guys, if i am not mistaken, the OS will also do it's own logging of critical services or process crash or experience problems. on NT this is usually accessible via the event viewer. i think the other thing that would be useful is monitoring the IIS process memory..and examine the difference between a fresh start and when it crashes.