写入转储文件时出现Procdump错误：0x80070005错误0x80070005（-2147024891）：访问被拒绝 [英] Procdump Error writing dump file: 0x80070005 Error 0x80070005 (-2147024891): Access is denied

问题描述

最近，我们在尝试捕获2012 R2服务器上各种IIS应用程序池的内存转储时遇到了问题。我尝试过使用任务管理器，但它会产生错误，并在管理控制台中使用procdump：

  PS C ：\Users\ _______ \Downloads> procdump -mA 31016 
 
 ProcDump v7.1  - 写入进程转储文件
版权所有（C）2009-2014 Mark Russinovich 
 Sysinternals  -  www.sysinternals.com 
随附来自Andrew Richards的捐款
 
 [19:59:22]转储1已启动：C：\ Users \ ____ \Downloads\w3wp.exe_161008_195922.dmp 
 [19:59：转储1写：估计转储文件大小为29278 MB。 
 [20:01:15]转储1错误：写入转储文件时出错：0x80070005 
错误0x80070005（-2147024891）：访问被拒绝。 
 
 [20:01:15]等待转储完成... 
 [20:01:17]未达到转储计数。 
  

我尝试了-ma和-mA以及-64和procdump64的各种组合，但它们都有对于使用超过~16GB内存的工作进程，访问被拒绝错误。

我还尝试添加-r以按照

大约90秒后出现错误消息，很可能是问题的原因。

解决方案

那又怎样正在发生的是procdump挂起工作进程，阻止它响应内部ping，即使使用-r reflect / clone选项也是如此。如果将内存写入转储文件的时间超过90秒，则IIS将回收该工作程序，从而导致旧进程终止。 Procdump然后返回拒绝访问或只有部分ReadProcessMemory或WriteProcessMemory请求已完成错误消息，因为它尝试读取的内存不再被分配，并且该过程不再存在。

要解决此问题，您可以使用 Resouce Monitor ， Process Explorer 或 PsSuspend 也暂停 svchost.exe -k iissvcs 进程，以便它不能中断procdump过程。可以在管理控制台中运行以下PowerShell脚本，以创建具有最大工作集的w3wp进程的内存转储：

  #Prevent IIS在procdump期间回收进程并导致Access Denied错误消息
 $ iispid = Get-Process svchost | ？{$ _。modules.ModuleName -eqiisw3adm.dll} |选择-First 1 -ExpandProperty Id 
 $ workerpid = Get-Process w3wp |排序ws -Descending |选择-First 1 -ExpandProperty Id 
 cd~ \Downloads #move到你要保存转储文件的位置
 #Add -accepteula到sysinternals调用如果你想绕过最初的EULA提示新服务器
& c：\ sysinternals\pssuspend.exe$ iispid 
写入输出为w3wp PID $ workerpid创建内存转储
& c：\ sysinternals\procdump.exe-ma $ workerpid 
& c：\ ssininternals\pssuspend.exe$ iispid -r 
  

输出应该看起来像什么像这样：

  PS> &安培; \\\\\dfshare\sysinternals\pssuspend.exe$ iispid 
 
 PsSuspend v1.06  -  Process Suspender 
版权所有⌐2001-2003Mark Russinovich 
 Sysinternals 
 
流程49836暂停。 
 
 PS> &安培; \\\dfshare\sysinternals\procdump.exe-ma 98340 
 
 ProcDump v8.2  -  Sysinternals进程转储实用程序
版权所有（C）2009-2016 Mark Russinovich和Andrew Richards 
 Sysinternals  -  www.sysinternals.com 
 
 [01:03:24]转储1已启动：C：\ Users \gbray \Downloads\w3wp.exe_161230_010324.dmp 
 [01:03:29]转储1写入：估计转储文件大小为19347 MB​​。 
 [01:05:14]转储1完成：19350 MB写入109.8秒
 [01:05:14]转储计数达到。 
 
 PS> &安培; \\\\\dfshare\sysinternals\pssuspend.exe$ iispid -r 
 
 PsSuspend v1.06  -  Process Suspender 
版权所有⌐2001-2003Mark Russinovich 
 Sysinternals 
 
流程49836已恢复。 
  

我不知道暂停iissvcs进程可能会创建哪些其他问题，因此最好运行创建内存转储后， iisreset 。

Recently we have had issues when trying to capture a memory dump for various IIS application pools on a 2012 R2 server. I've tried using task manager, but it generates an error, as well as using procdump in an Administrative console:

PS C:\Users\_______\Downloads> procdump -mA 31016

ProcDump v7.1 - Writes process dump files
Copyright (C) 2009-2014 Mark Russinovich
Sysinternals - www.sysinternals.com
With contributions from Andrew Richards

[19:59:22] Dump 1 initiated: C:\Users\____\Downloads\w3wp.exe_161008_195922.dmp
[19:59:25] Dump 1 writing: Estimated dump file size is 29278 MB.
[20:01:15] Dump 1 error: Error writing dump file: 0x80070005
Error 0x80070005 (-2147024891): Access is denied.

[20:01:15] Waiting for dump to complete...
[20:01:17] Dump count not reached.

I have tried various combinations of -ma and -mA and -64 and procdump64 but they all have the same Access is denied error for worker processes using over ~16GB of memory.

I also tried adding -r to reflect/clone the process as recommended by How to: Take a Memory Dump of an ASP.NET Application Pool Quickly but still get the same error message as above.

Update: So by default IIS application pools will be recycled if they do not respond to ongoing internal ping requests within 90 seconds. You can see this in the advanced settings:

And the error message occurs after about 90 seconds, so likely that is the cause of the issue.

解决方案

So what is happening is procdump suspends the worker process which prevents it from responding to the internal pings, even when using the -r reflect/clone option. And if writing the memory to the dump file takes longer than 90 seconds then IIS will recycle the worker, causing the old process to be terminated. Procdump then returns an "Access Denied" or "Only part of a ReadProcessMemory or WriteProcessMemory request was completed" error message, because the memory it was trying to read is no longer allocated and the process no longer exists.

To work around this issue you can use Resouce Monitor, Process Explorer or PsSuspend to also suspend the svchost.exe -k iissvcs process so that it cannot interrupt the procdump process. The following PowerShell script can be run in an Admin console to create a memory dump of the w3wp process with the largest working set:

#Prevent IIS from recycling the process during procdump and causing an Access Denied error message
$iispid = Get-Process svchost | ?{$_.modules.ModuleName -eq "iisw3adm.dll"} | Select -First 1 -ExpandProperty Id
$workerpid = Get-Process w3wp | Sort ws -Descending | Select -First 1 -ExpandProperty Id
cd ~\Downloads  #move to location where you want to save the dump files
#Add -accepteula to the sysinternals calls if you want to bypass the initial EULA prompt on new servers
& "c:\sysinternals\pssuspend.exe" $iispid 
Write-Output "Creating memory dump for w3wp PID $workerpid"
& "c:\sysinternals\procdump.exe" -ma $workerpid
& "c:\sysinternals\pssuspend.exe" $iispid -r

The output should look something like this:

PS> & "\\dfshare\sysinternals\pssuspend.exe" $iispid

PsSuspend v1.06 - Process Suspender
Copyright ⌐ 2001-2003 Mark Russinovich
Sysinternals

Process 49836 suspended.

PS> & "\\dfshare\sysinternals\procdump.exe" -ma 98340

ProcDump v8.2 - Sysinternals process dump utility
Copyright (C) 2009-2016 Mark Russinovich and Andrew Richards
Sysinternals - www.sysinternals.com

[01:03:24] Dump 1 initiated: C:\Users\gbray\Downloads\w3wp.exe_161230_010324.dmp
[01:03:29] Dump 1 writing: Estimated dump file size is 19347 MB.
[01:05:14] Dump 1 complete: 19350 MB written in 109.8 seconds
[01:05:14] Dump count reached.

PS> & "\\dfshare\sysinternals\pssuspend.exe" $iispid -r

PsSuspend v1.06 - Process Suspender
Copyright ⌐ 2001-2003 Mark Russinovich
Sysinternals

Process 49836 resumed.

I have no idea what other issues suspending the iissvcs process might create, so it may be best to run iisreset after the memory dump is created.

这篇关于写入转储文件时出现Procdump错误：0x80070005错误0x80070005（-2147024891）：访问被拒绝的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！