Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The server was unable to add the virtual root '<virtual directory>' for the directory '<directory>' due to the following error: The system cannot find the file specified. The data is the error code.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a virtual directory?
As per Microsoft: "This problem may occur if you had an IIS virtual root resource defined and then you removed the Cluster service but did not first delete the resource". See the link to "Windows Cluster Service Troubleshooting and Maintenance" to download the original white paper.
The problem can arise if the IIS Home Directory property for the default Web site is invalid. Read "Citrix Support Document ID: CTX105019" for further details on this issue.
David Lee Steele, Jr
Using ME193888 as a guideline, I sucessfully made the W3SVC service depend on MSExchangeIS without any ill results. The warning events disappeared and I have seen no issues with this workaround. I did have to use regedt32 instead on regedit to make the nessessary changes because of the way regedit displayed the data.
This warning is logged for websites that have virtual directories that point to UNC paths (i.e. a share on the same or another computer in the network). IIS cannot resolve correctly to the share, and it generates this error on reboot or restart. Verify the path specified in the event description.
This event is generated when the home directory of IIS is corrupted or deleted without deactivating the web site first. If Exchange is installed then it may be the cause of the error. See the links below.
When the virtual root is '/Exchange' or /Exadmin see ME259373.
This event and others with sources related to Exchange (i.e. SMTPSVC W3SVC, etc..) are typical for Exchange 2000. This is caused by the Virtual Drive M: not being mounted before the Virtual Servers (OWA, SMTP and NNTP) are started with IIS. IIS is trying to locate the physical path of these virtual directories which doesn't exist until after the Exchange services start up. Once the services start, you can stop and restart the web service and refresh the IIS Manager screen and the STOP icons will disappear. I've confirmed this with Microsoft's Exchange team and they advised this is "normal" functionality.
Do no try setting the W3SVC service to depend on the MSExchangeIS service. The results were disastrous: after restart the server was totally irresponsive, with several Exchange services in "start pending" mode. This is why Microsoft is not recommending putting the dependency, otherwise a simple and easy solution. Do not play with services dependencies as it is possible to create loops.
|Private comment: Subscribers only. See example of private comment|
|Links: Windows Cluster Service Troubleshooting and Maintenance|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated