Microsoft-Windows-WAS

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "WAS",
    "event_id": 5009,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 10:58:46.962519+00:00",
    "event_record_id": 4022,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "DefaultAppPool",
    "ProcessID": "6172",
    "ExitCode": "fffffffe"
  },
  "message": "A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '6172'. The process exit code was '0xfffffffe'."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "",
    "event_id": 5011,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T03:52:46.6110972+00:00",
    "event_record_id": 5952,
    "correlation": {},
    "execution": {
      "process_id": 3524,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "DefaultAppPool",
    "ProcessID": "1992"
  },
  "message": "A process serving application pool 'DefaultAppPool' suffered a fatal communication error with the Windows Process Activation Service. The process id was '1992'. The data field contains the error number."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "",
    "event_id": 5021,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T01:44:54.4190216+00:00",
    "event_record_id": 35181,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "CatalogBadPool"
  },
  "message": "The identity of application pool CatalogBadPool is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request.  If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "WAS",
    "event_id": 5053,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 10:58:56.098770+00:00",
    "event_record_id": 4026,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Binary": "MgAHgA=="
  },
  "message": "The Windows Process Activation Service received a change notification, but was unable to process it correctly.  The data field contains the error number."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "",
    "event_id": 5057,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T01:44:54.4190216+00:00",
    "event_record_id": 35182,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "CatalogBadPool"
  },
  "message": "Application pool CatalogBadPool has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "",
    "event_id": 5059,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T01:44:54.4190216+00:00",
    "event_record_id": 35183,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "CatalogBadPool"
  },
  "message": "Application pool CatalogBadPool has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "WAS",
    "event_id": 5078,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 17:33:30.560265+00:00",
    "event_record_id": 2681,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ProcessID": "8884",
    "AppPoolID": "WsusPool",
    "Binary": ""
  },
  "message": "An ISAPI reported an unhealthy condition to its worker process. Therefore, the worker process with process id of '8884' serving application pool 'WsusPool' has requested a recycle."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "WAS",
    "event_id": 5079,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-03-13T20:16:26.174943+00:00",
    "event_record_id": 11750,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "EvtGenPool1",
    "Binary": ""
  },
  "message": ""
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "WAS",
    "event_id": 5080,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-08 18:05:07.067619+00:00",
    "event_record_id": 3038,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "tel2-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "WsusPool",
    "Binary": ""
  },
  "message": "The worker processes serving application pool 'WsusPool' are being recycled due to 1 or more configuration changes in the application pool properties which necessitate a restart of the processes."
}

{
  "system": {
    "provider": "Microsoft-Windows-WAS",
    "guid": "{524B5D04-133C-4A62-8362-64E8EDB9CE40}",
    "event_source_name": "",
    "event_id": 5146,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-30T01:45:33.4672524+00:00",
    "event_record_id": 35189,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppPoolID": "CatalogPool",
    "ProtocolID": "http"
  },
  "message": "Application pool CatalogPool has been disabled. The request from protocol http to create the application pool failed. Restart the application pool so that Windows Process Activation Service (WAS) can determine the correct state of the protocol. The data field contains the error number."
}