WAS did not run the automatic shutdown executable for application pool

Microsoft.Windows.InternetInformationServices.10.0.WAS.did.not.run.the.automatic.shutdown.executable.for.application.pool (Rule)

Knowledge Base article:

Summary

Web sites and Web applications depend on the availability of Internet Information Services (IIS) application pools. IIS application pools in turn depend on the Windows Process Activation Service (WAS). If WAS is not running or errors occur during the startup or shutdown of an application pool, Web sites and Web applications may not be available.

Resolutions

Check the automatic shutdown executable

A user-specified executable file can be configured to run automatically when an application pool is being shut down by the World Wide Web Publishing Service (W3SVC). The executable file can, for example, redirect traffic for the application pool to another server. The file can be specified in IIS Manager and is represented by the autoShutdownExe attribute of the system.applicationHost/applicationPools/failure section in the ApplicationHost.config file.

If the autoShutdownExe process fails to run, possible resolutions include the following:

Check that the path and filename are correctly specified

Check the Access Control List for the shutdown executable

Make sure the program can execute independently

Test run the executable program separately from an application pool shutdown event. If the process can run independently of an application pool shutdown, it should run properly when the application pool is automatically disabled by WAS.

Element properties:

TargetMicrosoft.Windows.InternetInformationServices.10.0.ApplicationPool
CategoryAlert
EnabledTrue
Alert GenerateFalse
RemotableTrue

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.Server.IIS.10.0.WarningAndErrorEventProvider Default
Filter ConditionDetection Microsoft.Windows.InternetInformationServices.10.0.ApplicationPool.EventFilter Default
WA WriteAction Microsoft.Windows.Server.IIS.10.0.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.InternetInformationServices.10.0.WAS.did.not.run.the.automatic.shutdown.executable.for.application.pool" Enabled="true" Target="Microsoft.Windows.InternetInformationServices.10.0.ApplicationPool" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.Server.IIS.10.0.WarningAndErrorEventProvider">
<LogName>System</LogName>
</DataSource>
</DataSources>
<ConditionDetection ID="Filter" TypeID="Microsoft.Windows.InternetInformationServices.10.0.ApplicationPool.EventFilter">
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesRegularExpression</Operator>
<Pattern>^(5054|5091)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-WAS</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</ConditionDetection>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.10.0.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.10.0.WAS.did.not.run.the.automatic.shutdown.executable.for.application.pool.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>