Some IIS events are not detected by the IIS Management Pack

This article helps you resolve the problem where certain Microsoft Internet Information Services (IIS) events are not detected by the IIS Management Pack.

Original product version:   Internet Information Services 7.5, 7.0
Original KB number:   2635429

Symptoms

When monitoring an IIS 7.0 or 7.5 web site with System Center Operations Manager by using the IIS Management Pack, certain IIS events are not detected by System Center Operations Manager. This problem occurs even though the same IIS events do appear in the Windows event logs. Specifically, events with ID 2269, 2276, 2280, 2281, and 2282 from source Microsoft-Windows-IIS-W3SVC-WP are not detected.

For example, the following event may be logged to the Application event log, but not be reported by System Center Operations Manager:

 Log Name:      Application  
 Source:        Microsoft-Windows-IIS-W3SVC-WP  
 Date:          DateTime  
 Event ID:      2281  
 Task Category: None  
 Level:         Error  
 Keywords:      Classic  
 User:          N/A  
 Computer:      MACHINENAME  
 Description:  
 The worker process failed to initialize communication with the W3SVC and therefore could not be started.  
 The data is the error.

Cause

System Center Operations Manager is monitoring for events ranged 2201-2307 to be logged with a source of Microsoft-Windows-IIS-WMSVC, which is incorrect. The correct source for these events is Microsoft-Windows-IIS-W3SVC-WP.

Resolution

To work around this problem, create a custom rule in System Center Operations Manager to look for the correct event source of Microsoft-Windows-IIS-W3SVC-WP.

More information

Microsoft has confirmed that this problem is due to an issue in the IIS Management Pack and the associated IIS documentation. The following table lists the correct event source and event ID pairs: