Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
Unable to query the IIS Info service performance data. The error code returned by the service is data DWORD 0.
|English: This information is only available to subscribers. An example of English, please!|
|Concepts to understand:|
What are the performance counters?
What is a DWORD?
As per Microsoft: "This event is logged when a performance monitoring application, such as System Monitor, is unable to retrieve performance counter information from a service, such as FTP, SMTP or NNTP, hosted in Inetinfo.exe. This can occur if none of the IIS services are currently running, or if an error occurs when calling Inetinfo.exe". See MSW2KDB for more details on this issue.
See ME226512 to find out how to reinstall IIS 4.0 performance monitor counters.
This also appears when the WWWPS service is not setup to start automatically, but the IIS Admin service is.
These errors are caused when a server is being analyzed using Performance Monitor and the IIS Admin Service is stopped or restarted, or when the IIS counters are added when the IIS Admin Service is not running.
I got this error followed by W3Ctrs and FtpCtrs errors on boot time so I figured out it was about the order of the services were started. I found ME249230 which explained me how to make IISInfoCtrs start AFTER IISADMIN service by adding an registry value with regedt32 to:
Value Name: DependOnService
Data Type: REG_MULTI_SZ
Now after rebooting I got to the track of the problem as I got Event ID 105 on W3SVC and FTPSVC in System log instead of the 1003 in Application log. So I figured out that I have to enable NetBIOS on my internet connection (which was set to disable over TCP/IP). Now I got no errors and for the test I removed the earlier modifications on the registry and got to the starting point except without errors. So the resolution for me was just to "Use NetBIOS from DHCP Server" in network and dialup connections.
Based on a different EventID for IISInfoCtrs, EventID 2003, it may also be possible to resolve the eventID 1003 message by unloading and reloading the IIS performance DLL's. In Administrative Tools | Services, Make certain the "World Wide Web Publishing Service" and "IISAdmin" services are running. In Administrative Tools | Internet Services Manager, make sure that the Default Web Site is running. Open a CMD prompt, navigate to %SystemRoot%\System32 and run the following commands:
Restart the computer. See ME267831.
This event can also occur when a third party utility (such as I/watch) is polling aginst the server and the service is down.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated