IIS "Page unavailable" fault and Its Solution

1. Runtime Environment
Server Operating System: Microsoft Windows Server 2003 Enterprise Edition Service Pack 1
IIS server: 6.0
Client: ie5.5 +

2. Fault symptom:
The client cannot access the Web server. The error message is "the page cannot be displayed". When IIS is checked on the server, it is not found to stop running, but cannot be accessed (even static pages ). Check out system32 \ logfiles \ httperr \ httperrxxx in the Windows installation directory. log (xxx indicates a number) file. When multiple logs are found, the number_connections_refused error is reported (number is an integer such as 1, 2, and 3 ). Restarting IIS cannot solve the problem. It is solved by restarting the computer.

3. Online Search Results:
The reason may be that nonpaged pool memory (non-Paging pool memory) is insufficient. Search for the following documents:

• Microsoft official documentation: http://support.microsoft.com/kb/934878/en

• One way to diagnose the specific cause: http://jackyhawk.blog.hexun.com/9608276_d.html, which uses poolmon.exein support.cabin to directly extract poolmon.exe in support.cabfor execution

• Poolmon instructions for use: http://support.microsoft.com /? Id = 177415

• Another way to diagnose the specific cause: http://www.ks-soft.net/cgi-bin/phpBB/viewtopic.php? T = 2477

4. poolmon monitoring results
After poolmon monitoring, it is found that the non-Paging memory occupied by tags used by IIS does not reach the limit of 20 mb, A tag named DDK increases several Mb every day until the entire nonpaged pool memory reaches the upper limit, leading to IIS dos. The description of DDK in pooltag.txt is DDK-<Unknown>-default for driver allocated memory (user's of ntddk. h ).
As shown in the following table, When IIS rejects services, the nonpaged pool memory has reached the upper limit of 110 MB, the number of DDK tags has reached mb. Generally, when the server is started, DDK only occupies less than 1 MB ).
Memory: 3669472 K avail: 2629568 K pageflts: 214 inram krnl: 10920 k p: 146036 K
Commit: 1237096 K limit: 5618588 K peak: 1907340 K pool N: 110360 k p: 154684 K
System pool information
Tag type allocs frees diff bytes per alloc

DDK nonp 2484310 (13) 1693491 (13) 790819 73677496 (0) 93
WFC nonp 387717051 (1584) 387571218 (21112) 145833 5924760 (-745208) 40
Lswi nonp 1 (0) 0 (0) 1 2584576 (0) 2584576
Mmcm nonp 40 (0) 10 (0) 30 1786400 (0) 59546
Tcpt nonp 7962320 (77) 7962290 (77) 30 1456744 (0) 48558

5. Fault Diagnosis
Since DDK causes nonpaged pool memory insufficiency, the next step is to find the driver using DDK. Use findstr/S/M/L "DDK" *. sys in the Windows installation directory \ system32 \ drivers to find out which drivers use DDK. Find the following results:

• Windows \ system32 \ drivers \ cpqcidrv. sys
• Windows \ system32 \ drivers \ cpqcisse. sys
• Windows \ system32 \ drivers \ iqvw32.sys
• Windows \ system32 \ drivers \ storport. sys
• Windows \ system32 \ drivers \ tmtdi. sys
• Windows \ system32 \ drivers \ tm_cf1_sys

I still cannot see the specific programs here. My method is to search for the names of these sys files in the Registry (remove. sys suffix), find the first two sys files belong to one tool software of Hp, the last two files belong to the trend anti-virus software, the middle two are not found, however, files with the same name are found in Windows \ servicepackfiles \ i386, so they can be considered as operating system drivers.
After finding these sources, you can use the exclusion method (detach them one by one) to determine which of the two drivers in the operating system has a problem or all of them have a problem (the two drivers in the operating system cannot be detached ). Note that you need to restart your computer to detect changes after uninstalling the instance. Otherwise, the nonpaged pool memory will continue to grow at the original speed. Another thing to note is that after the fault source is eliminated and the computer is restarted, nonpaged pool memory will grow for a period of time (I am here for more than a day, and I think this growth is normal, when all the applications on the server are up and saturated, The nonpaged pool memory consumed should be more than when it was just started), and then stabilized, while the DDK is basically not growing. The following lists the poolmon monitoring results when the data is stable:
Memory: 3669472 K avail: 2851396 K pageflts: 469 inram krnl: 2556 k p: 123992 K
Commit: 1130100 K limit: 5618588 K peak: 1217596 K pool N: 31364 k p: 125092 K
System pool information
Tag type allocs frees diff bytes per alloc

File nonp 4900398 (221) 4874531 (219) 25867 4022408 (304) 155
Ntfr nonp 76508 (0) 35611 (0) 40897 2618376 (0) 64
Lswi nonp 1 (0) 0 (0) 1 2584576 (0) 2584576
Mmca nonp 267906 (1) 245131 (4) 22775 2544880 (-288) 111
Mmcm nonp 40 (0) 10 (0) 30 1786400 (0) 59546
......
DDK nonp 19 (0) 15 (0) 4 29680 (0) 7420