Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1113 Source: W3SVC

Source
Level
Description
One of the IP/Port combinations for site "<site>" has already been configured to be used by another site. The other site's SSL configuration will be used.
Comments
 
Open IIS Manager and expand the computer name, click on the website folder on the left side, look on the right side and take note of the Identifier column. This is the site number. In the event log, take note of the "site" number, and find that site in IIS. Make sure you are not using the same IP and port. If you have multiple SSL websites, you will need to assign an additional IP to the server to use for separate websites.
If you do not find the site number in IIS that you pulled from the event log, then you will need to run IIS Metabase Explorer to delete it. It had existed at some point, but when it was deleted from the IIS manager, it was not correctly purged from the metadata. You will need to manually clear the site. To do this, you need to install the Resource Kit Tools on to the server. After you have installed the tools perform the following:
- Open IIS Metabase Explorer.
- Expand the server name.
- Expand LM.
- Expand W3SVC.
Here you will see all the web server site numbers. Find the one that came from the event log and delete it.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...