MOSS 2007 Attempted to read or write protected memory

Question

My production Sharepoint 2007 has been working well until the last weekend. Monday morning the users noticed http error 500 coming from the server. Looking into the application logs show hundreds of error event messages apparently related to corrupt memory. The following three error messages were repeated hundreds of times over the span of three days:

Event Source: Windows SharePoint Services 3 Event Category: Timer Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

Event Source: Windows SharePoint Services 3 Event Category: General The description for Event ID ( 27745 ) in Source ( Windows SharePoint Services 3 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: #50071: Unable to connect to the database PMDG_SharePoint_Config on DBCL2K5P3\DB53. Check the database connection information and make sure that the database server is running..

Event Source: Office SharePoint Server Event Category: Office Server Shared Services Message: Attempted to read or write protected memory. This is often an indication that other memory is corrupt. Techinal Support Details: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt. at System.DirectoryServices.Interop.UnsafeNativeMethods.IntADsOpenObject(String path, String userName, String password, Int32 flags, Guid& iid, Object& ppObject) at System.DirectoryServices.Interop.UnsafeNativeMethods.ADsOpenObject(String path, String userName, String password, Int32 flags, Guid& iid, Object& ppObject) at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) at System.DirectoryServices.DirectoryEntry.Bind() at System.DirectoryServices.DirectoryEntry.get_IsContainer() at System.DirectoryServices.DirectoryEntries.CheckIsContainer() at System.DirectoryServices.DirectoryEntries.Find(String name, String schemaClassName) at Microsoft.SharePoint.Metabase.MetabaseObjectCollection1.Find(String name) at Microsoft.SharePoint.Metabase.MetabaseObjectCollection1.get_Item(String name) at Microsoft.SharePoint.Administration.SPProvisioningAssistant.ProvisionIisApplicationPool(String name, ApplicationPoolIdentityType identityType, String userName, SecureString password, TimeSpan idleTimeout, TimeSpan periodicRestartTime) at Microsoft.SharePoint.Administration.SPMetabaseManager.ProvisionIisApplicationPool(String name, Int32 identityType, String userName, SecureString password, TimeSpan idleTimeout, TimeSpan periodicRestartTime) at Microsoft.Office.Server.Administration.SharedWebServiceInstance.CreateSharedWebServiceApplicationPool(SharedResourceProvider srp) at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)

I looked into the update history, and there were no changes in three months. This Sharpoint site collection has about six sites containing Silverlight 4.0 controls embedded in Web parts, which access a WCF service.

What is a likely cause of this?

Answer 1

I would start with the Timer Service (owstimer.exe).

I have heard of memory leaks with SharePoint Timer Jobs and also heard that it is a best practice to recycle the Timer Service on a scheduled interval.

The other possible problem is corruption with your IIS installation or Metabase. I say that because the error is being thrown when Directory Services tries to read the Metabase.

You should be able to get more details from the ULS log files. You may have to adjust the logging level for ULS.

Answer 2

Definitely try parsing ULS logs under %CommonProgramFiles%\Microsoft Shared\Web server extensions\12\LOGS.

The issue is apparently related to Application Pool provisioning process on your web server(s). Check the validity of application pool accounts and settings in IIS manager, review any changes to Group Policy Objects and Local Security Policy that could have taken place recently.

By the way, specifying your topology and configuration could be beneficial for the resolution of your issue.