EventID.Net LogoEventID.Net

EvLog Event Analyzer

Monitor unlimited number of servers
Filter log events
Create email and web-based reports

EventID.Net Subscription

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 30 Source: W3SVC

Source
W3SVC
Level
Warning
Description
The server was unable to read the file <file>. The file does not exist.
English
Request a translation of the event description in plain English.
Comments
 
EventID.Net
See the link to "WSUS Bug Event 30" for information about this event.
EventID.Net
See ME242455 for a workaround.
Tod Beardsley
Could be caused by the named file being missing, bad permissions on the named file, etc.
Derek Walsh
This event will also appear when Citrix server is installed and the system drive letter is changed to M:\. The registry entries relating to the configuration parameters are located under: HKLM\System\CurrentControlSet\Services\W3svc\Parameters\Virtual Roots - Check that they all point to the correct locations of the listed files.
EventID.Net
For a file name like C:\WINNT\help\iishelp\common\404b.htm I have seen this error caused by a successful network attack. The cracker managed to delete some of these files due to poor IIS security configuration and no patching. Such files are an easy target when a breach exists because their location and names are well known. Any missing file on a server must be considered a very important (negative) event. A careful investigation, starting with IIS and OS logs should be started.


Rudy Coppens
This problem also happens when you install IIS without the documentation. The directory under winnt\help\iishelp is not created. The quick fix is to install the documentation from the add remove programs >> Windows components >> IIS.
Jesse Pike
It is common practice to remove the iishelp files for security reasons. This can cause problems if you don't change the default errors. When the web server can't find a page requested by the user it sends out a "404-Page not found" message, but if you removed these files and haven't created any custom files then this error will get written to the event log. What has worked for me in the past is to copy the actual file that the error is reporting from another server.
Private comment
Subscribers only. See an example of private comment
Links
ME242455, WSUS Bug Event 30
Search
Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...
Feedback
Send comments or solutions - Notify me when updated
 
Printer friendly

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...