Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1013 Source: W3SVC

A process serving application pool 'DefaultAppPool' exceeded time limits during shut down. The process id was '217'.
From a support forum: "Those are warning messages for the application pool. The application pool are recycled at a predefined time. IIS waits for the pool to do a graceful restart, that is complete all the pending requests on the pool, shut it down and start again. But if the pending queue is loong or the process has hung, the graceful restart will fail and IIS will just do a forced recycle on the pool. Thats when these messages are generated.

You need not get worried with these messages unless the same pool ID gets reflected time and time again on the logs, in which case, there is somethign wrong with the pool or the site that the pool serves. The site may have scripts that are trying to use resources beyond the pools capacity or has applications that remain connected inspite of a page being closed. For example, ms-sql or mysql db connections may be maintained inspite of the page requesting it being closed. These are scripting problems and need to be taken up with the developer."

* * *

ME919792 provides information on how to use the Debug Diagnostics tool to troubleshoot a process that has stopped responding in IIS.

* * *

Some users used IISTracer to find the source of this problem (faulty scripts). See the link below.

* * *

The link to "LogParser did it again: application pool recycle" provides an example of troubleshooting of event id 1013 using the LogParser.
This problem might occur because ASP.NET limits the number of worker threads and completion port threads that a call can use to execute requests. See ME821268 to resolve this problem.
When you experience a deadlock in Internet Information Services (IIS) 6.0, you may see this event. See ME828222 for details on this issue.

You can use the IISState utility to try to discover the source of the problem.
In my case, ME827214 helped me to resolve this problem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.