Internet Information Services (IIS) worker processes serve an application pool and can be in a starting, running, stopping, or unknown state. In IIS 7, worker processes are managed by WAS (the Windows Process Activation Service). If a worker process fails to respond, it may be recycled by WAS.
Check worker process initialization failure
If a worker process fails to initialize, check the event log message for a specific error number included in the message. This error number will be different from the Event ID. To do this, see the following steps.
Check for a specific error number
To check for a specific error number:
In the Event Viewer, select the event that you received.
Click the Details tab, then Friendly View.
If a specific error number is available, the words Binary data: should appear.
Below In Words, note the number after the colon.
Find out more about a specific error number
To learn more about a specific error number:
Download the Err.exe utility from the Microsoft Exchange Server Error Code Look-up page.
Open an elevated Command Prompt window. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
At the command prompt, navigate to the directory where you downloaded Err.exe. For example, if you downloaded Err.exe to C:\Err, type cd C:\Err.
Type err errornumber to obtain more information about the error. For example, if the specific error number is 80070005, type err 80070005.
In the example in Step 4, the error resolves to ERROR_ACCESS_DENIED, so your next step would be to check permissions related to the worker process.
| Target | Microsoft.Windows.InternetInformationServices.2008.WebServer | ||
| Category | Alert | ||
| Enabled | True | ||
| Event Source | Microsoft-Windows-IIS-W3SVC-WP | ||
| Alert Generate | True | ||
| Alert Severity | Warning | ||
| Alert Priority | Normal | ||
| Remotable | True | ||
| Alert Message |
| ||
| Event Log | Application |
| ID | Module Type | TypeId | RunAs |
|---|---|---|---|
| DS | DataSource | Microsoft.Windows.EventProvider | Default |
| WA | WriteAction | Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription | Default |
Home
ENU <Rule ID="Microsoft.Windows.InternetInformationServices.2008.Worker.process.encountered.an.error.during.initialization" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.InternetInformationServices.2008.WebServer" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-IIS-W3SVC-WP</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesRegularExpression</Operator>
<Pattern>^(2279|2278|2277)$</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Windows.Server.IIS.2008.GenerateAlertAction.SuppressedByDescription">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.InternetInformationServices.2008.Worker.process.encountered.an.error.during.initialization.AlertMessage"]$</AlertMessageId>
</WriteAction>
</WriteActions>
</Rule>