Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1003 Source: IISInfoCtrs

Source
Level
Description
Unable to query the IIS Info service performance data. The error code returned by the service is data DWORD 0.
Comments
 
As per Microsoft: "This event is logged when a performance monitoring application, such as System Monitor, is unable to retrieve performance counter information from a service, such as FTP, SMTP or NNTP, hosted in Inetinfo.exe. This can occur if none of the IIS services are currently running, or if an error occurs when calling Inetinfo.exe". See MSW2KDB for more details on this issue.

See ME226512 to find out how to reinstall IIS 4.0 performance monitor counters.
This also appears when the WWWPS service is not setup to start automatically, but the IIS Admin service is.
These errors are caused when a server is being analyzed using Performance Monitor and the IIS Admin Service is stopped or restarted, or when the IIS counters are added when the IIS Admin Service is not running.
I got this error followed by W3Ctrs and FtpCtrs errors on boot time so I figured out it was about the order of the services were started. I found ME249230 which explained me how to make IISInfoCtrs start AFTER IISADMIN service by adding an registry value with regedt32 to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IISInfoCtrs
   Value Name: DependOnService
   Data Type:  REG_MULTI_SZ
   Value:      IISADMIN
Now after rebooting I got to the track of the problem as I got Event ID 105 on W3SVC and FTPSVC in System log instead of the 1003 in Application log. So I figured out that I have to enable NetBIOS on my internet connection (which was set to disable over TCP/IP). Now I got no errors and for the test I removed the earlier modifications on the registry and got to the starting point except without errors. So the resolution for me was just to "Use NetBIOS from DHCP Server" in network and dialup connections.
Based on a different EventID for IISInfoCtrs, EventID 2003, it may also be possible to resolve the eventID 1003 message by unloading and reloading the IIS performance DLL's. In Administrative Tools | Services, Make certain the "World Wide Web Publishing Service" and "IISAdmin" services are running. In Administrative Tools | Internet Services Manager, make sure that the Default Web Site is running. Open a CMD prompt, navigate to %SystemRoot%\System32 and run the following commands:
unlodctr w3svc
unlodctr msftpsvc
unlodctr asp
unlodctr inetinfo
lodctr w3ctrs.ini
lodctr ftpctrs.ini
lodctr axperf.ini
lodctr infoctrs.ini
Restart the computer. See ME267831.


This event can also occur when a third party utility (such as I/watch) is polling aginst the server and the service is down.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...