How to: Resolve error “Faulting application name: w3wp.exe, Faulting module name: ntdll.dll, Unable to create log file”

To save people some time the error “Faulting application name: w3wp.exe” refers to an issue with IIS, while the error “Faulting module name: ntdll.dll” is incredibly generic it could be so many things, so you really need to gather more information to narrow down what the issue could be. But as mentioned, in the error you also get w3wp.exe so you can narrow down this to an IIS error, so if you only have a ntdll.dll error then try to narrow it down further. This particular error is linked to the error of being unable to create a log file for IIS that may manifest among other things with the following error message while opening a page:

Server Error

500 – Internal server error.

There is a problem with the resource you are looking for, and it cannot be displayed.

Below is an example of the error log you would find in your Event Log:

Faulting application name: w3wp.exe, version: 7.5.7600.16385, time stamp: 0x4a5bcd2b
Faulting module name: ntdll.dll, version: 6.1.7600.16559, time stamp: 0x4ba9b29c
Exception code: 0xc0000374
Fault offset: 0x000cdc9b
Faulting process id: 0x1808
Faulting application start time: 0x01cb87ac3802f70b
Faulting application path: C:WindowsSysWOW64inetsrvw3wp.exe
Faulting module path: C:WindowsSysWOW64ntdll.dll
Report Id: b6fef44a-f3a3-11df-a3ad-001f29e83b6c

——————————————————————————————————————

Below mentioned information events are logged at the same time in the eventviewer

Fault bucket , type 0

Event Name: APPCRASH

Response: Not available

Cab Id: 0

Problem signature:

P1: w3wp.exe

P2: 7.5.7600.16385

P3: 4a5bcd2b

P4: StackHash_36a0

P5: 6.1.7600.16385

P6: 4a5bdb3b

P7: c0000374

P8: 000cdcbb

P9:

P10:

Attached files:

These files may be available here:

C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_492df9603e11bbc5b03823f88e198723f5983146_02fd8b3f

Analysis symbol:

Rechecking for solution: 0

Report Id: a8505dcf-f397-11df-b196-001f29e7b642

Report Status: 4

Now, in this particular case if you continue to look around the System event log you´ll come across this other error message which really helps you most of the time to figure out what is going on:

Log Name: System
Source: Microsoft-Windows-HttpEvent
Date: 11/5/2013 8:10:12 PM
Event ID: 15000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: WebServer01.Bauzas.com
Description:
Unable to create log file S:WebLogsIIS Log FilesW3SVC3u_ex131106.log. Make sure that the logging directory is correct and this computer has write access to that directory.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=”Microsoft-Windows-HttpEvent” Guid=”{7b6bc78c-898b-4170-bbf8-1a469ea43fc5}” EventSourceName=”HTTP” />
<EventID Qualifiers=”49152″>15000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime=”2013-11-06T02:10:12.757494400Z” />
<EventRecordID>5817</EventRecordID>
<Correlation />
<Execution ProcessID=”4″ ThreadID=”4428″ />
<Channel>System</Channel>
<Computer>WebServer01.Bauzas.com</Computer>
<Security />
</System>
<EventData>
<Data Name=”DeviceObject”>DeviceHttpReqQueue</Data>
<Data Name=”LogFile”>S:WebLogsIIS Log FilesW3SVC3u_ex131106.log</Data>
<Binary>000004000200300000000000983A00C0000000000000000000000000000000000000000000000000430000C0</Binary>
</EventData>
</Event>

As the error log implies the system is not able to create/write to the log file. Now, in my case this happened because I was playing with Network shares, Shared Configuration & DFS so I forgot to set the right permissions for IIS to be able to write the log files that is has to the default directory:

Make sure your IIS IUSRS user has access to the log files