Good afternoon, colleagues.

There is a physical server on Win 2008 R2 + IIS 7.5, several sites are spinning on it. Previously, it worked like a clock, no problems were observed, but the last days, almost every day, in the morning hours (around 6-7 am), the IIS server hangs and refuses to respond to requests. Judging by the monitoring services and the responses through the browser from the server, there is simply no answer - a typical Timeout (on ALL sites). This lasts from two to eight minutes, then the work is fully restored. During the IIS timeout, you can easily access the server via RDP - at this time there is NOT any non-standard load - the processors are loaded at 10-15%.

I rummaged through all the Windows logs in EventViewer - there is absolutely no information there. The only thing that at the time of recovery records appear for some sites like

Exception information: Exception type: HttpException Exception message: The remote host closed the connection. The error code is 0x800704CD. at System.Web.Hosting.IIS7WorkerRequest.RaiseCommunicationError(Int32 result, Boolean throwOnDisconnect) at System.Web.Hosting.IIS7WorkerRequest.ExplicitFlush() at System.Web.HttpResponse.Flush(Boolean finalFlush, Boolean async)

but this, apparently, is due to the fact that some customers get tired of waiting and they break the connection.

In the logs of IIS for sites in the period of inactivity, a hole is found - there is not a single entry while IIS is hanging. So, for example, for 06:24 more than 200 records, then the idle period - not a single record and immediately records already for 06:31.

What do you think it could be, in which direction to dig? Thank.

Closed due to the fact that the essence of the question is not clear to the party PashaPash ♦ 2 Apr '16 at 10:51 .

Try to write more detailed questions. To get an answer, explain what exactly you see the problem, how to reproduce it, what you want to get as a result, etc. Give an example that clearly demonstrates the problem. If the question can be reformulated according to the rules set out in the certificate , edit it .

  • I suppose some bot scanning sends requests from which the server choke. On my apache, almost every day I see all sorts of strange requests, sometimes the system detects them as exploits. - dsnk
  • But then, in theory, the entire server would choke and would not allow access via RDP, and the CPU load would be visible. But there is nothing of that - the processor load is low, the RDP connection goes through. - user3057980
  • Not necessarily, the HTTP service lives its own life, and the exploit may temporarily fail to enter the service, without necessarily loading the processor. It is necessary to study the logs of the service. - dsnk 3:49
  • It is worth looking at the list of requests in IIS Manager / Worker Processes / Current Requests - are there any pending requests waiting for something? It may be connected by a debugger ( support.microsoft.com/en-us/kb/919790 ), take a dump and see what IIS is doing there at this time. - PashaPash ♦

0