>Where is this being logged ? - odd that it says 'File Change Notification ERROR'

This is from the _shutDownMessage and _shutDownStack from my application end event.

This is like this:

    Sub Application_End()
        Dim lcShutDownMessage As String = ""
        Dim lcShutDownStack As String = ""
        Dim lnDateNow As Double = Date.Now.Ticks
        Dim lnDuration As Double = 0
        Dim loHttpRuntime As HttpRuntime = Nothing
        Dim loUpdate As Update = Nothing

        oApp = App.oApp

        loUpdate = New Update(oApp)

        ' If we have an IISApplicationCycle table
        If Not oApp.Tables("IISApplicationCycle") Is Nothing Then
            lnDuration = ((lnDateNow - oApp.nDateNow) / 10000000)

            loHttpRuntime = DirectCast(GetType(System.Web.HttpRuntime).InvokeMember("_theRuntime", _
             BindingFlags.NonPublic Or BindingFlags.Static Or BindingFlags.GetField, Nothing, Nothing, Nothing), HttpRuntime)

            ' If it is running
            If Not loHttpRuntime Is Nothing Then

                lcShutDownMessage = DirectCast(loHttpRuntime.[GetType]().InvokeMember("_shutDownMessage", _
                 BindingFlags.NonPublic Or BindingFlags.Instance Or BindingFlags.GetField, Nothing, loHttpRuntime, Nothing), String)

                lcShutDownStack = DirectCast(loHttpRuntime.[GetType]().InvokeMember("_shutDownStack", _
                 BindingFlags.NonPublic Or BindingFlags.Instance Or BindingFlags.GetField, Nothing, loHttpRuntime, Nothing), String)

            End If

            ' Update the record
            loUpdate.cTable = "IISApplicationCycle"
            loUpdate.nPrimaryKey = oApp.nID
            loUpdate.ParameterAdd("Duration", lnDuration)
            loUpdate.ParameterAdd("ShutDownMessage", lcShutDownMessage)
            loUpdate.ParameterAdd("ShutDownStack", lcShutDownStack)
            If Not loUpdate.Update() Then
                Exit Sub
            End If

        End If

    End Sub

This ERROR text is random. Sometimes, it is something else. It varies. The timeframe also varies. I can have it ok for days and in one single day, it would be like 200 restarts. This is a known issue and I am trying to find a workaround.

>In 'Advanced Settings' for the AppPool you can log 'Generate Recycle Event Log Entry / Application Pool Configuration Changed'
>(You can also 'Disable Recycling for Configuration Changes' - but be sure that won't have other unwanted side effects

Yes, I have been looking into that. The thing is that so many people tried those settings and nothing more important was logged to help on that issue. We have a Windows update procedure on all servers in two weeks. I will see if that helps. We do not have that on UAT but only in production. UAT is more up to date. However, that issue is there since 2009. Microsoft released several fixes over the years but this keeps happening.

I also have this in my application start event to turn off monitoring:

    Sub Application_Start()
        Dim loFieldInfo As FieldInfo = Nothing
        Dim loMethodInfo As MethodInfo = Nothing
        Dim loObject As Object = Nothing
        Dim loObject2 As Object = Nothing
        Dim loPropertyInfo As PropertyInfo = Nothing

        ' This registration is only needed for the Web Service
        ' However, even if this is run under the Web site, it does not do anything
        RegisterSoapExtension(GetType(TraceExtension), 1, 0)

	' Microsoft IIS/ASP.NET has a bug that after a very long period of time, it can start restarting the worker process
	' several times per minute, for days, causing an enormous amount of load
	' As there is no guarantee this will come back, we disable this FCN at this level
	' This code will turn off monitoring from the root website directory, but monitoring of Bin, App_Themes and other folders will
	' still be operational, so updated DLLs will still auto deploy
	' This technique can also be stored in Web.config under:
	' <configuration>
	' <system.web>
	' <httpRuntime fcnMode="Disabled" />
	' </system.web>
	' </configuration>
	' But, that only works for .NET Framework 4.5 and up

	' This is a great link:
	' http://blogs.msdn.com/b/tess/archive/2006/08/02/686373.aspx

	loPropertyInfo = GetType(System.Web.HttpRuntime).GetProperty("FileChangesMonitor",
	 BindingFlags.NonPublic Or BindingFlags.Public Or BindingFlags.Static)
	loObject = loPropertyInfo.GetValue(Nothing, Nothing)

        ' Turn off FCN on the sub directories
        loFieldInfo = loObject.GetType().GetField("_dirMonSubdirs", BindingFlags.Instance Or BindingFlags.NonPublic Or BindingFlags.IgnoreCase)
        loObject2 = loFieldInfo.GetValue(loObject)

        ' Send the deactivation notice
        loMethodInfo = loObject2.GetType().GetMethod("StopMonitoring", BindingFlags.Instance Or BindingFlags.NonPublic)
        loMethodInfo.Invoke(loObject2, New Object() {})

    End Sub

>Good explanation of IIS File monitoring here :
>http://blogs.msdn.com/b/tmarq/archive/2007/11/02/asp-net-file-change-notifications-exactly-which-files-and-directories-are-monitored.aspx
>
>Bit of code you can use to create your own log here : http://chrismay.org/2009/04/02/asp-net-apps-recycling-because-of-fcn-issues/

I checked with the security team, as far as what could be an impact from the antivirus software. I have been confirmed that this only runs a full scan in a certain part of the week which does not match the time of those events. A full scan will update the attribute on files making IIS react for an app domain restart. The code above turns off monitoring on sub directories, but Bin. So, anything being updated in the root or the Bin would still be eligible for an app domain restarts. That would include a file attribute change. IIS goes a little bit too far on this and that would be an effect. However, as mentioned, the antivirus has been ruled off because of the time of the week it runs.

The production application has been there for weeks so nothing changed in the directories.