Web sites and Web applications depend on the availability of Internet Information Services (IIS) application pools. IIS application pools in turn depend on the Windows Process Activation Service (WAS). If WAS is not running or errors occur during the startup or shutdown of an application pool, Web sites and Web applications may not be available.
Check an unexpected worker process failure
To resolve this issue, examine the event log message for an error number that may indicate why the worker process is failing. This error number will be different from the Event ID.
Examine the event log message details for an error number that can provide additional information
To examine the event log message details for an error number that can provide additional information:
In the Event Viewer, select the event that you received.
Click the Details tab, then Friendly View.
If a specific error number is available, the words Binary data: should appear.
Below In Words, note the number after the colon.
Find out more about a specific error number
To learn more about a specific error number:
Download the Err.exe utility from the Microsoft Exchange Server Error Code Look-up page.
Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
At the command prompt, navigate to the directory where you downloaded Err.exe. For example, if you downloaded err.exe to C:\Err, type cd C:\Err.
Type err errornumber to obtain more information about the error. For example, if the specific error number is 80070005, type err 80070005.
In the example in Step 4, the error resolves to ERROR_ACCESS_DENIED, so your next step would be to check for a permissions issue.
| Target | Microsoft.Windows.InternetInformationServices.2008.ApplicationPool | ||
| Category | Alert | ||
| Enabled | True | ||
| Alert Generate | True | ||
| Alert Severity | Warning | ||
| Alert Priority | Normal | ||
| Remotable | True | ||
| Alert Message |
|
| ID | Module Type | TypeId | RunAs |
|---|---|---|---|
| DS | DataSource | Microsoft.Windows.Server.IIS.2008.WarningAndErrorEventProvider | Default |
| Filter | ConditionDetection | Microsoft.Windows.InternetInformationServices.2008.ApplicationPool.EventFilter | Default |
| WA | WriteAction | Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription | Default |
Home
ENU <Rule ID="Microsoft.Windows.InternetInformationServices.2008.WAS.encountered.an.internal.error.in.its.process.management.of.a.worker.process" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.InternetInformationServices.2008.ApplicationPool" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Windows.Server.IIS.2008.WarningAndErrorEventProvider">
<LogName>System</LogName>
</DataSource>
</DataSources>
<ConditionDetection ID="Filter" TypeID="Microsoft.Windows.InternetInformationServices.2008.ApplicationPool.EventFilter">
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>5014</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-WAS</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</ConditionDetection>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.2008.WAS.encountered.an.internal.error.in.its.process.management.of.a.worker.process.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>