Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 115 Source: W3SVC

The service could not bind instance <instance number>.
As already mentioned below MS article ME190008 directly relates to this error. This problem appears because a process has bound to the SSL port (normally 443) of your website running on IIS. In my case, ISA Server 2000 was bound to inbound web requests for SSL. This broke my default website and stopped it from starting.
In my case, stopping Skype and then restarting IIS solved the problem.
We encountered this problem twice as follows:
In one case, the software for monitoring the HP UPS was listening on port 80.
In another case, both Exchange 2000 and IAS were installed on the same server and both the Exchange Website as well as the "w3proxy" service were listening on port 80.
In my case, the Apache HTTP Service was using port 80. I had to uninstall this service using the Apache.exe command line interface. The IIS Default Web Site was then able to start.
In my case, I found out that Skype was working on port 80. Shut it down and IIS will start successfully.

As per Microsoft: "This may occur when the WinGate client software is installed on the Internet Information Services (IIS) Web server or the Personal Web Server (PWS). The problem occurs when both the Web server and the WinGate client try to use the same IP address and port. Only one application can use a particular IP address and port combination, which causes the other application to have a conflict. Either remove the WinGate client or change the WinGate client to use a different IP address and port combination". See ME328375 for more details.

See ME190008 and the link to "IISFAQ - Event 115" for additional information on this event.
Found problem caused by installing IIS5 after an already installed application, which used port 80 (in my case Citrix MXL service). Microsoft Knowledgebase article ME261194 gives more details how to resolve this problem.
Using “netstat –an” didn't reveal any applications or processes bound to this port. In addition, there was no problem in the IIS Metabase. Using TCPView from Sysinternals revealed a Compaq process bound to this port (mine was Power Manager).
This event can be caused by invalid information in the Internet Information Server (IIS) metabase for SecureBindings. The key is LM\W3SVC\1\SecureBindings. See ME248497.
As per Microsoft: "Some or all of the Web sites that are using Host Headers have the same port number defined for Secure Sockets Layer (SSL). Internet Information Server 4.0 does not support the use of Host Headers for SSL.". See the link below for workaround.
ME186810 relates to IIS 4. I have found ME284984 in the MSKB. It refers to IIS 4 & 5.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.