Event Log Rules for a Management Pack

適用於: Operations Manager 2007

The following tables display information about the event log rules in the Internet Information Services (IIS) 7.0 management pack.

Event Log Rules Enabled by Default

The event log rules in the table below are enabled by default and generate alerts by default.

 

Name Target Event ID Event Source Event Log Alert Severity

Application pool has an IdleTimeout equal to or greater than the PeriodicRestart time.

IIS 7.0 application pool

5152

Microsoft-Windows-WAS

System

Warning

Application pool worker process is unresponsive.

IIS 7.0 application pool

5010, 5011, 5012, 5013

Microsoft-Windows-WAS

System

Warning

Application pool worker process terminated unexpectedly.

IIS 7.0 application pool

5009

Microsoft-Windows-WAS

System

Warning

Job object associated with the application pool encountered an error.

IIS 7.0 application pool

5088, 5061, 5060

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) did not apply configuration changes to application pool.

IIS 7.0 application pool

5085

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) did not run the automatic shutdown executable for application pool.

IIS 7.0 application pool

5054, 5091

Microsoft-Windows-WAS

System

Error

Windows Process Activation Service (WAS) encountered a failure while setting the affinity mask of an application pool.

IIS 7.0 application pool

5058

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) encountered an internal error while managing a worker process.

IIS 7.0 application pool

5014

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) failed to create application pool.

IIS 7.0 application pool

5101

Microsoft-Windows-WAS

System

Error

Windows Process Activation Service (WAS) failed to issue recycle request to application pool.

IIS 7.0 application pool

5070, 5093

Microsoft-Windows-WAS

System

Warning

Worker process for application pool encountered an error while trying to read global module configuration.

IIS 7.0 application pool

2297

Microsoft-Windows-IIS-W3SVC-WP

Application

Warning

Worker process serving an application pool reported a failure.

IIS 7.0 application pool

5039

Microsoft-Windows-WAS

System

Warning

Worker process serving application pool was orphaned.

IIS 7.0 application pool

5015

Microsoft-Windows-WAS

System

Warning

Worker process serving the application pool is no longer trusted by Windows Process Activation Service (WAS).

IIS 7.0 application pool

5127

Microsoft-Windows-WAS

System

Warning

World Wide Web Publishing Service encountered an error when it tried to secure the handle of the application pool.

IIS 7.0 application pool

1026

Microsoft-Windows-IIS-W3SVC

System

Warning

World Wide Web Publishing Service failed to properly configure the application pool queue length.

IIS 7.0 application pool

1087

Microsoft-Windows-IIS-W3SVC

System

Warning

World Wide Web Publishing Service failed to properly configure the load balancer capabilities on application pool.

IIS 7.0 application pool

1086

Microsoft-Windows-IIS-W3SVC

System

Warning

A script has not responded within the configured time-out period.

IIS 7.0 Web server

2216

Microsoft-Windows-IIS-WMSVC

Application

Warning

A server-side-include file has included itself, or the maximum depth of server-side include files has been exceeded.

IIS 7.0 Web server

2221

Microsoft-Windows-IIS-WMSVC

Application

Warning

An attempt was made to load an ISAPI filter on a server instance, but because it requires the SF_NOTIFY_READ_RAW_DATA filter notification, it must be loaded as a global filter.

IIS 7.0 Web server

2222

Microsoft-Windows-IIS-W3SVC-WP

Application

Warning

ASP application error occurred.

IIS 7.0 Web server

500, 499, 23, 22, 21, 20, 19, 18, 17, 16, 9, 8, 7, 6, 5

Active Server Pages

Application

Warning

HTTP control channel for the World Wide Web Publishing Service did not open.

IIS 7.0 Web server

1037

Microsoft-Windows-IIS-W3SVC

System

Warning

HTTP Server could not create a client connection object for user.

IIS 7.0 Web server

2208

Microsoft-Windows-IIS-WMSVC

Application

Warning

HTTP Server could not create the main connection socket.

IIS 7.0 Web server

2206

Microsoft-Windows-IIS-WMSVC

Application

Warning

HTTP Server could not initialize its security.

IIS 7.0 Web server

2201

Microsoft-Windows-IIS-WMSVC

Application

Warning

HTTP Server could not initialize the socket library.

IIS 7.0 Web server

2203

Microsoft-Windows-IIS-WMSVC

Application

Warning

HTTP Server was unable to initialize because of a shortage of available memory.

IIS 7.0 Web server

2204

Microsoft-Windows-IIS-WMSVC

Application

Warning

ISAPI application error detected.

IIS 7.0 Web server

2274, 2268, 2220, 2219, 2214

Microsoft-Windows-IIS-WMSVC

Application

Warning

Module has an invalid precondition.

IIS 7.0 Web server

2296

Microsoft-Windows-IIS-W3SVC-WP

Application

Warning

Module registration error detected (failed to find RegisterModule entry point).

IIS 7.0 Web server

2295

Microsoft-Windows-IIS-W3SVC-WP

Application

Warning

Module registration error detected (module returned an error during registration).

IIS 7.0 Web server

2293

Microsoft-Windows-IIS-WMSVC

Application

Warning

Only one type of logging can be enabled at a time.

IIS 7.0 Web server

1133

Microsoft-Windows-IIS-W3SVC

System

Warning

SF_NOTIFY_READ_RAW_DATA filter notification is not supported in IIS 7.0.

IIS 7.0 Web server

2261

Microsoft-Windows-IIS-WMSVC

Application

Warning

The configuration manager for Windows Process Activation Service (WAS) did not initialize.

IIS 7.0 Web server

5036

Microsoft-Windows-WAS

System

Error

The directory specified for caching compressed content is invalid.

IIS 7.0 Web server

2264

Microsoft-Windows-IIS-WMSVC

Application

Warning

The Global Modules list is empty.

IIS 7.0 Web server

2298

Microsoft-Windows-IIS-W3SVC-WP

Application

Warning

The HTTP server encountered an error processing the server-side include file.

IIS 7.0 Web server

2218

Microsoft-Windows-IIS-WMSVC

Application

Warning

The server failed to close client connections to URLs during shutdown.

IIS 7.0 Web server

2258

Microsoft-Windows-IIS-WMSVC

Application

Warning

The server was unable to acquire a license for an SSL connection.

IIS 7.0 Web server

2227

Microsoft-Windows-IIS-WMSVC

Application

Warning

The server was unable to allocate a buffer to read a file.

IIS 7.0 Web server

2233

Microsoft-Windows-IIS-WMSVC

Application

Warning

The server was unable to read a file.

IIS 7.0 Web server

2226, 2230, 2231, 2232

Microsoft-Windows-IIS-WMSVC

Application

Warning

Windows Process Activation Service (WAS) detected invalid configuration data.

IIS 7.0 Web server

5174, 5179, 5180

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) encountered a failure requesting IIS configuration store change notifications.

IIS 7.0 Web server

5063

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) encountered an error attempting to configure centralized logging.

IIS 7.0 Web server

5066

Microsoft-Windows-WAS

System

Error

Windows Process Activation Service (WAS) encountered an error attempting to look up the built-in IIS_IUSRS group.

IIS 7.0 Web server

5153

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) encountered an error trying to read configuration.

IIS 7.0 Web server

5172, 5173

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) is stopping because it encountered an error.

IIS 7.0 Web server

5005

Microsoft-Windows-WAS

System

Error

Windows Process Activation Service (WAS) received a change notification but was unable to process it correctly.

IIS 7.0 Web server

5053

Microsoft-Windows-WAS

System

Warning

Windows Process Activation Service (WAS) terminated unexpectedly, and the system was not configured to restart it.

IIS 7.0 Web server

5030

Microsoft-Windows-WAS

System

Error

Worker process encountered an error during initialization.

IIS 7.0 Web server

2279, 2278, 2277

Microsoft-Windows-IIS-W3SVC-WP

Application

Warning

Worker process failed to initialize communication with the World Wide Web Publishing Service and therefore could not be started.

IIS 7.0 Web server

2281

Microsoft-Windows-IIS-WMSVC

Application

Warning

World Wide Web Publishing Service did not initialize the HTTP driver and was unable start.

IIS 7.0 Web server

1173

Microsoft-Windows-IIS-W3SVC

System

Error

World Wide Web Publishing Service failed to configure the centralized World Wide Web Consortium (W3C) logging properties.

IIS 7.0 Web server

1135, 1134

Microsoft-Windows-IIS-WMSVC

System

Warning

World Wide Web Publishing Service failed to configure the HTTP.SYS control channel property.

IIS 7.0 Web server

1020

Microsoft-Windows-IIS-WMSVC

System

Warning

World Wide Web Publishing service failed to configure the logging properties for the HTTP control channel.

IIS 7.0 Web server

1062

Microsoft-Windows-IIS-WMSVC

System

Warning

World Wide Web Publishing Service failed to copy a change notification for processing.

IIS 7.0 Web server

1126

Microsoft-Windows-IIS-W3SVC

System

Warning

World Wide Web Publishing Service failed to enable end point sharing for the HTTP control channel.

IIS 7.0 Web server

1175

Microsoft-Windows-IIS-W3SVC

System

Warning

World Wide Web Publishing Service failed to enable global bandwidth throttling.

IIS 7.0 Web server

1071, 1073

Microsoft-Windows-IIS-W3SVC

System

Warning

World Wide Web Publishing Service property failed range validation.

IIS 7.0 Web server

5067

Microsoft-Windows-WAS

System

Warning

Event Log Rules Disabled by Default

The following rules are designed to detect errors that are logged by the Operations Manager 2007 modules that perform discovery and monitoring of IIS 7.0. The rules are disabled by default because their purpose is to run only on servers on which IIS 7.0 is installed rather than running on every server that has an Operations Manager agent.

To ensure that these rules run only on servers on which IIS 7.0 is actually installed, the rules are disabled by default. The management pack contains a set of overrides that enable the rules to run only on servers with IIS 7.0 installed.

note附註
The Operations Manager administrator does not need to take any action such as creating overrides in order to enable these rules to run on IIS 7.0 servers as the necessary overrides are already included in the IIS 7.0 management pack and are applied automatically when you import the management pack.

The following settings apply to all the event log rules in the table below.

  • Alerts are generated by default. This can be changed by creating an override.

  • Event Source: Health Service Modules

  • Event Log: Operations Manager

 

Name Target Event ID Alert Severity

Failed to find application pool while attempting to retrieve state.

Health Service

33856

Warning

Failed to find site while attempting to retrieve state.

Health Service

33855

Warning

Failed to perform application pool discovery.

Health Service

33006, 33031, 33032, 33033

Warning

Failed to perform FTP server discovery.

Health Service

33007

Warning

Failed to perform FTP site discovery.

Health Service

33008

Warning

Failed to perform initialization of IIS discovery module.

Health Service

33001, 33014, 33017, 33018, 33030, 33034, 33035

Warning

Failed to perform initialization of IIS state monitoring module.

Health Service

33851, 33853, 33854, 33867, 33868

Warning

Failed to perform Web application discovery.

Health Service

33029

Warning

Failed to perform Web server properties discovery.

Health Service

33004

Warning

Failed to perform Web site discovery.

Health Service

33005, 33019, 33020, 33021, 33036, 33037, 33038

Warning

Failed to retrieve application pool state.

Health Service

33858, 33859, 33862

Warning

Failed to retrieve site state.

Health Service

33852, 33857, 33860, 33863, 33864, 33865, 33866

Warning

IIS component discovery failed due to insufficient privileges.

Health Service

33015

Warning

Agent update that is required for IIS 7.0 monitoring is not installed.

Health Service

4507

Error

社群新增項目

顯示: