We have the IIS Crash/Hang agent installed on the production IIS servers. It seems to record quite a lot of start/stop events. Do these imply that something is really happening? if so, what other events should I be looking for to correlate? I don't see anything that looks significant except possibly for an ASP .NET event that's pretty much "invalid session id"
This is probably just normal recycling behaviour.
By default, IIS App Pools will recycle:
They're started on demand, i.e. when a request arrives.
Setting LogEventOnRecycle to 255 - everything on - will help you correlate Start/Stop events with app pool activity.
(IIS6: http://support.microsoft.com/kb/332088 ; IIS 7 exposes the possible flags through advanced App Pool properties, Recycling)
You haven't specified anything except "invalid session ID" - what are you looking for?