ASP.Net 网站收到大量请求，导致 IIS 工作进程崩溃
我正在两个服务器集群上运行一个相当大容量的 ASP.NET 网站。根据 ASP.Net Apps 性能对象的记录，典型负载约为每台服务器每秒 20 个请求。
一天中的某个特定时间，性能计数器会记录每秒 2,000 到 9,000 个请求。工作进程此时终止，并报告“.Net Runtime 2.0 Error Reporting”应用程序日志，其中列出了“Faulting application w3wp.exe”。
奇怪的是，IIS 此时没有记录任何突发请求。到目前为止，网络日志记录了正常的流量速度，并且没有显示数千个请求的突发。
服务器在 Windows 2003 64 位服务器上运行 IIS6。它是一款四核至强处理器，配备 6GB RAM。
负载平衡集群中的两台服务器中只有一台记录了这一请求量。另一台服务器显示的平均请求数不会超过每秒 20 个左右。
关于为什么性能日志会显示如此大量未记录在任何地方的请求，有什么想法吗？我无法确定是什么导致了这种负载，并且想知道这是否是某种应用程序错误，或者是否确实是流量突发。
对于如何追查罪魁祸首有什么建议吗？
I'm running a fairly high volume asp.net web site across a two serve cluster. Typical load is around 20 requests/second per server as logged by the ASP.Net Apps performance object.
At periodic times during the day the performance counter logs anywhere from 2,000 to 9,000 requests/second. The worker process dies at this time and reports a ".Net Runtime 2.0 Error Reporting" application log with "Faulting application w3wp.exe" listed.
What is strange is that IIS doesn't log any burst of requests at this time. The web logs record a normal pace of traffic up until this point, and show no burst of thousands of requests.
The server is running IIS6 on Windows 2003 64 bit Server. It is a quad core xeon with 6GB of RAM.
Only ONE of the two servers in the load balanced cluster record this volume of requests. The other server never shows more than the 20 or so average requests/second.
Any ideas as to why the performance log would show such a high volume of requests that aren't logged anywhere? I am not able to determine what is causing this load, and am wondering if it is an application error of some kind or if it is truly a burst of traffic.
Any suggestions for how to track down the culprit?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
使用调试工具 (Windbg & Co) 获取 ASP 进程的故障转储。
请查看 http://blogs.msdn.com/tess。
Get a crashdump of your asp process using Debugging Tools (Windbg & Co).
Check out http://blogs.msdn.com/tess.
使用 WinDbg 查看故障转储后，发现这是由递归 Server.Transfer 产生堆栈溢出引起的。
显然，显示 ASP.Net Apps v2.0.50727 的请求/秒的性能日志将服务器传输记录为新请求。但由于它没有执行客户端重定向，因此永远不会像 DOS 攻击那样出现在 IIS 日志中。
日志显示每秒请求数很高这一事实让我认为这不是应用程序错误。
感谢您的所有建议。
After using WinDbg to view a crash dump, it turned out this was caused by a recursive Server.Transfer producing a stack overflow.
Apparently the performance log that shows the the Requests/Sec for ASP.Net Apps v2.0.50727 records a server transfer as a new request. But since it is not doing a client redirect it never shows up in the IIS logs like a DOS attack probably would.
The fact that the log showed high requests/sec made me think it was not an application error.
Thanks for all your suggestions.
老实说，这听起来像是潜在的 DoS 攻击。您可以在路由器/交换机上启用日志来查看通过的原始以太网帧吗？让我知道。谢谢。
-肖恩
Honestly, it sounds like a potential DoS attack. Can you enable a log on your router/switch to see the raw ethernet frames coming through? Let me know. Thanks.
-Shaun