W3wp. EXE Solution

11 anti-DDoS Attacks:
1. Ensure that all servers use the latest system and install security patches. The Computer Emergency Response Coordination Center found that almost all systems under DDoS attacks were not patched in time.

2. Ensure that the Administrator checks all hosts, not only key hosts. This is to ensure that the Administrator knows what each host system is running? Who is using the host? Who can access the host? Otherwise, it is difficult to find out If hackers infringe the system.

3. Ensure that unused services such as ftp or NFS are deleted from the corresponding directory or file database on the server. Wu-ftpdProgramSome known vulnerabilities allow hackers to gain access to privileged systems through root attacks and access other systems-or even firewall-protected systems.

4. Ensure that all services running on UNIX have TCP encapsulation programs and restrict access to the host.

5. Disable intranet connection to the PSTN system through modem. Otherwise, hackers can discover unprotected hosts through telephone lines and immediately access extremely confidential data.

6. Prohibit the use of network access programs such as telnet, FTP, RSH, rlogin and RCP, and replace them with PKI-based access programs such as SSH. SSH does not send passwords in plain text format on the Internet, while Telnet and rlogin are the opposite. Hackers can find these passwords and access important servers on the network immediately. In addition, the. rHost and hosts. equiv files should be deleted on Unix. Because you do not need to guess the password, these files will provide logon access!

7. Restrict sharing of network files outside the firewall. This gives hackers the opportunity to intercept system files and replace them with a Trojan horse. The file transfer function will be paralyzed.

8. Make sure you have the latest network topology. This figure details TCP/IP addresses, hosts, routers, and other network devices. It also includes network boundaries, DMZ, and internal confidentiality of the network.

9. Run the port ing program or port scanning program on the firewall. Most events are caused by improper firewall configuration, which leads to a high success rate of DoS/DDoS attacks. Therefore, you must carefully check Privileged Ports and non-privileged ports.

10. Check logs of all network devices and host/server systems. As long as a log vulnerability or time changes, it is almost certain that the related host security is under threat.

11. Use DDoS device vendor Devices

It is estimated that you are a network administrator or a hardware firewall like Cisco or professional software.
Such as aoshield and Alibaba Cloud security to reduce DDoS attacks.

 

W3wp.exe high memory usage Solution

In IIS6, w3wp memory usage often fails to be released in time, resulting in slow server response. Because the memory release is not timely and seriously affects the normal operation of the server, we recommend that you use the following configuration, but consider the use of your own server. You can perform the following configurations: 1. configure a separate application pool for each website in IIS. That is, they do not affect each other. (The more process pools, the more memory occupied, because the memory resources will not be released immediately after the website is accessed .) 2. Set the recycle time of the application pool. The default value is 1720 hours, which can be modified as needed. At the same time, set the number of w3wp processes that run simultaneously to 1. Then, the memory is automatically reclaimed when the memory or CPU usage exceeds the limit. 3. Set a fixed time receiving process. For example, the number of visitors is relatively small between and, and the impact is very small. You can set the memory to be recycled every day during this time period, to reduce the impact of insufficient memory on the server. There is no limit on the number of times to set a fixed time in IIS6. You can set a time range for effective process pool resource recovery based on actual conditions, such as, and. In general, this can be solved. However, some websites cannot be correctly released due to program problems. So how can we find the website? 1. Add the PID field to the task manager. You can see the process PID with the highest memory usage or CPU usage. 2. Run iisapp-A at the command prompt. Note: the first running will prompt that no JS support is available. Click OK. Then run it again. In this way, we can see the application pool corresponding to the PID. 3. Check the website corresponding to the application pool in IIS.   Windows Server 2003wp.exe processes occupy a large amount of CPU resources. solution- At a.m. in the past few days, the server was always slow. After a remote connection, it was found that a w3wp.exe process occupied 100% CPU For every web application in Windows Server 2003, IIS uses an independent w3wp.exe To run it. W3wp.exe is also called a working process (each host header has one) It does not take effect to end the process directly in the task manager. It will be started shortly after the end. to end the process, you can In IIS, find the corresponding application pool to stop the corresponding application pool. These are not solutions. The fundamental problem is that your website program has a problem. before finding the problem, you can Open IIS and find the application pool. First, right-click the application pool and set "performance" to set the CPU to greater than 60%. Use the program pool to set the closing time and opening time to a shorter value, for example, 10 seconds. In this way, when your website programs occupy a large amount of space IIS automatically recycles the process and starts the process. Your Website will be ready for work now. You can right-click the application pool in IIS to create multiple applications. Pool, and then at the bottom of the file home option in each host header, the application pool corresponds to the application just created In the task manager to check which program occupies a large amount of resources. Below are some posts related to netizens that may be helpful to you. My friend's web server has been running normally, but the CPU usage has been nearly 100% in the past few days, so let's check it out. The server uses Windows 2003, and the website uses ASP + ACCESS database to view the process list and discover W3wp.exe occupies more than 70% of the CPU, When viewing web logs, the site traffic is low, and there are not many TCP connections. Use net stop W3SVC to stop the Web Server The CPU usage is normal immediately. Net start w3svc started the web and then appeared again soon. Stop all virtual machines It is no problem to create a virtual site to detect the site.CodeProblem. Check the homepage Code in the following structure: This section of code creates w3wp.exe that occupies a large amount of CPU. Is it an endless loop? Similar Almost no reason. Adding the count in the loop body indicates that it is an endless loop, indicating that Rs. EOF is always false. The following code: If Rs. EOF = true then response. Write "EOF is true" If Rs. EOF = false then response. Write "EOF is false" If the output is EOF is true EOF is false, the value of Rs. EOF cannot be determined, Why is it so puzzling. Check the database and find that there is no mytable table in the database. If this table does not exist, Rs. Open "select * From mytable", conn will have an error. Why is there no error? Exceptions that may be captured are ignored. Check the conn. asp file and find the exception handling code: On Error resume next The original problem is this. On Error resume next ignores Table query failures and subsequent errors, resulting in an endless loop. . Why can't I find the mytable table while the website is running normally? Check the website carefully to find that "there are customers I uploaded a backdoor tool and deleted multiple data tables from afar, which made me busy for a day. For more information, visit: Http://www.microsoft.com/china/technet/security/guidance/secmod93.mspx Find more detailed security settings Windows iis6.0 Solution In the past few days, the server has been running slowly. After remote failover, it is found that a w3wp.exe process occupies 100% of the CPU. There are two reasons for the problem: 1. The use of JET database connection problems: http://support.microsoft.com /? Id = 838306 Patch download: CHS: WindowsServer2003-KB838306-x86-chs.exe Enu: WindowsServer2003-KB838306-x86-enu.exe 2. Change the ACCESS database extension to ASP. The following is my error process and solution: The w3wp process is the application pool of iis6.0. There are two types: one is because ASP or Asp.net Code contains an endless loop. But there are so many websites on the server Who knows that the website is faulty. Second, due to the bug in the above jet connection to the database, download 838306 patch, or upgrade to SP1 can solve this problem, but after the patch, some websites ask Question still exists. Search again. It is said that each website has an independent application pool, and the security account of the application pool is set as this Local Service. The method is as follows: First, create an application pool: Then point the application pool of the website to the application pool just created: After all application pools are created, the attributes of the application pool are modified in a unified manner: Specify the application pool security account as a local service: After these settings, the problem still exists. Such a website may not affect other websites. Websites still occupy a large amount of resources, resulting in slow response from other websites. However, in the task manager Use the process of the program pool, so you can find the specific problematic process. The following is the process of searching for a website with errors: To locate the Website, you must link the problematic process with the application process of the website. The sequence pool is associated. First, set the view mode of the task manager and add the PID display: Then run iisapp-A on the command line to see the correspondence between the PID and the application pool: Go to IIS and check the website corresponding to the application pool. If there is a problem, the website will be found, and the rest will be the website generation. Code. As a website administrator, I can't stand it anymore. I want to help him find a mistake-countless times to configure IIS The website Program has also changed, and the upgrade has also been upgraded. the problem still exists. Let's see what's going on. When I tried to open his database, the problem occurred: His database is the extension of. asp. It must be changed to. mdb before it can be opened, but when I click to change the name My computer has no response ~! It seems that the problem lies in this database. After the command line rename is used, open the database and fix it. It seems that there is no problem, but when it is changed to. asp The problem just occurred. Ha ~ It turns out that the extension of. asp is strange. But I tried to change other databases to. asp. The root cause is unknown. please let us know. Finally, an ISAPI is added to IIS to correspond to mdb, causing MDB to fail to be executed. The. ASP database is changed back to. mdb to solve the problem. (Conversion) w3wp.exe process in Windows Server 2003occupies a lot of CPU resources. solution 1: using the Microsoft Jet Database Engine web application may stop responding to the load, resulting in false positives: Cause: this problem occurs because of a defect in the JET database engine. This problem only occurs on Microsoft Windows Server 2003. In Windows Server 2003, the COM + change frequency cofreeunusedlibraries function is called. This change causes frequent initialization of the jet driver. This behavior may cause deadlock conditions. This problem occurs most often when the web server loads. Patch download: CHS: WindowsServer2003-KB838306-x86-chs.exe Enu: WindowsServer2003-KB838306-x86-enu.exe In iis6, the memory and CPU usage of w3wp.exe cannot be released in time, resulting in slow server response. To solve the problem of excessive memory usage, you can configure the following: 1. configure a separate application pool for each website in IIS. That is, they do not affect each other. 2. Set the recycle time of the application pool. The default value is 1720 hours, which can be modified as needed. Then, when the memory usage exceeds 500 mb, the memory is automatically reclaimed. Solve the problem of excessive CPU usage: 1. configure a separate application pool for each website in IIS. That is, they do not affect each other. 2. Set the CPU monitoring of the application pool to no more than 25% (4 CPU for the server), refresh every minute, and close when the limit is exceeded. The app pool is obtained based on w3wp: 1. Add the PID field to the task manager. You can see the process PID with the highest memory usage or CPU usage. 2. Run iisapp-A at the command prompt. Note: the first running will prompt that no JS support is available. Click OK. Then run it again. In this way, you can see the application pool corresponding to the PID. (Iisapp is actually a vbs script stored in the c: \ windows \ system32 directory. Its full name is iisapp. vbs: If you and I are the same, and disable the default vbs associated program, you need to manually go to this directory, select the open method, and then select "Microsoft (r) run the Windows Based Script Host Command to obtain the correspondence between the PID and the application pool .) 3. Check the website corresponding to the application pool in IIS, and then make the above memory or CPU restrictions, or check whether the program has problems such as endless loops.   Quote: Environment: win2003server + IIS + ASP + MSSQL Phenomenon: Once a website is opened very slowly (sometimes several minutes, sometimes half an hour), or sometimes it times out to open the site. In this case, check the process on the server, the CPU usage reaches 100%, of which w3wp occupies 70 ~ 80%, SQL occupies 20 ~ 30%. Operations on all servers also become slow. Initial solution: log on to the server immediately to stop the w3wp process or restart the IIS Service. On average, the server is stored in the remote data center, all operations are remotely controlled, and sometimes remote connection cannot be performed. You can only call the Data Center Administrator to restart the server. This process causes constant complaints. After checking the information on the Internet, we found that most of these phenomena are caused by improper webpage code. The following situations may cause such phenomena: 1. application, seesion, and other Server caches are often used in the Code, resulting in excessive use of server data; 2. The Code has unreasonable syntax and endless loops; 3. database corruption, especially access database; 4. install too many third-party software or plug-ins, which conflict with the IIS or webpage function code. Phase 1 troubleshooting: Perform one-by-one analysis based on the referenced Materials 1. All site code on the server is written by the company's designers. It can be confirmed that the server cache syntax is not called too much (excluded) 2. Whether the Code has unreasonable syntax (uncertain) 3. Depending on the situation, when the IIS process usage increases, the SQL usage increases at the same time. It should be the SQL database site. Based on the phenomenon, the database or table should be normal. It is estimated that the data may be incorrect; (Not Sure) 4. In addition to basic system services, anti-virus protection, and essential services for website operations, the server does not have any third-party software, which is unlikely (excluded ). After the above analysis and judgment, the uncertain items are linked to the conclusion that an unreasonable syntax exists in the Web Page code of a website using SQL database, resulting in high CPU usage of IIS and SQL processes. Phase 2 troubleshooting: Determine the scope and continue to narrow down the scope. Because there are not many sites using SQL databases on the server, it is easy to establish an independent process ID for observation. All the sites using SQL databases are separately created in the IIS manager, then, enter the iisapp-a command on the CMD interface to view and record the ID of the processes in each IIS pool, an IIS process ID is the cause of this problem. 2003 the server uses the. NET program, and w3wp occupies CPU resources! What should I do?   W3wp.exe memory usage solution! Q: Memory: memory usage is very large. It reaches 1 GB. Why? Is there any way to avoid this situation? A: This is mainly because your asp. Net Program has memory leakage. For unmanaged resources, be sure to release them. -======================================== Q: My situation is as follows: 2 Xeon 2.8 GB memory 512 m scsi hard disks (soft images) configured on the server) Windows 2003 Now I am stuck with an Asp.net website with a low access volume, but one problem is that Every time the server runs for 2-3 days, it is very slow to visit the website. After restarting the server, it will be normal. View the memory usage of the process and find that the w3wp.exe and sqlservr.exe processes occupy the memory. The size of physical available memory reaches more than 170 MB (each), and almost no memory is used up. (The memory occupied during server restart is very small, only 40 MB per) In the past, when a website was mounted to a virtual machine, databases were separated. This never happened. Later, the original version was transplanted to the new server ~~ Another problem is that I found many SQL processes in the SQL Enterprise Manager. The process caused by. NET is sleeping, but the memory is occupied ~ Cannot be released I haven't solved this problem for a long time. For help ~~ Please kindly advise ~~ Thank you very much ~~~~~ Answer: IIS service manager ---- application pool ---- add your application and set the maximum memory. When the Program reaches the maximum memory, it will automatically restart. My problem is the same as yours, but my memory is 2 GB and the access traffic is high. Generally, I have to restart after 24 hours of operation, and the memory is not enough, w3wp processes account for one hundred and eight 90 MB, and SQL accounts for more than two hundred MB, You have to restart, or the whole site will be there .... 55555555. It's almost half a month. It's still not good. It's painful. W3wp.exe is your ASP. NET application host. If you use a large number of session, cache, and other resources, and the session supermarket takes a long time, the memory usage is relatively large. The application pool is a feature designed to increase performance, but it also consumes a lot of memory. In addition, turning off most services in Windows Server 2003 (which can be switched off without any need) can also save some memory 1. Suspect the cache applied in the program, 2. the cache contains a large amount of data. 3. Frequent cache refresh 4. No cache method is designed. I have met your problem before. I used to use sessions. After I changed them all to cook, it would be much better, it should be because of a problem with your session or your cache (the cache doesn't know much about it, but it should be somewhat true) Trace the SQL call records and record the time each time a large amount of data is written to the cache or session to check whether the time is too frequent. 1.The process of asp.netin win2003is w3wp.exe MB memory is enough for personal use, but it is not enough to put it on the server, especially win2003 + Asp.net + SQL Server. In particular, SQL Server is very memory-consuming. If it is not controlled, it will occupy all the physical memory (only a few MB is left for 100 MB ). Win2003 occupies around MB. There is nothing left. 3. to optimize the Asp.net program, I would like to say that there is little or no need to use session cache applications and other things, and whether there is a page flip, the page flip processing will also occupy a lot of memory. 4. Restrict SQL Memory. Enterprise Manager -- SQL attributes (generally local) -- "Memory" tag Here, let's look at the memory settings and change the maximum value to MB. Article 4 is the fastest way. You can try it. This problem also exists in one of my self-developed OA systems. To sum up, this is probably because of the improper use of sessions and cache. Many sessions and caches are used in my application, I found the "dynamic memory allocation" article in msdn. Today, I will explain whether it works. I hope some experienced friends can give me more information. You can also summarize the reasons for similar errors. Thank you !! I don't know what website you are. It is said that it will not occupy such a large amount. As shown above, you have used the cache to store excess content. Of course. Session-like objects are unlikely to occupy such a large amount of data, or some objects with a long time or permanent persistence similar to the application are used to save a large amount of data. For example, using a single instance to save data may result in a large amount of memory. Jianye 2003 system installation requires at least 1 GB of memory. W3wp.exe is an IIS process in 2003. As for the memory usage of SQL statements, it may be because your SQL statements do not set a memory usage limit.   -======================================== Who can help me with the memory and CPU usage of w3wp.exe processes ?? My computer: P4, M memory .. When I used the aspxsystem to build two websites, I found that the speed was extremely slow. In the process, I saw that w3wp.exe occupies the memory and CPU. The speed of registration for dozens of people at the beginning will not be affected, but after more than 100 registered members, when many people register at the same time, there will be a very slow speed, it is almost paralyzed. The settings in IIS are incorrect. In. net, do not limit the memory usage in IIS. Otherwise, IIS will continue to restart when the memory is insufficient. Every 30 s of startup is used to re-load the. NET package. Therefore, the website is very slow when loading the. NET package. This is also a problem I encountered when using the. NET system. Application pool -- properties -- recycle -- Memory recycle: reclaim worker processes when too much memory is consumed: 1. Maximum virtual memory. 2. Maximum memory used. Neither of the two options is selected Do not check it here. The other is the request queue in performance. Do not check it. I have experience in debugging and debugging, and I have also figured out my own method. A: knowledge about w3wp. EXE. Q: Relationship between w3wp. EXE, applications, and application pools A: An application pool can contain multiple applications. One application pool creates a w3wp. EXE process. therefore, we cannot simply say that a process pool corresponds to a w3wp. EXE process now! In fact, multiple application process pools correspond to a w3wp. EXE process. Q: How to start and close the w3wp. EXE process? A: The w3wp. EXE process will be started when you access the WWW application. Someone will ask: "I started a web application and found that the system automatically created a w3wp.exe process. After closing this webapplication, I found that the newly created w3wp.exe process is still running. How can I close this process. "This process will not be closed immediately after you close this program. this is because HTTP is a connectionless access. When you close a Web page, no corresponding close information is returned, so w3wp. the EXE process will not be closed because you have disabled the web application. Q: How can I close this process? A: In the application pool configuration, set the appropriate time in "Idle timeout". The default value is 20 minutes. if the specified time is set and the application is not accessed within the time range, the system will automatically disable w3wp. EXE process. without human intervention. you can also end this process in Windows Task Manager. Q: How to Make the w3wp. EXE process run for a long time. A: w3wp. the default life of the process exe is 1740 minutes, but it is still under this default natural law, w3wp. EXE will be shot by the system 20 minutes after unemployment. in this way, we can see that to make w3wp. if the EXE remains alive for a long time, we can achieve our goal through "Idle timeout" without processing. Q: In iis6, the memory and CPU usage of w3wp.exe cannot be released in time, resulting in slow server response. A: To solve the problem of excessive memory usage, perform the following Configuration: 1. configure a separate application pool for each website in IIS. That is, they do not affect each other. 2. Set the recycle time of the application pool. The default value is 1720 hours, which can be modified as needed. Then, when the memory usage exceeds 500 mb, the memory is automatically reclaimed. Solve the problem of excessive CPU usage: 1. configure a separate application pool for each website in IIS. That is, they do not affect each other. 2. Set the CPU monitoring of the application pool to no more than 25% (4 CPU for the server), refresh every minute, and close when the limit is exceeded. The app pool is obtained based on w3wp: 1. Add the PID field to the task manager. You can see the process PID with the highest memory usage or CPU usage. 2. Run iisapp-A at the command prompt. Note: the first running will prompt that no JS support is available. Click OK. Then run it again. In this way, you can see the application pool corresponding to the PID. (Iisapp is actually a vbs script stored in the c: \ windows \ system32 directory. Its full name is iisapp. vbs: if the default vbs associated program is disabled, You need to manually enter the directory, select the open mode, and then select "Microsoft (r) Windows Based Script Host" for execution, the relationship between the PID and the application pool can be obtained .) 3. Check the website corresponding to the application pool in IIS, and then make the above memory or CPU restrictions, or check whether the program has problems such as endless loops. A2: by mini dance Check that the CPU-consuming w3wp process contains the User call token. Q: The w3wp.exe problem occurs after a program is installed. A: Modify c: \ windows \ Microsoft. net \ framework \ v1.1.4322 \ config \ machine. config, configure the node <processmodel> with a property "memorylimit". The value of this property is a percentage. The default value is "60" (note that 60% is not 60 m ), ASP. net process can use 60% of all the physical memory, when ASP. net, IIS starts to automatically recycle the process, that is, create a new process to handle HTTP requests, and reclaim the memory occupied by the old process.