Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1057 Source: W3SVC

The identity of application pool '<pool>' is invalid, so the World Wide Web Publishing Service can not create a worker process to serve the application pool. Therefore, the application pool has been disabled.
This was a SharePoint problem for us. If you go to your IIS on the server in question under application pools and find the site in question, go to Properties, then the Identity tab, to the place where you can change the user/password. We had recently changed the service account password, but did not know we needed to change it here as well. Once we did that things started working again.
This problem occurs if the Net Logon service on the domain controller does not start before the World Wide Web Publishing Service starts. See ME929100 for a workaround.

This issue occurs if the password of the Communicator Web Access service account has changed or has expired. Therefore, the Communicator Web Access service uses an incorrect password to try to start. See ME931507 to solve this problem.
From a newsgroup post: "I seem to have resolved the issue by recreating the application pool account (delete / recreate)".

See "Configuring and Troubleshooting Windows 2000 and Windows Server 2003 Certificate Services Web Enrollment" for details on this event.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.