.Net 6.0 Windows service crashing on system shutdown or reboot

[sourdig]

Description

This windows service is migrated recently from .Net framework 4.8 to .Net core (6.0).
The service is crashing on the system shutdown or reboot. This issue was not seen before migrating to .Net 6.0.
The crash is happening in System.Diagnostics.EventLog.dll. Details are added below.

Reproduction Steps

As mentioned above

Expected behavior

The windows service should not crash

Actual behavior

The windows service is crashing

Regression?

No response

Known Workarounds

No response

Configuration

.Net 6.0, Windows 10
Windows Service architecture : x86

Other information

Call Stack after Crash -

KERNELBASE.dll!75e1d8a2() Unknown
[Frames below may be incorrect and/or missing, no symbols loaded for KERNELBASE.dll]
[Managed to Native Transition]

System.Diagnostics.EventLog.dll!System.Diagnostics.EventLogInternal.InternalWriteEvent(uint eventID, ushort category,
System.Diagnostics.EventLogEntryType type, string[] strings, byte[] rawData, string currentMachineName) Line 1397
System.Diagnostics.EventLog.dll!System.Diagnostics.EventLogInternal.WriteEntry(string message,
System.Diagnostics.EventLogEntryType type, int eventID, short category, byte[] rawData) Line 1317
System.Diagnostics.EventLog.dll!System.Diagnostics.EventLog.WriteEntry(string message,
System.Diagnostics.EventLogEntryType type) Line 988
System.ServiceProcess.ServiceController.dll!System.ServiceProcess.ServiceBase.WriteLogEntry(string message,
System.Diagnostics.EventLogEntryType type)
System.ServiceProcess.ServiceController.dll!System.ServiceProcess.ServiceBase.DeferredShutdown()
System.ServiceProcess.ServiceController.dll!System.ServiceProcess.ServiceBase.ServiceCommandCallback.AnonymousMethod__3(object _)
System.Private.CoreLib.dll!System.Threading.QueueUserWorkItemCallbackDefaultContext.Execute()
System.Private.CoreLib.dll!System.Threading.ThreadPoolWorkQueue.Dispatch()
System.Private.CoreLib.dll!System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()
System.Private.CoreLib.dll!System.Threading.Thread.StartCallback()
[Native to Managed Transition]
kernel32.dll!75b800c9()
ntdll.dll!776f7b4e()
ntdll.dll!776f7b1e()

Unhandled exception at 0x75E1D8A2 (KERNELBASE.dll)

Tagging subscribers to this area: @dotnet/area-system-diagnostics-eventlog
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

This windows service is migrated recently from .Net framework 4.8 to .Net core (6.0).
The service is crashing on the system shutdown or reboot. This issue was not seen before migrating to .Net 6.0.
The crash is happening in System.Diagnostics.EventLog.dll. Details are added below.

Reproduction Steps

As mentioned above

Expected behavior

The windows service should not crash

Actual behavior

The windows service is crashing

Regression?

No response

Known Workarounds

No response

Configuration

.Net 6.0, Windows 10
Windows Service architecture : x86

Other information

Call Stack after Crash -

KERNELBASE.dll!75e1d8a2() Unknown
[Frames below may be incorrect and/or missing, no symbols loaded for KERNELBASE.dll]
[Managed to Native Transition]

System.Diagnostics.EventLog.dll!System.Diagnostics.EventLogInternal.InternalWriteEvent(uint eventID, ushort category,
System.Diagnostics.EventLogEntryType type, string[] strings, byte[] rawData, string currentMachineName) Line 1397
System.Diagnostics.EventLog.dll!System.Diagnostics.EventLogInternal.WriteEntry(string message,
System.Diagnostics.EventLogEntryType type, int eventID, short category, byte[] rawData) Line 1317
System.Diagnostics.EventLog.dll!System.Diagnostics.EventLog.WriteEntry(string message,
System.Diagnostics.EventLogEntryType type) Line 988
System.ServiceProcess.ServiceController.dll!System.ServiceProcess.ServiceBase.WriteLogEntry(string message,
System.Diagnostics.EventLogEntryType type)
System.ServiceProcess.ServiceController.dll!System.ServiceProcess.ServiceBase.DeferredShutdown()
System.ServiceProcess.ServiceController.dll!System.ServiceProcess.ServiceBase.ServiceCommandCallback.AnonymousMethod__3(object _)
System.Private.CoreLib.dll!System.Threading.QueueUserWorkItemCallbackDefaultContext.Execute()
System.Private.CoreLib.dll!System.Threading.ThreadPoolWorkQueue.Dispatch()
System.Private.CoreLib.dll!System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()
System.Private.CoreLib.dll!System.Threading.Thread.StartCallback()
[Native to Managed Transition]
kernel32.dll!75b800c9()
ntdll.dll!776f7b4e()
ntdll.dll!776f7b1e()

Unhandled exception at 0x75E1D8A2 (KERNELBASE.dll)

Author:	sourdig
Assignees:	-
Labels:	untriaged, area-System.Diagnostics.EventLog
Milestone:	-

[carlossanlop]

Thanks for reporting, @sourdig. Some questions:

• Are you able to repro this using .NET 8?
• Any chance you can share code with a minimal repro?

This issue has been marked needs-author-action and may be missing some important information.

[sourdig]

@carlossanlop I haven't tried to repro this issue on .NET 8 as we just completed the .NET 6 migration for this component. I am uploading the crash dump for this issue, hope this will be helpful in further analysis.
Crash Dump Link - https://drive.google.com/file/d/1WVxbgrVVQSiB3M88v1Mtxcpet5T910V1/view?usp=sharing

[sourdig]

@carlossanlop One more thing to consider is, we are using ServiceBase class (from .Net Framework) for this windows service and not the BackgroundService class which is used to create a new windows service in .Net core. The reason being, we have migrated this binary from .Net framework to .Net core.

[danmoseley]

@sourdig as well as trying on 7.0 or 8.0 it would also be good if you can simplify the service code down to the minimum required to repro the crash. It will likely be small enough to share here.

[sourdig]

Hi @danmoseley , @carlossanlop
I am trying to create a sample service to reproduce this issue which can be shared here, but I am not able to repro the issue in the sample. Also we cannot move this service immediately to .Net 7 or 8 due to some constraints. Is it possible to deduce anything from the crash dump provided above? Is there any difference in the way service is handled at the time of shutdown between .Net 4.8 vs .Net 6 ? Any other inputs could be really helpful.

[sourdig]

@danmoseley , @carlossanlop
In .Net 6.0 CoreClr code, EventLogInternal.cs -> InternalWriteEvent(), following code is causing the failure in writing the event log in case of system shutdown. Any idea why it would throw exception with advapi32.dll function to log event ?

            bool success = Interop.Advapi32.ReportEvent(writeHandle, (short)type, category, eventID,
                                                 sid, (short)strings.Length, rawData.Length, stringsRootHandle.AddrOfPinnedObject(), rawData);
            if (!success)
            {
                throw new Win32Exception();
            }