| Event Id | 5009 |
| Source | Microsoft-Windows-WAS |
| Description | A process serving application pool '%1' terminated unexpectedly. The process id was '%2'. The process exit code was '0x%3'. |
| Event Information | According to Microsoft : Cause : This event is logged when process serving application pool terminated unexpectedly. Resolution : Diagnose a worker process crash Possible resolutions include the following: Use the Debug Diagnostics tool to determine the cause of the crash. Examine the event log message details for an error number that can provide additional information about the cause of the error. This error number will be different from the Event ID. Use the Debug Diagnostics tool To use the Debug Diagnostics tool: See the article How to use the Debug Diagnostics tool to troubleshoot an IIS process that stops unexpectedly. To perform the following procedures, you must have membership in Administrators , or you must have been delegated the appropriate authority. Examine the event log message details for an error number To examine the event log message details for an error number that can provide additional information: 1.In the Event Viewer , select the event that you received. 2.Click the Details tab, then Friendly View . 3. If a specific error number is available, the words Binary data : should appear. 4.Below In Words , note the number after the colon. Learn more about a specific error number To learn more about a specific error number: 1.Download the Err.exe utility from the Microsoft Exchange Server Error Code Look-up page. 2.Open an elevated Command Prompt window. Click Start , point to All Programs , click Accessories , right-click Command Prompt , and then click Run as administrator . 3.At the command prompt, navigate to the directory where you downloaded Err.exe. 4.Type err errornumber to obtain more information about the error. 5.The error resolves to ERROR_ACCESS_DENIED, so your next step would be to check for a permissions issue. Verify : To perform this procedure, you must have membership in Administrators , or you must have been delegated the appropriate authority. To verify that an application pool has started: 1.Click Start , click Control Panel , and then click Administrative Tools . 2.Right-click Internet Information Services (IIS) Manager and select Run as administrator . 3.In the Connections pane, expand the server node and select Application Pools . 4.In Features View , the Status column for the application pool will indicate Started if the application pool has started. |
| Reference Links | Event ID 5009 from Microsoft-Windows-WAS |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.