Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 15005 Source: HTTP

Unable to bind to the underlying transport for The IP Listen-Only list may contain a reference to an interface which may not exist on this machine.  The data field contains the error number.
I encountered this issue following a reboot of our Windows 2003 SBS PDC for critical updates. The problem was caused by ISA Server 2004, which had changed the SBS Web Listener to bind to the External Network as well as All Protected Networks. Due to the overlap in the IP addresses for these networks it failed to bind, this in turn stopped IIS from starting the default site.
See ME890015 for details on fixing this problem.
In my case, I have an Apache server listening on one IP in the 80 port (intranet) and I need IIS to listen on another IP on the 80 port on the same machine (because SUS client only runs on port 80). Apache is easily configured to listen on one specific IP, but IIS pools on all IPs. To disable socket pooling, have to perform the follows steps:

Open a command prompt and make sure you are in the <X>:\Inetpub\Adminscripts folder (where <X> is the IIS installation drive). After you open the Adminscripts folder, type the following line at the command prompt:

“cscript adsutil.vbs set w3svc/disablesocketpooling true”.

Stop and start the IIS Admin service. Restart the WWW service. Install the Support tools (suptools.msi on the W2k3 CD). Open a command prompt window. Type the following:

“httpcfg set iplisten -i <IP>”,

where <IP> is the IP address you want to add. When this succeeds, Httpcfg returns the following: “HttpSetServiceConfiguration completed with 0”. To view additional status codes, see the Httpcfg help. After the IP address is added, use the following command to list it: “httpcfg query iplisten”.

The IP inclusion list is read during startup of the HTTP service. If you change the list, you must restart the service. To restart the HTTP service, open a command window and type “net stop http /y”. This stops the HTTP Secure Sockets Layer (SSL) service and the World Wide Web publishing services because they are dependent on the HTTP service. To start the HTTP service, type “net start w3svc” at the command prompt. This starts the HTTP SSL service and the HTTP service. After you add IP addresses to the IP inclusion list, you must add each IP address that is used by a Web site. If you bind a Web site to an IP address that is not on the list, the Web site does not start.
In IIS 6.0, there could be a Web site in “Stopped” state. That web site has the same listening port assigned as the other web site, and is not able to change the state to “Started”. Each time you try to start the problematic web site a warning message appears, and two errors are generated: EventID 15005 from source Http, and EventID 1004 from source W3SVC.
If the listening port for the web site is changed, you will be able to start the web site. You can change it in “IIS\Web Site\<problematic web site>” -> “Properties\Web site (tab)\TCP Port”.
In IIS 6.0 if you want to host another application to listen on port 80 on a different IP than any of your web sites you have to use httpcfg.exe from Microsoft. In IIS 5 you could use the “DisableSocketPooling” command on the metabase to accomplish this. See ME813368 for more details.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.