Event Log Rules for a Management Pack
Applies To: Operations Manager 2007
The following tables display information about the event log rules in the Internet Information Services (IIS) 7.0 management pack.
Event Log Rules Enabled by Default
The event log rules in the table below are enabled by default and generate alerts by default.
| Name | Target | Event ID | Event Source | Event Log | Alert Severity |
|---|---|---|---|---|---|
Application pool has an IdleTimeout equal to or greater than the PeriodicRestart time. |
IIS 7.0 application pool |
5152 |
Microsoft-Windows-WAS |
System |
Warning |
Application pool worker process is unresponsive. |
IIS 7.0 application pool |
5010, 5011, 5012, 5013 |
Microsoft-Windows-WAS |
System |
Warning |
Application pool worker process terminated unexpectedly. |
IIS 7.0 application pool |
5009 |
Microsoft-Windows-WAS |
System |
Warning |
Job object associated with the application pool encountered an error. |
IIS 7.0 application pool |
5088, 5061, 5060 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) did not apply configuration changes to application pool. |
IIS 7.0 application pool |
5085 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) did not run the automatic shutdown executable for application pool. |
IIS 7.0 application pool |
5054, 5091 |
Microsoft-Windows-WAS |
System |
Error |
Windows Process Activation Service (WAS) encountered a failure while setting the affinity mask of an application pool. |
IIS 7.0 application pool |
5058 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) encountered an internal error while managing a worker process. |
IIS 7.0 application pool |
5014 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) failed to create application pool. |
IIS 7.0 application pool |
5101 |
Microsoft-Windows-WAS |
System |
Error |
Windows Process Activation Service (WAS) failed to issue recycle request to application pool. |
IIS 7.0 application pool |
5070, 5093 |
Microsoft-Windows-WAS |
System |
Warning |
Worker process for application pool encountered an error while trying to read global module configuration. |
IIS 7.0 application pool |
2297 |
Microsoft-Windows-IIS-W3SVC-WP |
Application |
Warning |
Worker process serving an application pool reported a failure. |
IIS 7.0 application pool |
5039 |
Microsoft-Windows-WAS |
System |
Warning |
Worker process serving application pool was orphaned. |
IIS 7.0 application pool |
5015 |
Microsoft-Windows-WAS |
System |
Warning |
Worker process serving the application pool is no longer trusted by Windows Process Activation Service (WAS). |
IIS 7.0 application pool |
5127 |
Microsoft-Windows-WAS |
System |
Warning |
World Wide Web Publishing Service encountered an error when it tried to secure the handle of the application pool. |
IIS 7.0 application pool |
1026 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
World Wide Web Publishing Service failed to properly configure the application pool queue length. |
IIS 7.0 application pool |
1087 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
World Wide Web Publishing Service failed to properly configure the load balancer capabilities on application pool. |
IIS 7.0 application pool |
1086 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
A script has not responded within the configured time-out period. |
IIS 7.0 Web server |
2216 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
A server-side-include file has included itself, or the maximum depth of server-side include files has been exceeded. |
IIS 7.0 Web server |
2221 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
An attempt was made to load an ISAPI filter on a server instance, but because it requires the SF_NOTIFY_READ_RAW_DATA filter notification, it must be loaded as a global filter. |
IIS 7.0 Web server |
2222 |
Microsoft-Windows-IIS-W3SVC-WP |
Application |
Warning |
ASP application error occurred. |
IIS 7.0 Web server |
500, 499, 23, 22, 21, 20, 19, 18, 17, 16, 9, 8, 7, 6, 5 |
Active Server Pages |
Application |
Warning |
HTTP control channel for the World Wide Web Publishing Service did not open. |
IIS 7.0 Web server |
1037 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
HTTP Server could not create a client connection object for user. |
IIS 7.0 Web server |
2208 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
HTTP Server could not create the main connection socket. |
IIS 7.0 Web server |
2206 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
HTTP Server could not initialize its security. |
IIS 7.0 Web server |
2201 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
HTTP Server could not initialize the socket library. |
IIS 7.0 Web server |
2203 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
HTTP Server was unable to initialize because of a shortage of available memory. |
IIS 7.0 Web server |
2204 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
ISAPI application error detected. |
IIS 7.0 Web server |
2274, 2268, 2220, 2219, 2214 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
Module has an invalid precondition. |
IIS 7.0 Web server |
2296 |
Microsoft-Windows-IIS-W3SVC-WP |
Application |
Warning |
Module registration error detected (failed to find RegisterModule entry point). |
IIS 7.0 Web server |
2295 |
Microsoft-Windows-IIS-W3SVC-WP |
Application |
Warning |
Module registration error detected (module returned an error during registration). |
IIS 7.0 Web server |
2293 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
Only one type of logging can be enabled at a time. |
IIS 7.0 Web server |
1133 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
SF_NOTIFY_READ_RAW_DATA filter notification is not supported in IIS 7.0. |
IIS 7.0 Web server |
2261 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
The configuration manager for Windows Process Activation Service (WAS) did not initialize. |
IIS 7.0 Web server |
5036 |
Microsoft-Windows-WAS |
System |
Error |
The directory specified for caching compressed content is invalid. |
IIS 7.0 Web server |
2264 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
The Global Modules list is empty. |
IIS 7.0 Web server |
2298 |
Microsoft-Windows-IIS-W3SVC-WP |
Application |
Warning |
The HTTP server encountered an error processing the server-side include file. |
IIS 7.0 Web server |
2218 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
The server failed to close client connections to URLs during shutdown. |
IIS 7.0 Web server |
2258 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
The server was unable to acquire a license for an SSL connection. |
IIS 7.0 Web server |
2227 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
The server was unable to allocate a buffer to read a file. |
IIS 7.0 Web server |
2233 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
The server was unable to read a file. |
IIS 7.0 Web server |
2226, 2230, 2231, 2232 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
Windows Process Activation Service (WAS) detected invalid configuration data. |
IIS 7.0 Web server |
5174, 5179, 5180 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) encountered a failure requesting IIS configuration store change notifications. |
IIS 7.0 Web server |
5063 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) encountered an error attempting to configure centralized logging. |
IIS 7.0 Web server |
5066 |
Microsoft-Windows-WAS |
System |
Error |
Windows Process Activation Service (WAS) encountered an error attempting to look up the built-in IIS_IUSRS group. |
IIS 7.0 Web server |
5153 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) encountered an error trying to read configuration. |
IIS 7.0 Web server |
5172, 5173 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) is stopping because it encountered an error. |
IIS 7.0 Web server |
5005 |
Microsoft-Windows-WAS |
System |
Error |
Windows Process Activation Service (WAS) received a change notification but was unable to process it correctly. |
IIS 7.0 Web server |
5053 |
Microsoft-Windows-WAS |
System |
Warning |
Windows Process Activation Service (WAS) terminated unexpectedly, and the system was not configured to restart it. |
IIS 7.0 Web server |
5030 |
Microsoft-Windows-WAS |
System |
Error |
Worker process encountered an error during initialization. |
IIS 7.0 Web server |
2279, 2278, 2277 |
Microsoft-Windows-IIS-W3SVC-WP |
Application |
Warning |
Worker process failed to initialize communication with the World Wide Web Publishing Service and therefore could not be started. |
IIS 7.0 Web server |
2281 |
Microsoft-Windows-IIS-WMSVC |
Application |
Warning |
World Wide Web Publishing Service did not initialize the HTTP driver and was unable start. |
IIS 7.0 Web server |
1173 |
Microsoft-Windows-IIS-W3SVC |
System |
Error |
World Wide Web Publishing Service failed to configure the centralized World Wide Web Consortium (W3C) logging properties. |
IIS 7.0 Web server |
1135, 1134 |
Microsoft-Windows-IIS-WMSVC |
System |
Warning |
World Wide Web Publishing Service failed to configure the HTTP.SYS control channel property. |
IIS 7.0 Web server |
1020 |
Microsoft-Windows-IIS-WMSVC |
System |
Warning |
World Wide Web Publishing service failed to configure the logging properties for the HTTP control channel. |
IIS 7.0 Web server |
1062 |
Microsoft-Windows-IIS-WMSVC |
System |
Warning |
World Wide Web Publishing Service failed to copy a change notification for processing. |
IIS 7.0 Web server |
1126 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
World Wide Web Publishing Service failed to enable end point sharing for the HTTP control channel. |
IIS 7.0 Web server |
1175 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
World Wide Web Publishing Service failed to enable global bandwidth throttling. |
IIS 7.0 Web server |
1071, 1073 |
Microsoft-Windows-IIS-W3SVC |
System |
Warning |
World Wide Web Publishing Service property failed range validation. |
IIS 7.0 Web server |
5067 |
Microsoft-Windows-WAS |
System |
Warning |
Event Log Rules Disabled by Default
The following rules are designed to detect errors that are logged by the Operations Manager 2007 modules that perform discovery and monitoring of IIS 7.0. The rules are disabled by default because their purpose is to run only on servers on which IIS 7.0 is installed rather than running on every server that has an Operations Manager agent.
To ensure that these rules run only on servers on which IIS 7.0 is actually installed, the rules are disabled by default. The management pack contains a set of overrides that enable the rules to run only on servers with IIS 7.0 installed.
Note
The Operations Manager administrator does not need to take any action such as creating overrides in order to enable these rules to run on IIS 7.0 servers as the necessary overrides are already included in the IIS 7.0 management pack and are applied automatically when you import the management pack.
The following settings apply to all the event log rules in the table below.
Alerts are generated by default. This can be changed by creating an override.
Event Source: Health Service Modules
Event Log: Operations Manager
| Name | Target | Event ID | Alert Severity |
|---|---|---|---|
Failed to find application pool while attempting to retrieve state. |
Health Service |
33856 |
Warning |
Failed to find site while attempting to retrieve state. |
Health Service |
33855 |
Warning |
Failed to perform application pool discovery. |
Health Service |
33006, 33031, 33032, 33033 |
Warning |
Failed to perform FTP server discovery. |
Health Service |
33007 |
Warning |
Failed to perform FTP site discovery. |
Health Service |
33008 |
Warning |
Failed to perform initialization of IIS discovery module. |
Health Service |
33001, 33014, 33017, 33018, 33030, 33034, 33035 |
Warning |
Failed to perform initialization of IIS state monitoring module. |
Health Service |
33851, 33853, 33854, 33867, 33868 |
Warning |
Failed to perform Web application discovery. |
Health Service |
33029 |
Warning |
Failed to perform Web server properties discovery. |
Health Service |
33004 |
Warning |
Failed to perform Web site discovery. |
Health Service |
33005, 33019, 33020, 33021, 33036, 33037, 33038 |
Warning |
Failed to retrieve application pool state. |
Health Service |
33858, 33859, 33862 |
Warning |
Failed to retrieve site state. |
Health Service |
33852, 33857, 33860, 33863, 33864, 33865, 33866 |
Warning |
IIS component discovery failed due to insufficient privileges. |
Health Service |
33015 |
Warning |
Agent update that is required for IIS 7.0 monitoring is not installed. |
Health Service |
4507 |
Error |