Microsoft-Windows-IIS-W3SVC-WP
Event ID 2201: HTTP Server could not initialize its security
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 2203: HTTP Server could not initialize the socket library
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 2204: HTTP Server was unable to initialize due to a shortage of available memory
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 2206: HTTP Server could not create the main connection socket
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 2208: HTTP Server could not create a client connection object for user at host
#Fields #
| Name | Description |
|---|---|
HostAddress UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2214: The HTTP Filter DLL IsapiFilter failed to load
#Fields #
| Name | Description |
|---|---|
IsapiFilter UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2216: The script started from the URL 'Url' has not responded within the configured timeout period
#Fields #
| Name | Description |
|---|---|
Url UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2218: The HTTP server encountered an error processing the server side include file 'File'
#Fields #
| Name | Description |
|---|---|
File UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2219: The HTTP server encountered an unhandled exception while processing the ISAPI Application 'IsapiExtension'
#Fields #
| Name | Description |
|---|---|
IsapiExtension UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2220: The HTTP server was unable to load the ISAPI Application 'IsapiExtension'
#Fields #
| Name | Description |
|---|---|
IsapiExtension UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2221: A server side include file has included itself or the maximum depth of server side includes has been exceeded
#Event ID 2223: For compatibility with previous versions of IIS, the filter 'IsapiFilter' was loaded as a global filter from the registry
#Fields #
| Name | Description |
|---|---|
IsapiFilter UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2226: The server was unable to read the file File due to a lack of access permissions
#Fields #
| Name | Description |
|---|---|
File UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2227: The server was unable to acquire a license for a SSL connection
#Event ID 2228: The server stop serving requests for application 'Application' because the number of Out of Process component crashes exceed a limit
#Fields #
| Name | Description |
|---|---|
Application UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2229: The server failed to shut down application 'Application'
#Fields #
| Name | Description |
|---|---|
Application UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2230: The server was unable to read the file
#Fields #
| Name | Description |
|---|---|
File UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2231: The server was unable to read the file
#Fields #
| Name | Description |
|---|---|
File UnicodeString | |
Win32Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2232: The server was unable to read the file
#Fields #
| Name | Description |
|---|---|
File UnicodeString | |
MaxSize UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2233: The server was unable to allocate a buffer to read the file
#Fields #
| Name | Description |
|---|---|
File UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2236: The server failed to load application 'Application'
#Fields #
| Name | Description |
|---|---|
Application UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2237: Out of process application 'Application' terminated unexpectedly
#Fields #
| Name | Description |
|---|---|
Application UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2238: Job object query failed
#Event ID 2239: Job object set limit failed
#Event ID 2240: Schedule a work item for CPU Accounting or Limits failed
#Event ID 2241: Site 'Site' hit its CPU Limit
#Fields #
| Name | Description |
|---|---|
Site UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2242: Site 'Site' hit its CPU Limit
#Fields #
| Name | Description |
|---|---|
Site UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2243: Site 'Site' hit its CPU Limit
#Fields #
| Name | Description |
|---|---|
Site UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2244: Site 'Site' hit its CPU Limit
#Fields #
| Name | Description |
|---|---|
Site UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2245: The server certificate for instance 'Instance' has expired or is not yet valid
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2246: The server certificate for instance 'Instance' has been revoked
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2247: The server certificate chain does not include a trusted root certificate
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2248: A certificate in the server certificate chain has an invalid signature
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2249: CPU Limits/Accounting failed to queue work item
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 2250: The World Wide Web Publishing Service (WWW Service) could not retrieve the server certificate for instance 'Instance' because the associated IIS configuration store data is invalid
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2251: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because of a CryptoAPI error
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2252: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because the certificate could not be found in a certificate store
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2253: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because of an internal error
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2254: The server Certificate Trust List for instance 'Instance' had invalid IIS configuration store data associated with it and could not be retrieved; the error encountered was 'Error'
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2255: The World Wide Web Publishing Service (WWW Service) failed to retrieve the server Certificate Trust List for instance 'Instance' because of a CryptoAPI error
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2256: The World Wide Web Publishing Service (WWW Service) did not retrieve the server Certificate Trust List for instance 'Instance' because it could not be found in the certificate store
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2257: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because of an internal error
#Fields #
| Name | Description |
|---|---|
Instance UnicodeString | |
Error UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2258: The server failed to close client connections to the following URLs during shutdown: 'UrlList'
#Fields #
| Name | Description |
|---|---|
UrlList UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2259: The COM Application 'ComPlusApplication' at 'Path' failed to activate out of process
#Fields #
| Name | Description |
|---|---|
ComPlusApplication UnicodeString | |
Path UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2261: An attempt was made to load filter 'IsapiFilter' but it requires the SF_NOTIFY_READ_RAW_DATA filter notification and this notification is not supported in this IIS version
#Fields #
| Name | Description |
|---|---|
IsapiFilter UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2262: ISAPI 'IsapiExtension' reported itself as unhealthy for the following reason: 'UnhealthyReason'
#Fields #
| Name | Description |
|---|---|
IsapiExtension UnicodeString | |
UnhealthyReason UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2263: ISAPI 'IsapiExtension' reported itself as unhealthy
#Fields #
| Name | Description |
|---|---|
IsapiExtension UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2264: The directory specified for caching compressed content Directory is invalid
#Fields #
| Name | Description |
|---|---|
Directory UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2265: The registry key for IIS subauthenticator is not configured correctly on local machine, the anonymous password sync feature is disabled
#Event ID 2266: The account that the current worker process is running under does not have SeTcbPrivilege privilege, the anonymous password sync feature and the Digest authentication feature are disabled
#Event ID 2268: Could not load all ISAPI filters for site 'SiteName'
#Fields #
| Name | Description |
|---|---|
SiteName UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2269: The worker process for app pool 'ApplicationPool', PID='PID', failed to initialize the http
#Fields #
| Name | Description |
|---|---|
ApplicationPool UnicodeString | |
PID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2270: IIS Client certificate mapping configuration for site Site failed to be loaded
#Fields #
| Name | Description |
|---|---|
Site UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2271: Could not initialize the logging module for site
#Fields #
| Name | Description |
|---|---|
Site UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2272: The registry key for IIS subauthenticator is not configured correctly on domain controller, the Digest feature is disabled
#Event ID 2273: Worker process could not access IIS configuration store due to disconnection error
#Event ID 2274: ISAPI Filter 'IsapiFilter' could not be loaded due to a configuration problem
#Fields #
| Name | Description |
|---|---|
IsapiFilter UnicodeString | |
ProcessorArchitecture UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2275: ETW Tracing support failed to intialize
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 2276: The worker process failed to initialize correctly and therefore could not be started
#Event ID 2280: The Module DLL ModuleDll failed to load
#Fields #
| Name | Description |
|---|---|
ModuleDll UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2281: The worker process failed to initialize communication with the W3SVC and therefore could not be started
#Event ID 2282: The Module DLL 'ModuleDll' could not be loaded due to a configuration problem
#Fields #
| Name | Description |
|---|---|
ModuleDll UnicodeString | |
ProcessorArchitecture UnicodeString | |
__binLength UInt32 | |
binary Binary |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Splunk # view in coverage
T1505, T1505.004
Event ID 2283: FailedRequestTracing module failed to create directory 'Directory'
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
Directory UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2284: FailedRequestTracing module failed to write buffered events to log file for the request that matched failure definition
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2285: FailedRequestTracing module detected invalid configuration on path 'Path'
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
InvalidConfig UnicodeString | |
Path UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2286: FailedRequestTracing module detected invalid configuration on path 'Path'
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
InvalidConfig UnicodeString | |
Path UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2287: FailedRequestTracing module encountered problem while reading configuration
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
ConfigException UnicodeString | |
File UnicodeString | |
LineNumber UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2288: FailedRequestTracing module encountered problem while reading configuration
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2289: FailedRequestTracing Module failed to delete at least one log file from the directory 'Directory'
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
Directory UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2290: FailedRequestTracing module encountered runtime error
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2291: FailedRequestTracing module detected invalid configuration on path 'Path'
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
InvalidConfig UnicodeString | |
Path UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2292: FailedRequestTracing module failed to create XSL file '
#Fields #
| Name | Description |
|---|---|
FailureCount UnicodeString | |
Minutes UnicodeString | |
XslFile UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2293: The Module name ModuleDll path Path returned an error from registration
#Fields #
| Name | Description |
|---|---|
ModuleDll UnicodeString | |
Path UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2294: The worker process failed to pre-load
#Fields #
| Name | Description |
|---|---|
CLRRunTimeVersion UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2295: Failed to find the RegisterModule entrypoint in the module DLL
#Fields #
| Name | Description |
|---|---|
ModuleDll UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2296: The Module name 'ModuleName' path 'ModuleDll' has an invalid precondition 'PreCondition'
#Fields #
| Name | Description |
|---|---|
ModuleName UnicodeString | |
ModuleDll UnicodeString | |
PreCondition UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2297: The worker process for application pool 'WsusPool' encountered an error 'Configuration file is not well-formed XML ' trying to read global module c...
#Fields #
| Name | Description |
|---|---|
ApplicationPool | |
ConfigException | |
FileName | |
LineNumber | |
__binLength | |
binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-W3SVC-WP",
"guid": "{670080D9-742A-4187-8D16-41143D1290BD}",
"event_source_name": "W3SVC-WP",
"event_id": 2297,
"version": 0,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 10:58:56.614958+00:00",
"event_record_id": 8249,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "tel2-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"ApplicationPool": "WsusPool",
"ConfigException": "Configuration file is not well-formed XML\n",
"FileName": "\\\\?\\C:\\inetpub\\temp\\apppools\\WsusPool\\WsusPool.config",
"LineNumber": "3",
"Binary": "DQAAAA=="
},
"message": "The worker process for application pool 'WsusPool' encountered an error 'Configuration file is not well-formed XML\n' trying to read global module configuration data from file '\\\\?\\C:\\inetpub\\temp\\apppools\\WsusPool\\WsusPool.config', line number '3'. Worker process startup aborted."
}
Example keys not documented in the fields table: Binary
Event ID 2297: The worker process for application pool 'ApplicationPool' encountered an error 'ConfigException' trying to read global module configuration data from file 'FileName', line number 'LineNumber'
#Fields #
| Name | Description |
|---|---|
ApplicationPool UnicodeString | |
ConfigException UnicodeString | |
FileName UnicodeString | |
LineNumber UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2298: The globalModules list is empty
#Event ID 2299: An application has reported as being unhealthy
#Fields #
| Name | Description |
|---|---|
Reason UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2300: The worker process cannot access the CLR configuration file at 'CLRConfigFileName'
#Fields #
| Name | Description |
|---|---|
CLRConfigFileName UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2301: There was an error during processing of the HTTP Application Preload event
#Event ID 2302: There was an error during processing of the managed application service auto-start for configuration path: 'ConfigPath'
#Fields #
| Name | Description |
|---|---|
ConfigPath UnicodeString | |
ErrorInfo UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2303: There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'
#Fields #
| Name | Description |
|---|---|
ApplicationPool | |
__binLength | |
binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-W3SVC-WP",
"guid": "{670080D9-742A-4187-8D16-41143D1290BD}",
"event_source_name": "W3SVC-WP",
"event_id": 2303,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-03-13T22:03:09.716729+00:00",
"event_record_id": 3944,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"ApplicationPool": "DefaultAppPool",
"Binary": "02000780"
},
"message": ""
}
Example keys not documented in the fields table: Binary
Event ID 2303: There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'
#Fields #
| Name | Description |
|---|---|
ApplicationPool UnicodeString | |
__binLength UInt32 | |
binary Binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-W3SVC-WP",
"event_id": 2303,
"level": 3,
"task": 0,
"opcode": 0,
"time_created": "2026-03-13T22:03:09.7167297+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "Application"
},
"event_data": {
"ApplicationPool": "DefaultAppPool"
}
}
Event ID 2304: There was an unexpected error during the loading of managed runtime version: 'CLRRunTimeVersion'
#Fields #
| Name | Description |
|---|---|
CLRRunTimeVersion UnicodeString | |
CLRLoaderDllPath UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2305: There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'
#Fields #
| Name | Description |
|---|---|
ApplicationPool UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2306: There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'
#Fields #
| Name | Description |
|---|---|
ApplicationPool UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2307: The worker process for application pool 'DefaultAppPool' encountered an error 'Configuration file is not well-formed XML ' trying to read configura...
#Fields #
| Name | Description |
|---|---|
ApplicationPool | |
ConfigException | |
FileName | |
LineNumber | |
__binLength | |
binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-W3SVC-WP",
"guid": "{670080D9-742A-4187-8D16-41143D1290BD}",
"event_source_name": "W3SVC-WP",
"event_id": 2307,
"version": 0,
"level": 2,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 10:58:56.614958+00:00",
"event_record_id": 8248,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "tel2-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"ApplicationPool": "DefaultAppPool",
"ConfigException": "Configuration file is not well-formed XML\n",
"FileName": "\\\\?\\C:\\inetpub\\temp\\apppools\\DefaultAppPool\\DefaultAppPool.config",
"LineNumber": "3",
"Binary": "DQAAAA=="
},
"message": "The worker process for application pool 'DefaultAppPool' encountered an error 'Configuration file is not well-formed XML\n' trying to read configuration data from file '\\\\?\\C:\\inetpub\\temp\\apppools\\DefaultAppPool\\DefaultAppPool.config', line number '3'. The data field contains the error code."
}
Example keys not documented in the fields table: Binary
Event ID 2307: The worker process for application pool 'ApplicationPool' encountered an error 'ConfigException' trying to read configuration data from file 'FileName', line number 'LineNumber'
#Fields #
| Name | Description |
|---|---|
ApplicationPool UnicodeString | |
ConfigException UnicodeString | |
FileName UnicodeString | |
LineNumber UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2308: The loghttp module in the worker process with id 'PID' could not obtain custom log data for 'RequestCount' requests
#Fields #
| Name | Description |
|---|---|
RequestCount UnicodeString | |
PID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2309: The loghttp module in the worker process with id 'PID' removed custom log data for 'Count' request(s) which was not claimed by the W3C Logging Service
#Fields #
| Name | Description |
|---|---|
Count UnicodeString | |
PID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 2310: A worker process with process id of 'ProcessID' serving application pool 'AppPoolID' paged out due to inactivity
#Fields #
| Name | Description |
|---|---|
ProcessID UnicodeString | |
AppPoolID UnicodeString | |
Minutes UnicodeString |
Event ID 2311: The worker process for application pool 'ApplicationPool', PID='PID', failed to duplicate the request queue handle and therefore will not be able to provide transport-level telemetry data during re...
#Fields #
| Name | Description |
|---|---|
ApplicationPool UnicodeString | |
PID UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 1073744047: For compatibility with previous versions of IIS, the filter 'IsapiFilter' was loaded as a global filter from the registry.
#Description
For compatibility with previous versions of IIS, the filter 'IsapiFilter' was loaded as a global filter from the registry. To control the filter with the Internet Service Manager, remove the filter from the registry and add it as a global filter with Internet Service Manager. Filters in the registry are stored at "HKLM\System\CurrentControlSet\Services\W3Svc\Parameters\Filter DLLs".
Message #
Fields #
| Name | Description |
|---|---|
IsapiFilter | |
__binLength | |
binary |
Event ID 1073744134: A worker process with process id of 'ProcessID' serving application pool 'AppPoolID' paged out due to inactivity.
#Event ID 2147485874: The server was unable to read the file File due to a lack of access permissions.
#Event ID 2147485876: The server stop serving requests for application 'Application' because the number of Out of Process component crashes exceed a limit.
#Event ID 2147485877: The server failed to shut down application 'Application'.
#Event ID 2147485879: The server was unable to read the file File.
#Event ID 2147485880: The server was unable to read the file File.
#Event ID 2147485881: The server was unable to allocate a buffer to read the file File.
#Event ID 2147485884: The server failed to load application 'Application'.
#Event ID 2147485885: Out of process application 'Application' terminated unexpectedly.
#Event ID 2147485889: Site 'Site' hit its CPU Limit.
#Event ID 2147485890: Site 'Site' hit its CPU Limit.
#Event ID 2147485891: Site 'Site' hit its CPU Limit.
#Event ID 2147485892: Site 'Site' hit its CPU Limit.
#Event ID 2147485893: The server certificate for instance 'Instance' has expired or is not yet valid.
#Event ID 2147485894: The server certificate for instance 'Instance' has been revoked.
#Event ID 2147485895: The server certificate chain does not include a trusted root certificate.
#Fields #
| Name | Description |
|---|---|
Instance | |
__binLength | |
binary |
Event ID 2147485896: A certificate in the server certificate chain has an invalid signature.
#Fields #
| Name | Description |
|---|---|
Instance | |
__binLength | |
binary |
Event ID 2147485897: CPU Limits/Accounting failed to queue work item.
#Event ID 2147485898: The World Wide Web Publishing Service (WWW Service) could not retrieve the server certificate for instance 'Instance' because the associated IIS configur...
#Event ID 2147485899: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because of a CryptoAPI error.
#Event ID 2147485900: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because the certificate could not be ...
#Event ID 2147485901: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because of an internal error.
#Event ID 2147485902: The server Certificate Trust List for instance 'Instance' had invalid IIS configuration store data associated with it and could not be retrieved; the err...
#Event ID 2147485903: The World Wide Web Publishing Service (WWW Service) failed to retrieve the server Certificate Trust List for instance 'Instance' because of a CryptoAPI e...
#Event ID 2147485904: The World Wide Web Publishing Service (WWW Service) did not retrieve the server Certificate Trust List for instance 'Instance' because it could not be fo...
#Event ID 2147485905: The World Wide Web Publishing Service (WWW Service) did not retrieve the server certificate for instance 'Instance' because of an internal error.
#Event ID 2147485906: The server failed to close client connections to the following URLs during shutdown: 'UrlList'.
#Event ID 2147485910: ISAPI 'IsapiExtension' reported itself as unhealthy for the following reason: 'UnhealthyReason'.
#Event ID 2147485911: ISAPI 'IsapiExtension' reported itself as unhealthy.
#Event ID 2147485912: The directory specified for caching compressed content Directory is invalid.
#Event ID 2147485913: The registry key for IIS subauthenticator is not configured correctly on local machine, the anonymous password sync feature is disabled.
#Event ID 2147485914: The account that the current worker process is running under does not have SeTcbPrivilege privilege, the anonymous password sync feature and the Di...
#Description
The account that the current worker process is running under does not have SeTcbPrivilege privilege, the anonymous password sync feature and the Digest authentication feature are disabled.
Message #
Event ID 2147485920: The registry key for IIS subauthenticator is not configured correctly on domain controller, the Digest feature is disabled.
#Event ID 2147485921: Worker process could not access IIS configuration store due to disconnection error.
#Description
Worker process could not access IIS configuration store due to disconnection error. Marking process as unhealthy.
Message #
Event ID 2147485923: ETW Tracing support failed to intialize.
#Event ID 2147485931: FailedRequestTracing module failed to create directory 'Directory'.
#Event ID 2147485932: FailedRequestTracing module failed to write buffered events to log file for the request that matched failure definition.
#Description
FailedRequestTracing module failed to write buffered events to log file for the request that matched failure definition. No logs will be generated until this condition is corrected. The problem happened at least FailureCount times in the last Minutes minutes. The data is the error.
Message #
Fields #
| Name | Description |
|---|---|
FailureCount | |
Minutes | |
__binLength | |
binary |
Event ID 2147485933: FailedRequestTracing module detected invalid configuration on path 'Path'.
#Description
FailedRequestTracing module detected invalid configuration on path 'Path'. Trace provider or tracing area name 'InvalidConfig' is not recognized. Check the <traceProviderDefinitions> section for currently supported list or providers and areas. No logs will be generated until this condition is corrected. The problem happened at least FailureCount times in the last Minutes minutes. The data is the error.
Message #
Fields #
| Name | Description |
|---|---|
FailureCount | |
Minutes | |
InvalidConfig | |
Path | |
__binLength | |
binary |
Event ID 2147485934: FailedRequestTracing module detected invalid configuration on path 'Path'.
#Description
FailedRequestTracing module detected invalid configuration on path 'Path'. Attribute "statusCode" contains invalid value 'InvalidConfig'. Examples of valid status are '404' or '403.1'. No logs will be generated until this condition is corrected. The problem happened at least FailureCount times in the last Minutes minutes. The data is the error.
Message #
Fields #
| Name | Description |
|---|---|
FailureCount | |
Minutes | |
InvalidConfig | |
Path | |
__binLength | |
binary |
Event ID 2147485935: FailedRequestTracing module encountered problem while reading configuration.
#Description
FailedRequestTracing module encountered problem while reading configuration. Configuration system returned exception 'ConfigException' in file File on line LineNumber. No logs will be generated until this condition is corrected. The problem happened at least FailureCount times in the last Minutes minutes. The data is the error.
Message #
Fields #
| Name | Description |
|---|---|
FailureCount | |
Minutes | |
ConfigException | |
File | |
LineNumber | |
__binLength | |
binary |
Event ID 2147485936: FailedRequestTracing module encountered problem while reading configuration.
#Description
FailedRequestTracing module encountered problem while reading configuration. No logs will be generated until this condition is corrected. The problem happened at least FailureCount times in the last Minutes minutes. The data is the error.
Message #
Fields #
| Name | Description |
|---|---|
FailureCount | |
Minutes | |
__binLength | |
binary |
Event ID 2147485937: FailedRequestTracing Module failed to delete at least one log file from the directory 'Directory'.
#Event ID 2147485938: FailedRequestTracing module encountered runtime error.
#Event ID 2147485939: FailedRequestTracing module detected invalid configuration on path 'Path'.
#Description
FailedRequestTracing module detected invalid configuration on path 'Path'. Attribute "guid" in <traceProviderDefinitions> section contains invalid value 'InvalidConfig'. No logs will be generated until this condition is corrected. The problem happened at least FailureCount times in the last Minutes minutes. The data is the error.
Message #
Fields #
| Name | Description |
|---|---|
FailureCount | |
Minutes | |
InvalidConfig | |
Path | |
__binLength | |
binary |
Event ID 2147485940: FailedRequestTracing module failed to create XSL file 'XslFile.
#Event ID 2147485942: The worker process failed to pre-load .
#Event ID 2147485946: The globalModules list is empty.
#Description
The globalModules list is empty. No requests can be served successfully.
Message #
Event ID 2147485948: The worker process cannot access the CLR configuration file at 'CLRConfigFileName'.
#Event ID 2147485949: There was an error during processing of the HTTP Application Preload event.
#Description
There was an error during processing of the HTTP Application Preload event. Modules and/or applications relying upon this event may not have been initialized properly. The data field contains the error code.
Message #
Event ID 2147485951: There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'.
#Description
There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'. Some application services may not have been processed correctly. Please check the configuration for application service auto-start for the application(s) assigned to this application pool. The data field contains the error code.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationPool | |
__binLength | |
binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-IIS-W3SVC-WP",
"event_id": 2303,
"level": 3,
"task": 0,
"opcode": 0,
"time_created": "2026-03-13T22:03:09.7167297+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "Application"
},
"event_data": {
"ApplicationPool": "DefaultAppPool"
}
}
Event ID 2147485953: There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'.
#Description
There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'. The configured .Net Framework for this application pool doesn't support managed application services. As a result, no managed application service auto-start has been completed. To resolve this issue, please change the .Net Framework version configured for this application pool to one that supports managed application service. The data field contains the error code.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationPool | |
__binLength | |
binary |
Event ID 2147485954: There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'.
#Description
There was an error during processing of the managed application service auto-start for application pool: 'ApplicationPool'. The loading of application service provider objects is not supported if the pipeline mode is set to 'Classic' mode. As a result, no managed application service auto-start has been completed. To resolve this issue, please change the pipeline mode for this application pool to 'Integrated' mode. The data field contains the error code.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationPool | |
__binLength | |
binary |
Event ID 3221227673: HTTP Server could not initialize its security.
#Event ID 3221227676: HTTP Server was unable to initialize due to a shortage of available memory.
#Event ID 3221227678: HTTP Server could not create the main connection socket.
#Event ID 3221227680: HTTP Server could not create a client connection object for user at host HostAddress.
#Event ID 3221227686: The HTTP Filter DLL IsapiFilter failed to load.
#Event ID 3221227688: The script started from the URL 'Url' has not responded within the configured timeout period.
#Event ID 3221227690: The HTTP server encountered an error processing the server side include file 'File'.
#Event ID 3221227691: The HTTP server encountered an unhandled exception while processing the ISAPI Application 'IsapiExtension'.
#Event ID 3221227692: The HTTP server was unable to load the ISAPI Application 'IsapiExtension'.
#Event ID 3221227693: A server side include file has included itself or the maximum depth of server side includes has been exceeded.
#Event ID 3221227699: The server was unable to acquire a license for a SSL connection.
#Event ID 3221227710: Job object query failed.
#Description
Job object query failed. The data is the error.
Message #
Event ID 3221227711: Job object set limit failed.
#Description
Job object set limit failed. The data is the error.
Message #
Event ID 3221227712: Schedule a work item for CPU Accounting or Limits failed.
#Description
Schedule a work item for CPU Accounting or Limits failed. The data is the error.
Message #
Event ID 3221227731: The COM Application 'ComPlusApplication' at 'Path' failed to activate out of process.
#Event ID 3221227733: An attempt was made to load filter 'IsapiFilter' but it requires the SF_NOTIFY_READ_RAW_DATA filter notification and this notification is not supported in t...
#Event ID 3221227740: Could not load all ISAPI filters for site 'SiteName'.
#Event ID 3221227741: The worker process for app pool 'ApplicationPool', PID='PID', failed to initialize the http.
#Description
The worker process for app pool 'ApplicationPool', PID='PID', failed to initialize the http.sys communication when asked to start processing http requests and therefore will be considered ill by W3SVC and terminated. The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationPool | |
PID | |
__binLength | |
binary |
Event ID 3221227742: IIS Client certificate mapping configuration for site Site failed to be loaded.
#Event ID 3221227743: Could not initialize the logging module for site Site.
#Event ID 3221227746: ISAPI Filter 'IsapiFilter' could not be loaded due to a configuration problem.
#Description
ISAPI Filter 'IsapiFilter' could not be loaded due to a configuration problem. The current configuration only supports loading images built for a ProcessorArchitecture processor architecture. The data field contains the error number. To learn more about this issue, including how to troubleshooting this kind of processor architecture mismatch error, see http://go.microsoft.com/fwlink/?LinkId=29349.
Message #
Fields #
| Name | Description |
|---|---|
IsapiFilter | |
ProcessorArchitecture | |
__binLength | |
binary |
Event ID 3221227748: The worker process failed to initialize correctly and therefore could not be started.
#Description
The worker process failed to initialize correctly and therefore could not be started. The data is the error.
Message #
Event ID 3221227752: The Module DLL ModuleDll failed to load.
#Event ID 3221227753: The worker process failed to initialize communication with the W3SVC and therefore could not be started.
#Description
The worker process failed to initialize communication with the W3SVC and therefore could not be started. The data is the error.
Message #
Event ID 3221227754: The Module DLL 'ModuleDll' could not be loaded due to a configuration problem.
#Description
The Module DLL 'ModuleDll' could not be loaded due to a configuration problem. The current configuration only supports loading images built for a ProcessorArchitecture processor architecture. The data field contains the error number. To learn more about this issue, including how to troubleshooting this kind of processor architecture mismatch error, see http://go.microsoft.com/fwlink/?LinkId=29349.
Message #
Fields #
| Name | Description |
|---|---|
ModuleDll | |
ProcessorArchitecture | |
__binLength | |
binary |
Event ID 3221227765: The Module name ModuleDll path Path returned an error from registration.
#Event ID 3221227766: The worker process failed to pre-load.
#Event ID 3221227767: Failed to find the RegisterModule entrypoint in the module DLL ModuleDll.
#Event ID 3221227768: The Module name 'ModuleName' path 'ModuleDll' has an invalid precondition 'PreCondition'.
#Event ID 3221227769: The worker process for application pool 'ApplicationPool' encountered an error 'ConfigException' trying to read global module configuration data from file 'FileName', line number ...
#Description
The worker process for application pool 'ApplicationPool' encountered an error 'ConfigException' trying to read global module configuration data from file 'FileName', line number 'LineNumber'. Worker process startup aborted.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationPool | |
ConfigException | |
FileName | |
LineNumber | |
__binLength | |
binary |
Event ID 3221227771: An application has reported as being unhealthy.
#Event ID 3221227774: There was an error during processing of the managed application service auto-start for configuration path: 'ConfigPath'.
#Description
There was an error during processing of the managed application service auto-start for configuration path: 'ConfigPath'. The error message returned is: 'ErrorInfo'. The worker process will be marked unhealthy and be shutdown. The data field contains the error code.
Message #
Fields #
| Name | Description |
|---|---|
ConfigPath | |
ErrorInfo | |
__binLength | |
binary |
Event ID 3221227776: There was an unexpected error during the loading of managed runtime version: 'CLRRunTimeVersion'.
#Description
There was an unexpected error during the loading of managed runtime version: 'CLRRunTimeVersion'. The managed runtime loader 'CLRLoaderDllPath' was unable to load the managed runtime. The data field contains the error code.
Message #
Fields #
| Name | Description |
|---|---|
CLRRunTimeVersion | |
CLRLoaderDllPath | |
__binLength | |
binary |
Event ID 3221227779: The worker process for application pool 'ApplicationPool' encountered an error 'ConfigException' trying to read configuration data from file 'FileName', line number 'LineNumber'.
#Description
The worker process for application pool 'ApplicationPool' encountered an error 'ConfigException' trying to read configuration data from file 'FileName', line number 'LineNumber'. The data field contains the error code.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationPool | |
ConfigException | |
FileName | |
LineNumber | |
__binLength | |
binary |
Event ID 3221227780: The loghttp module in the worker process with id 'PID' could not obtain custom log data for 'RequestCount' requests.
#Event ID 3221227781: The loghttp module in the worker process with id 'PID' removed custom log data for 'Count' request(s) which was not claimed by the W3C Logging Service.
#Event ID 3221227783: The worker process for application pool 'ApplicationPool', PID='PID', failed to duplicate the request queue handle and therefore will not be able to provide tran...
#Description
The worker process for application pool 'ApplicationPool', PID='PID', failed to duplicate the request queue handle and therefore will not be able to provide transport-level telemetry data during request processing. The data field contains the error number.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationPool | |
PID | |
__binLength | |
binary |
Provenance
ETW provider GUID 670080d9-742a-4187-8d16-41143d1290bd
Defined in iisres.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB