WAS terminated unexpectedly and the system was not configured to restart it

Microsoft.Windows.InternetInformationServices.2008.WAS.terminated.unexpectedly.and.the.system.was.not.configured.to.restart.it (Rule)

Knowledge Base article:

Summary

The Internet Information Services (IIS) Windows Process Activation Service (WAS) is needed for most Web sites because it supports the World Wide Web Publishing Service (W3SVC), which handles HTTP requests. The WAS Process Manager maps application pools to existing worker processes and spawns new instances of W3SVC to host new application pools as needed. If WAS is not available, most Web sites will not start.

Resolutions

Manually restart WAS or configure it to restart automatically

Possible resolutions include the following:

Manually restart WAS

To restart WAS manually:

Note: Because the World Wide Web Publishing Service (W3SVC) depends on WAS, you may need to start W3SVC after you start WAS.

Configure WAS to restart automatically

To configure WAS to restart automatically:

The Recovery tab also has other actions you can specify when WAS fails. These include the following:

For more information about these options, on the Recovery tab, click Help me set up recovery actions.

Element properties:

TargetMicrosoft.Windows.InternetInformationServices.2008.WebServer
CategoryAlert
EnabledTrue
Event_ID5030
Event SourceMicrosoft-Windows-WAS
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
WAS terminated unexpectedly and the system was not configured to restart it
{0}
Event LogSystem

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WA WriteAction Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription Default

Source Code:

<Rule ID="Microsoft.Windows.InternetInformationServices.2008.WAS.terminated.unexpectedly.and.the.system.was.not.configured.to.restart.it" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.InternetInformationServices.2008.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-WAS</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>5030</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.2008.WAS.terminated.unexpectedly.and.the.system.was.not.configured.to.restart.it.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>