Could aspnet_wp.exe recycle be due to hackers?

[ringo]

Hi all, I have a couple of Win2000 servers running IIS and an asp.NET web application, and have seen sporadic errors in the event logs:

aspnet_wp.exe (PID:PIDNumber) was recycled because memory consumption exceeded the SizeLimit MB (Percentage percent of available RAM)

The app I'm running doesn't deal with anything even approaching large amounts of data (there's a datagrid which displays a max 13x6 grid, all fields less than 50 characters), and does not upload files. The errors seem to come at random times, whether or not there is activity in the app (I know this because I log all user operations to a SQL Server database). I have been running performance logs on the machine, and noticed a huge spike for 'ASP.NET APPS v 1.1.4xxx' Requests/sec right before the crashes.
I'm wondering if anyone has seen this before, and if the cause could be some type of DOS or similar attack on the server... and if so, what can I do to stop it? Any experiences/advice is appreciated,
-Ringo

[Kevin Spencer]

Check your web server logs. If you're under attack, it should show up there.

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
Big things are made up
of lots of little things.

"ringo" <rgp@ringosoft*NoSpam*.com> wrote in message
news:i3ANb.230089$Vu5.17002810@twister.southeast.r r.com...

> Hi all, I have a couple of Win2000 servers running IIS and an asp.NET

web application, and have seen sporadic errors in the event logs:

>
> aspnet_wp.exe (PID:PIDNumber) was recycled because memory consumption

exceeded the SizeLimit MB (Percentage percent of available RAM)

>
> The app I'm running doesn't deal with anything even approaching large

amounts of data (there's a datagrid which displays a max 13x6 grid, all
fields less than 50 characters), and does not upload files. The errors seem
to come at random times, whether or not there is activity in the app (I know
this because I log all user operations to a SQL Server database). I have
been running performance logs on the machine, and noticed a huge spike for
'ASP.NET APPS v 1.1.4xxx' Requests/sec right before the crashes.

> I'm wondering if anyone has seen this before, and if the cause could be

some type of DOS or similar attack on the server... and if so, what can I do
to stop it? Any experiences/advice is appreciated,

> -Ringo
>

[Alvin Bruney]

well you have a couple of issues here the first being that this is iis5 so
all process as spawned inside aspnet worker process so memory adds up on a
per process basis. The other thing is that if you are returning large
datasets and not cleaning them out, they will build up in the worker process
eventually causing it to recycle. You need to monitor your memory
consumption a bit more closely.

I wouldn't rule out an attack either but it just seems a lot less likely
from where i sit.
--
Regards,
Alvin Bruney
Got tidbits? Get it here...
[url]http://tinyurl.com/3he3b[/url]
"ringo" <rgp@ringosoft*NoSpam*.com> wrote in message
news:i3ANb.230089$Vu5.17002810@twister.southeast.r r.com...

> Hi all, I have a couple of Win2000 servers running IIS and an asp.NET

web application, and have seen sporadic errors in the event logs:

>
> aspnet_wp.exe (PID:PIDNumber) was recycled because memory consumption

exceeded the SizeLimit MB (Percentage percent of available RAM)

>
> The app I'm running doesn't deal with anything even approaching large

amounts of data (there's a datagrid which displays a max 13x6 grid, all
fields less than 50 characters), and does not upload files. The errors seem
to come at random times, whether or not there is activity in the app (I know
this because I log all user operations to a SQL Server database). I have
been running performance logs on the machine, and noticed a huge spike for
'ASP.NET APPS v 1.1.4xxx' Requests/sec right before the crashes.

> I'm wondering if anyone has seen this before, and if the cause could be

some type of DOS or similar attack on the server... and if so, what can I do
to stop it? Any experiences/advice is appreciated,

> -Ringo
>

[parley]

ringo <rgp@ringosoft*NoSpam*.com> wrote in message news:<i3ANb.230089$Vu5.17002810@twister.southeast. rr.com>...

> Hi all, I have a couple of Win2000 servers running IIS and an asp.NET web application, and have seen sporadic errors in the event logs:
>
> aspnet_wp.exe (PID:PIDNumber) was recycled because memory consumption exceeded the SizeLimit MB (Percentage percent of available RAM)
>
> The app I'm running doesn't deal with anything even approaching

large amounts of data (there's a datagrid which displays a max 13x6
grid, all fields less than 50 characters), and does not upload files.
The errors seem to come at random times, whether or not there is
activity in the app (I know this because I log all user operations to
a SQL Server database). I have been running performance logs on the
machine, and noticed a huge spike for 'ASP.NET APPS v 1.1.4xxx'
Requests/sec right before the crashes.

> I'm wondering if anyone has seen this before, and if the cause could be some type of DOS or similar attack on the server... and if so, what can I do to stop it? Any experiences/advice is appreciated,
> -Ringo

Listen to yourself: "My program is slow and there are other problems:
someone must be hacking into my system."

The very existence of this software antipattern indicates that you
will never ever be a decent programmer and that you _may_ be
delusional. A real programmer would search his own code for errors for
_hours_ before looking elesewhere; after that a good programmer would
look at the _system_ for problems; only when he saw hard evidence
would an _excellent_ programmer conclude that third parties were
changing his system.

Find another job - perhaps salesman or preacher. You will never be
more than an embarrassment as a programmer.
tom

[gerry]

sounds like tommy forgot to take his meds today


"parley" <parley_point@yahoo.com> wrote in message
news:8a6ad5c3.0401160903.62fb1449@posting.google.c om...

> ringo <rgp@ringosoft*NoSpam*.com> wrote in message

news:<i3ANb.230089$Vu5.17002810@twister.southeast. rr.com>...

> > Hi all, I have a couple of Win2000 servers running IIS and an

asp.NET web application, and have seen sporadic errors in the event logs:

> >
> > aspnet_wp.exe (PID:PIDNumber) was recycled because memory consumption

exceeded the SizeLimit MB (Percentage percent of available RAM)

> >
> > The app I'm running doesn't deal with anything even approaching

> large amounts of data (there's a datagrid which displays a max 13x6
> grid, all fields less than 50 characters), and does not upload files.
> The errors seem to come at random times, whether or not there is
> activity in the app (I know this because I log all user operations to
> a SQL Server database). I have been running performance logs on the
> machine, and noticed a huge spike for 'ASP.NET APPS v 1.1.4xxx'
> Requests/sec right before the crashes.

> > I'm wondering if anyone has seen this before, and if the cause could be

some type of DOS or similar attack on the server... and if so, what can I do
to stop it? Any experiences/advice is appreciated,

> > -Ringo

>
> Listen to yourself: "My program is slow and there are other problems:
> someone must be hacking into my system."
>
> The very existence of this software antipattern indicates that you
> will never ever be a decent programmer and that you _may_ be
> delusional. A real programmer would search his own code for errors for
> _hours_ before looking elesewhere; after that a good programmer would
> look at the _system_ for problems; only when he saw hard evidence
> would an _excellent_ programmer conclude that third parties were
> changing his system.
>
> Find another job - perhaps salesman or preacher. You will never be
> more than an embarrassment as a programmer.
> tom