Home
  •  

SF_NOTIFY_READ_RAW_DATA filter notification is not supported in IIS 7

Microsoft.Windows.InternetInformationServices.2008.SFNOTIFYREADRAWDATA.filter.notification.is.not.supported.in.IIS.7 (Rule)

Knowledge Base article:

Summary

Internet Information Services (IIS) ISAPI (Internet Server Application Programming Interface) extensions and filters can extend and modify the request-processing capabilities of IIS. ISAPI filters require a long time to be written, offer no native support for session handling, and can be cumbersome to maintain. IIS 6.0 and IIS 7 run ISAPI applications in isolation to enhance server stability. While ISAPI filters can still be used in IIS 7, it is easier for developers to add managed or native modules that integrate into IIS 7’s new modular architecture.

Resolutions

SF_NOTIFY_READ_RAW_DATA not supported on IIS 7

IIS 7 no longer supports the SF_NOTIFY_READ_RAW_DATA notification for ISAPI filters. If you have to use an ISAPI Filter that requires this notification, you must run the filter on IIS 6.0 in IIS 5.0 Isolation Mode (however, notice that this is not a recommended practice). For more information, see the article Information about ISAPI filters that register the SF_NOTIFY_READ_RAW_DATA event in Internet Information Services version 6.0.

Element properties:

TargetMicrosoft.Windows.InternetInformationServices.2008.WebServer
CategoryAlert
EnabledTrue
Event_ID2261
Event SourceMicrosoft-Windows-IIS-WMSVC
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
SF_NOTIFY_READ_RAW_DATA filter notification is not supported in IIS 7
{0}
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WA WriteAction Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.InternetInformationServices.2008.SFNOTIFYREADRAWDATA.filter.notification.is.not.supported.in.IIS.7" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.InternetInformationServices.2008.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-IIS-WMSVC</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>2261</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.2008.SFNOTIFYREADRAWDATA.filter.notification.is.not.supported.in.IIS.7.AlertMessage"]$</AlertMessageId>

    </WriteAction>

  </WriteActions>

</Rule>