写入转储文件时出现Procdump错误:0x80070005错误0x80070005(-2147024891):访问被拒绝

Question

最近,我们在尝试捕获2012 R2服务器上的各种IIS应用程序池的内存转储时遇到了问题.我已尝试使用任务管理器,但它会生成错误,以及在管理控制台中使用procdump:

PS C:\Users\_______\Downloads> procdump -mA 31016

ProcDump v7.1 - Writes process dump files
Copyright (C) 2009-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
With contributions from Andrew Richards

[19:59:22] Dump 1 initiated: C:\Users\____\Downloads\w3wp.exe_161008_195922.dmp
[19:59:25] Dump 1 writing: Estimated dump file size is 29278 MB.
[20:01:15] Dump 1 error: Error writing dump file: 0x80070005
Error 0x80070005 (-2147024891): Access is denied.

[20:01:15] Waiting for dump to complete...
[20:01:17] Dump count not reached.

我已经尝试了-ma和-mA以及-64和procdump64的各种组合,但是对于使用超过~16GB内存的工作进程,它们都具有相同的Access被拒绝错误.

我还尝试添加-r来反映/克隆该过程,如下所述:快速获取ASP.NET应用程序池的内存转储但仍然得到与上面相同的错误消息.

更新:因此,默认情况下,如果IIS应用程序池在90秒内未响应正在进行的内部ping请求,则它们将被回收.您可以在高级设置中看到此信息:

并且大约90秒后出现错误消息,因此可能是问题的原因.

Answer 1

所以正在发生的事情是procdump暂停工作进程,这会阻止它响应内部ping,即使使用-r reflect/clone选项也是如此.如果将内存写入转储文件的时间超过90秒,则IIS将回收该工作程序,从而导致旧进程终止.Procdump然后返回"拒绝访问"或"只有部分ReadProcessMemory或WriteProcessMemory请求已完成"错误消息,因为它尝试读取的内存不再被分配,并且该进程不再存在.

要解决此问题,您可以使用Resouce Monitor,Process Explorer或PsSuspend来暂停svchost.exe -k iissvcs进程,以便它不会中断procdump进程.可以在管理控制台中运行以下PowerShell脚本,以创建具有最大工作集的w3wp进程的内存转储:

#Prevent IIS from recycling the process during procdump and causing an Access Denied error message
$iispid = Get-Process svchost | ?{$_.modules.ModuleName -eq "iisw3adm.dll"} | Select -First 1 -ExpandProperty Id
$workerpid = Get-Process w3wp | Sort ws -Descending | Select -First 1 -ExpandProperty Id
cd ~\Downloads  #move to location where you want to save the dump files
#Add -accepteula to the sysinternals calls if you want to bypass the initial EULA prompt on new servers
& "c:\sysinternals\pssuspend.exe" $iispid 
Write-Output "Creating memory dump for w3wp PID $workerpid"
& "c:\sysinternals\procdump.exe" -ma $workerpid
& "c:\sysinternals\pssuspend.exe" $iispid -r

输出应该如下所示:

PS> & "\\dfshare\sysinternals\pssuspend.exe" $iispid

PsSuspend v1.06 - Process Suspender
Copyright ? 2001-2003 Mark Russinovich
Sysinternals

Process 49836 suspended.

PS> & "\\dfshare\sysinternals\procdump.exe" -ma 98340

ProcDump v8.2 - Sysinternals process dump utility
Copyright (C) 2009-2016 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com

[01:03:24] Dump 1 initiated: C:\Users\gbray\Downloads\w3wp.exe_161230_010324.dmp
[01:03:29] Dump 1 writing: Estimated dump file size is 19347 MB.
[01:05:14] Dump 1 complete: 19350 MB written in 109.8 seconds
[01:05:14] Dump count reached.

PS> & "\\dfshare\sysinternals\pssuspend.exe" $iispid -r

PsSuspend v1.06 - Process Suspender
Copyright ? 2001-2003 Mark Russinovich
Sysinternals

Process 49836 resumed.

我不知道暂停iissvcs进程可能会创建哪些其他问题,因此最好iisreset在创建内存转储后运行.