Morning,
On our server which is RD Gateway and RD Web Access role we've found a lot of events like this:
Log Name: Application
Source: ASP.NET 4.0.30319.0
Date: 2015-04-15 16:17:31
Event ID: 1309
Task Category: Web Event
Level: Warning
Keywords: Classic
User: N/A
Computer: XSS-RDS1.XSS.LOCAL
Description:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 2015-04-15 16:17:31
Event time (UTC): 2015-04-15 14:17:31
Event ID: f898bb6c9a014b4097e23da99c64222f
Event sequence: 19046
Event occurrence: 182
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/1/ROOT/RDWeb/Pages-2-130701539766097203
Trust level: Full
Application Virtual Path: /RDWeb/Pages
Application Path: C:\Windows\Web\RDWeb\Pages\
Machine name: XSS-RDS1
Process information:
Process ID: 1876
Process name: w3wp.exe
Account name: IIS APPPOOL\RDWebAccess
Exception information:
Exception type: NullReferenceException
Exception message: Object reference not set to an instance of an object.
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.PrepareRdpFile(String& rdp_contents, String fileExtension, String ts_name, String alias, String& rdp_file_url, String& rdp_file_name, DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.ProcessPublishedApp(String alias, String name, String resourceFile, String fileExtension, Byte[] iconContents, UInt32 pceIconSize, Int32 resourceType, FileExtensionInfo[] fileAssociations, String[]
folderNames, String securityDescriptor, ArrayList& apps, DateTime requestTime, UInt64 lastUpdateTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.GetFreshApps(DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.OnCacheItemRemoved(String key, Object value, CacheItemRemovedReason removedReason)
at System.Web.Caching.CacheEntry.CallCacheItemRemovedCallback(CacheItemRemovedCallback callback, CacheItemRemovedReason reason)
Request information:
Request URL:
Request path:
User host address:
User:
Is authenticated: False
Authentication Type:
Thread account name: IIS APPPOOL\RDWebAccess
Thread information:
Thread ID: 32
Thread account name: IIS APPPOOL\RDWebAccess
Is impersonating: False
Stack trace: at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.PrepareRdpFile(String& rdp_contents, String fileExtension, String ts_name, String alias, String& rdp_file_url, String& rdp_file_name, DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.ProcessPublishedApp(String alias, String name, String resourceFile, String fileExtension, Byte[] iconContents, UInt32 pceIconSize, Int32 resourceType, FileExtensionInfo[] fileAssociations, String[]
folderNames, String securityDescriptor, ArrayList& apps, DateTime requestTime, UInt64 lastUpdateTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.GetFreshApps(DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.OnCacheItemRemoved(String key, Object value, CacheItemRemovedReason removedReason)
at System.Web.Caching.CacheEntry.CallCacheItemRemovedCallback(CacheItemRemovedCallback callback, CacheItemRemovedReason reason)
Custom event details:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="ASP.NET 4.0.30319.0" />
<EventID Qualifiers="32768">1309</EventID>
<Level>3</Level>
<Task>3</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-04-15T14:17:31.000000000Z" />
<EventRecordID>8316</EventRecordID>
<Channel>Application</Channel>
<Computer>XSS-RDS1.XSS.LOCAL</Computer>
<Security />
</System>
<EventData>
<Data>3005</Data>
<Data>An unhandled exception has occurred.</Data>
<Data>2015-04-15 16:17:31</Data>
<Data>2015-04-15 14:17:31</Data>
<Data>f898bb6c9a014b4097e23da99c64222f</Data>
<Data>19046</Data>
<Data>182</Data>
<Data>0</Data>
<Data>/LM/W3SVC/1/ROOT/RDWeb/Pages-2-130701539766097203</Data>
<Data>Full</Data>
<Data>/RDWeb/Pages</Data>
<Data>C:\Windows\Web\RDWeb\Pages\</Data>
<Data>XSS-RDS1</Data>
<Data>
</Data>
<Data>1876</Data>
<Data>w3wp.exe</Data>
<Data>IIS APPPOOL\RDWebAccess</Data>
<Data>NullReferenceException</Data>
<Data>Object reference not set to an instance of an object.
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.PrepareRdpFile(String& rdp_contents, String fileExtension, String ts_name, String alias, String& rdp_file_url, String& rdp_file_name, DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.ProcessPublishedApp(String alias, String name, String resourceFile, String fileExtension, Byte[] iconContents, UInt32 pceIconSize, Int32 resourceType, FileExtensionInfo[] fileAssociations, String[]
folderNames, String securityDescriptor, ArrayList& apps, DateTime requestTime, UInt64 lastUpdateTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.GetFreshApps(DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.OnCacheItemRemoved(String key, Object value, CacheItemRemovedReason removedReason)
at System.Web.Caching.CacheEntry.CallCacheItemRemovedCallback(CacheItemRemovedCallback callback, CacheItemRemovedReason reason)
</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
</Data>
<Data>False</Data>
<Data>
</Data>
<Data>IIS APPPOOL\RDWebAccess</Data>
<Data>32</Data>
<Data>IIS APPPOOL\RDWebAccess</Data>
<Data>False</Data>
<Data> at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.PrepareRdpFile(String& rdp_contents, String fileExtension, String ts_name, String alias, String& rdp_file_url, String& rdp_file_name, DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.ProcessPublishedApp(String alias, String name, String resourceFile, String fileExtension, Byte[] iconContents, UInt32 pceIconSize, Int32 resourceType, FileExtensionInfo[] fileAssociations, String[]
folderNames, String securityDescriptor, ArrayList& apps, DateTime requestTime, UInt64 lastUpdateTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.GetFreshApps(DateTime requestTime)
at Microsoft.TerminalServices.Publishing.Portal.RWSCPUBAccessor.OnCacheItemRemoved(String key, Object value, CacheItemRemovedReason removedReason)
at System.Web.Caching.CacheEntry.CallCacheItemRemovedCallback(CacheItemRemovedCallback callback, CacheItemRemovedReason reason)
</Data>
</EventData>
</Event>
This is out of the box configuration, according MS docs. No custom modification was done. What can cause this events?
