Event Log Application Error, is the fault address meaningful?

Question

I have an application error in the event log and it includes the following information:

Reporting queued error: faulting application w3wp.exe, version 6.0.3790.3959, faulting module kernel32.dll, version 5.2.3790.4480, fault address 0x0000bef7.

In general: Is the fault address useful in tracking down the issue?

In particular: I have found a chinese support site that relates the fault address to unclosed database connections. should I start searching our code for those? if so is there a quick way to find them?

Cheers. Murray.

Answer 1

This event log information, faulting module etc, is not for you to use it to track the exception, but rather on Microsoft part to properly organize errors. The fault address is almost never the same between 2 different crashes on the same module, so its useful to distinguish the crash when Windows Error Report runs.

Right now the best thing you can do, is when the application crashes, make sure you send the report to Microsoft. Also if you really need, using this event log, someone inside Microsoft can help you track the issue. If this is windows vista, there is a BucketID in the event log, on the 1001 event that is useful for tracking this issues.

Since w3wp.exe is a owned by Microsoft, someone probably already took a look at this crash, on the upcoming windows 7 you will get response back with a solution when available so you won't have to worry on looking for this codes.