Home
  •  

WAS received a change notification, but was unable to process it correctly

Microsoft.Windows.InternetInformationServices.2008.WAS.received.a.change.notification.but.was.unable.to.process.it.correctly (Rule)

Knowledge Base article:

Summary

The Internet Information Services (IIS) Windows Process Activation Service (WAS) configuration manager manages configuration for the application pools and protocol adapters that it maintains. If WAS encounters problems when it reads configuration or reacts to configuration change notifications, configuration changes for the entities it manages may not be processed.

Resolutions

Stop and restart WAS

If a configuration change has to take effect immediately, stop and restart the Windows Process Activation Service (WAS). Stopping WAS will also stop the World Wide Web Publishing Service (W3SVC) if W3SVC is running. Thus, you may also have to start W3SVC.

To stop and restart WAS:

Element properties:

TargetMicrosoft.Windows.InternetInformationServices.2008.WebServer
CategoryAlert
EnabledTrue
Event_ID5053
Event SourceMicrosoft-Windows-WAS
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
WAS received a change notification, but was unable to process it correctly
{0}
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WA WriteAction Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.InternetInformationServices.2008.WAS.received.a.change.notification.but.was.unable.to.process.it.correctly" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.InternetInformationServices.2008.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-WAS</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>5053</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.2008.WAS.received.a.change.notification.but.was.unable.to.process.it.correctly.AlertMessage"]$</AlertMessageId>

    </WriteAction>

  </WriteActions>

</Rule>