Note: This article was originally published in 2013. Some steps, commands, or software versions may have changed. Check the current Internet Information Services (IIS) documentation for the latest information.

In this step-by-step guide, you’ll learn resolve error .

How to: Resolve error “Faulting application name: w3wp.exe, Faulting module name: ntdll.dll, Unable to create log file”

To save people some time the error “Faulting application name: w3wp.exe” refers to an issue with (http://www.iis.net/ “Internet Information Services”), while the error “Faulting module name: ntdll.dll” is incredibly generic it could be so many things, so you really need to gather more information to narrow down what the issue could be. But as mentioned, in the error you also get w3wp.exe so you can narrow down this to an IIS error, so if you only have a ntdll.dll error then try to narrow it down further. This particular error is linked to the error of being unable to create a log file for IIS that may manifest among other things with the following error message while opening a page:

Server Error

500 - Internal server error.

There is a problem with the resource you are looking for, and it cannot be displayed.

Below is an example of the error log you would find in your Event Log:  

Faulting application name: w3wp.exe, version: 7.5.7600.16385, time stamp: 0x4a5bcd2b Faulting module name: ntdll.dll, version: 6.1.7600.16559, time stamp: 0x4ba9b29c Exception code: 0xc0000374 Fault offset: 0x000cdc9b Faulting process id: 0x1808 Faulting application start time: 0x01cb87ac3802f70b Faulting application path: C:WindowsSysWOW64inetsrvw3wp.exe Faulting module path: C:WindowsSysWOW64ntdll.dll Report Id: b6fef44a-f3a3-11df-a3ad-001f29e83b6c ------------------------------------------------------------------------------------------------------------------ Below mentioned information events are logged at the same time in the eventviewer Fault bucket , type 0 Event Name: APPCRASH Response: Not available Cab Id: 0 Problem signature: P1: w3wp.exe P2: 7.5.7600.16385 P3: 4a5bcd2b P4: StackHash_36a0 P5: 6.1.7600.16385 P6: 4a5bdb3b P7: c0000374 P8: 000cdcbb P9: P10: Attached files: These files may be available here: C:ProgramDataMicrosoftWindowsWERReportQueueAppCrash_w3wp.exe_492df9603e11bbc5b03823f88e198723f5983146_02fd8b3f Analysis symbol: Rechecking for solution: 0 Report Id: a8505dcf-f397-11df-b196-001f29e7b642 Report Status: 4

Now, in this particular case if you continue to look around the System event log you´ll come across this other error message which really helps you most of the time to figure out what is going on:

Log Name: System Source: (http://www.microsoft.com/WINDOWS “Windows”)-HttpEvent Date: 11/5/2013 8:10:12 PM (http://en.wikipedia.org/wiki/Event_Viewer “Event Viewer”): 15000 Task Category: None Level: Error Keywords: Classic User: N/A Computer: WebServer01.Bauzas.com Description: Unable to create log file S:WebLogsIIS Log FilesW3SVC3u_ex131106.log. Make sure that the logging directory is correct and this computer has write access to that directory. Event Xml: 15000 0 2 0 0 0x80000000000000 5817 System WebServer01.Bauzas.com DeviceHttpReqQueue S:WebLogsIIS Log FilesW3SVC3u_ex131106.log 000004000200300000000000983A00C0000000000000000000000000000000000000000000000000430000C0

As the error log implies the system is not able to create/write to the log file. Now, in my case this happened because I was playing with Network shares, Shared Configuration & (http://en.wikipedia.org/wiki/Distributed_File_System_%28Microsoft%29 “Distributed File System (Microsoft)”) so I forgot to set the right permissions for IIS to be able to write the log files that is has to the default directory:

Make sure your IIS IUSRS user has access to the log files

Summary

You’ve successfully learned resolve error . If you run into any issues, double-check the prerequisites and ensure your Internet Information Services (IIS) environment is properly configured.