windows-server-2008-r2 – 应用程序事件日志不断损坏

我最近问过 repairing a corrupt event log,因为它似乎是一次性事件.此后,事件日志表现出相同的行为3次.我们一直在努力寻找模式,但到目前为止我们一无所获.服务器运行多个ASP.NET应用程序和三个用.NET编写的计划任务.事件日志的上次修改日期恰好与其中一个计划任务同时发生,但其他任务未执行.

有关在哪里查看下一步的建议或我们可以从损坏的evtx文件中获取任何信息的方法？

服务器正在运行关键的电子商务应用程序,因此我们希望将所需的重新启动次数保持在最低限度.

编辑：我跑了DUMPEL并得到了非常奇怪的结果.

1/9/2012    4:14:05 PM  1   100 1000    Application Error       N/A SERVERNAME  Faulting application name: w3wp.exe,version: 7.5.7601.17514,time stamp: 0x4ce7a5f8  Faulting module name: ntdll.dll,version: 6.1.7601.17514,time stamp: 0x4ce7ba58  Exception code: 0xc0000374  Fault offset: 0x000ce653  Faulting process id: 0x1070  Faulting application start time: 0x01cccf1386d30991  Faulting application path: C:WindowsSysWOW64inetsrvw3wp.exe  Faulting module path: C:WindowsSysWOW64ntdll.dll  Report Id: dbf4f691-3b06-11e1-9025-005056a602e6  
1/9/2012    4:14:07 PM  4   0   1001    Windows Error Reporting N/A SERVERNAME  Fault bucket,type 0  Event Name: APPCRASH  Response: Not available  Cab Id: 0    Problem signature:  P1: w3wp.exe  P2: 7.5.7601.17514  P3: 4ce7a5f8  P4: StackHash_79d9  P5: 6.1.7601.17514  P6: 4ce7ba58  P7: c0000374  P8: 000ce653  P9:   P10:     Attached files:  C:WindowsTempWER975.tmp.appcompat.txt  C:WindowsTempWERA03.tmp.WERInternalMetadata.xml  C:WindowsTempWERA13.tmp.hdmp  C:WindowsTempWERD21.tmp.mdmp    These files may be available here:  C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_cd7d09dfc84119d82a2ac6a789038bd5661acfb_cab_128f0e67    Analysis symbol:   Rechecking for solution: 0  Report Id: dbf4f691-3b06-11e1-9025-005056a602e6  Report Status: 4  
1/9/2012    4:14:07 PM  4   0   1001    Windows Error Reporting N/A SERVERNAME  Fault bucket,type 0  Event Name: APPCRASH  Response: Not available  Cab Id: 0    Problem signature:  P1: w3wp.exe  P2: 7.5.7601.17514  P3: 4ce7a5f8  P4: StackHash_79d9  P5: 6.1.7601.17514  P6: 4ce7ba58  P7: c0000374  P8: 000ce653  P9:   P10:     Attached files:  C:WindowsTempWER975.tmp.appcompat.txt  C:WindowsTempWERA03.tmp.WERInternalMetadata.xml  C:WindowsTempWERA13.tmp.hdmp  C:WindowsTempWERD21.tmp.mdmp    These files may be available here:  C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_cd7d09dfc84119d82a2ac6a789038bd5661acfb_cab_128f0e67    Analysis symbol:   Rechecking for solution: 0  Report Id: dbf4f691-3b06-11e1-9025-005056a602e6  Report Status: 0  
1/9/2012    4:14:12 PM  1   100 1000    Application Error       N/A SERVERNAME  Faulting application name: w3wp.exe,time stamp: 0x4ce7ba58  Exception code: 0xc0000374  Fault offset: 0x000ce653  Faulting process id: 0x16ac  Faulting application start time: 0x01cccf139f475c0c  Faulting application path: C:WindowsSysWOW64inetsrvw3wp.exe  Faulting module path: C:WindowsSysWOW64ntdll.dll  Report Id: e03bae70-3b06-11e1-9025-005056a602e6  
1/9/2012    4:14:16 PM  4   0   1001    Windows Error Reporting N/A SERVERNAME  Fault bucket,type 0  Event Name: APPCRASH  Response: Not available  Cab Id: 0    Problem signature:  P1: w3wp.exe  P2: 7.5.7601.17514  P3: 4ce7a5f8  P4: StackHash_9c6c  P5: 6.1.7601.17514  P6: 4ce7ba58  P7: c0000374  P8: 000ce653  P9:   P10:     Attached files:  C:WindowsTempWER2579.tmp.appcompat.txt  C:WindowsTempWER25F7.tmp.WERInternalMetadata.xml  C:WindowsTempWER25F8.tmp.hdmp  C:WindowsTempWER28F6.tmp.mdmp    These files may be available here:  C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_c49a67649524ad11b64bbf809211bc5ba742a3d6_cab_0b63321b    Analysis symbol:   Rechecking for solution: 0  Report Id: e03bae70-3b06-11e1-9025-005056a602e6  Report Status: 4  
1/9/2012    4:14:16 PM  4   0   1001    Windows Error Reporting N/A SERVERNAME  Fault bucket,type 0  Event Name: APPCRASH  Response: Not available  Cab Id: 0    Problem signature:  P1: w3wp.exe  P2: 7.5.7601.17514  P3: 4ce7a5f8  P4: StackHash_9c6c  P5: 6.1.7601.17514  P6: 4ce7ba58  P7: c0000374  P8: 000ce653  P9:   P10:     Attached files:  C:WindowsTempWER2579.tmp.appcompat.txt  C:WindowsTempWER25F7.tmp.WERInternalMetadata.xml  C:WindowsTempWER25F8.tmp.hdmp  C:WindowsTempWER28F6.tmp.mdmp    These files may be available here:  C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_c49a67649524ad11b64bbf809211bc5ba742a3d6_cab_0b63321b    Analysis symbol:   Rechecking for solution: 0  Report Id: e03bae70-3b06-11e1-9025-005056a602e6  Report Status: 0  
1/9/2012    4:14:21 PM  1   100 1000    Application Error       N/A SERVERNAME  Faulting application name: w3wp.exe,time stamp: 0x4ce7ba58  Exception code: 0xc0000374  Fault offset: 0x000ce653  Faulting process id: 0x17f8  Faulting application start time: 0x01cccf13a4ba5126  Faulting application path: C:WindowsSysWOW64inetsrvw3wp.exe  Faulting module path: C:WindowsSysWOW64ntdll.dll  Report Id: e57a0a85-3b06-11e1-9025-005056a602e6  
1/9/2012    4:14:21 PM  4   0   1001    Windows Error Reporting N/A SERVERNAME  Fault bucket,type 0  Event Name: APPCRASH  Response: Not available  Cab Id: 0    Problem signature:  P1: w3wp.exe  P2: 7.5.7601.17514  P3: 4ce7a5f8  P4: StackHash_9c6c  P5: 6.1.7601.17514  P6: 4ce7ba58  P7: c0000374  P8: 000ce653  P9:   P10:     Attached files:    These files may be available here:  C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_c49a67649524ad11b64bbf809211bc5ba742a3d6_1cfb4872    Analysis symbol:   Rechecking for solution: 0  Report Id: e57a0a85-3b06-11e1-9025-005056a602e6  Report Status: 4  
1/9/2012    4:14:21 PM  4   0   1001    Windows Error Reporting N/A SERVERNAME  Fault bucket,type 0  Event Name: APPCRASH  Response: Not available  Cab Id: 0    Problem signature:  P1: w3wp.exe  P2: 7.5.7601.17514  P3: 4ce7a5f8  P4: StackHash_9c6c  P5: 6.1.7601.17514  P6: 4ce7ba58  P7: c0000374  P8: 000ce653  P9:   P10:     Attached files:    These files may be available here:  C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_c49a67649524ad11b64bbf809211bc5ba742a3d6_1cfb4872    Analysis symbol:   Rechecking for solution: 0  Report Id: e57a0a85-3b06-11e1-9025-005056a602e6  Report Status: 0

所引用的文件实际上都不存在(甚至在WER ReportArchive中也不存在).这些不应该是提到的唯一事件.自1月9日以来,日志文件已被清除两次,因此甚至根本不应列出这些事件.

（编辑：济南站长网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!