program or a driver is requesting it. This resource is very valuable, if the program is not properly handled, it will also lead to the situation, such as a socket only accept the connection, but for some reason did not read the data, and then the client connected to send data after the connection, in this extreme case of nonpaged memory will soon be full.

Http://www.cnblogs.com/maoniu602/archive/2012/12/24/2830804.html