How to use the IIS Debug Diagnostics tool to troubleshoot a memory leak in an IIS process

A memory leak may occur in Microsoft Internet Information Services (IIS) when an IIS process consumes excessive memory. Inetinfo.exe, Dllhost.exe, and W3wp.exe are examples of IIS processes. IIS caches static content and dynamic content. An IIS process normally uses up to 50 percent of the available physical memory. This memory usage metric pertains to each IIS process, not to a total of all IIS processes. You can use this information and Performance Monitor to identify a memory problem.

Additionally, the following symptoms may occur when an IIS process consumes excessive memory:

• In Windows Task Manager, the Mem Usage column indicates that the process consumes excessive memory.
• In Performance Monitor, the difference increases between the Private Bytes counter and the Virtual Bytes counter of the Process object.
• In IIS 6.0, an IIS process uses up to 1.3 gigabytes (GB) of virtual memory. If memory recycling is enabled, an event is logged that resembles the following:

  Event Type: Information
  Event Source: W3SVC
  Event Category: None
  Event ID: 1077
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  A worker process with process id of '1234' serving application pool 'DefaultAppPool' has requested a recycle because it reached its virtual memory limit.

• If memory recycling is not enabled, an IIS process uses up to 1.3 GB of virtual memory and eventually stops responding. Then, an event is logged that resembles the following:

  Event Type: Warning
  Event Source: W3SVC
  Event Category: None
  Event ID: 1009
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '1234'. The process exit code was '0xc0000005'.
  
  For more information, see Help and Support Center at http://support.microsoft.com.

• In IIS 5.0, an IIS process uses up to 1.3 GB of virtual memory and eventually stops responding. Then, an event is logged that resembles the following:

  Event Type: Error
  Event Source: Service Control Manager
  Event Category: None
  Event ID: 7031
  Date: Date
  Time: Time
  User: N/A
  Computer: ComputerName
  Description:
  The IIS Admin Service service terminated unexpectedly. It has done this 7 time(s). The following corrective action will be taken in 0 milliseconds: No action.
  
  For more information, see Help and Support Center at http://support.microsoft.com.

When an IIS process consumes excessive memory, use the IIS Debug Diagnostics tool to troubleshoot the outstanding memory allocations that caused the memory leak. You have to insert the LeakTrack.dll file and then monitor for the memory leak. As soon as the leak is reproduced, a memory dump file is generated. The memory dump file contains the memory leak information.

To use the IIS Debug Diagnostics tool to troubleshoot an IIS process that consumes excessive memory, follow these steps.

Step 1: Download and install the IIS Diagnostics Toolkit

The following files are available for download from the Microsoft Download Center:

IIS Diagnostics Toolkit for 32-bit systems

Download the iisdiag.msi package now. (http://www.microsoft.com/downloads/details.aspx?FamilyID=28bd5941-c458-46f1-b24d-f60151d875a3&DisplayLang=en)

IIS Diagnostics Toolkit for Itanium-based systems

Download the iisdiag.msi package now. (http://www.microsoft.com/downloads/details.aspx?FamilyID=13c1c5e5-592c-45bc-b5bb-c486b43eb539&DisplayLang=en)

Step 2: Set up performance logging before the memory leak occurs

1. Click Start, point to Programs, point to IIS Diagnostics, point to Debug Diagnostics Tool, and then click Debug Diagnostics Tools 1.1.
2. Click Tools, and then click Options And Settings.
3. Click the Performance Log tab, click Enable Performance Counter Data Logging, and then click OK.

Note The data sampling interval and the time to start monitoring depend on when the memory leak is reproduced. Because of the log size, make sure that you work with support professionals to obtain the information that you need without overwhelming the server.

Step 3: Create a "Memory and Handle Leak" rule

1. Click Start, point to Programs, point to IIS Diagnostics, point to Debug Diagnostics Tool, and then click Debug Diagnostics Tools 1.1.
2. On the Rules tab, click Add Rule.
3. Click Memory and Handle Leak, and then click Next.
4. Select the process that has the memory leak, and then click Next.
5. In the Configure Tracking Duration dialog box, type or select a warm-up time in the Warm-Up time box.
   
   Note If the problem is immediately reproduced, click to select the Start memory tracking immediately when rule is activated check box.
6. In the Tracking Time box, type or select the time that is required to reproduce the problem. Make sure that the Auto-create a crash rule to get userdump on unexpected process exit check box is selected.
   
   Note At the end of the specified time, a dump file is created.
7. Click Next, and then click Finish.

Step 4: Obtain the data manually

1. Click Start, point to Programs, point to IIS Diagnostics, point to Debug Diagnostics Tool, and then click Debug Diagnostics Tools 1.1.
2. Click the Processes tab, right-click the process that you want, and then click Monitor For Leaks.
3. When the leak is reproduced, right-click the process from step 4b, and then click Create Full Userdump.

Note Notice that the status is Active. Additionally, the Userdump Count counter value increases every time that a memory dump file is created.

Step 5: Stop performance logging after the memory dump file is finished

1. Click Start, point to Programs, point to IIS Diagnostics, point to Debug Diagnostics Tool, and then click Debug Diagnostics Tools 1.1.
2. Click Tools, and then click Options And Settings.
3. Click the Performance Log tab, click Disable Performance Counter Data Logging, and then click OK.

Step 6: Analyze the memory dump file

Step 7: If you are using custom .dll files, add the "Symbol Search Path For Analysis" path or the "Symbol Search Path for Debugging" path

1. Click Tools, and then click Options And Settings.
2. In the Symbol Search Path For Analysis box or in the Symbol Search Path for Debugging box, type the appropriate path, and then click OK.