Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The server was unable to read the file <file>. The file does not exist.
|English: Request a translation of the event description in plain English.|
See the link to "WSUS Bug Event 30" for information about this event.
See ME242455 for a workaround.
Could be caused by the named file being missing, bad permissions on the named file, etc.
This event will also appear when Citrix server is installed and the system drive letter is changed to M:\. The registry entries relating to the configuration parameters are located under: HKLM\System\CurrentControlSet\Services\W3svc\Parameters\Virtual Roots - Check that they all point to the correct locations of the listed files.
For a file name like C:\WINNT\help\iishelp\common\404b.htm I have seen this error caused by a successful network attack. The cracker managed to delete some of these files due to poor IIS security configuration and no patching. Such files are an easy target when a breach exists because their location and names are well known. Any missing file on a server must be considered a very important (negative) event. A careful investigation, starting with IIS and OS logs should be started.
This problem also happens when you install IIS without the documentation. The directory under winnt\help\iishelp is not created. The quick fix is to install the documentation from the add remove programs >> Windows components >> IIS.
It is common practice to remove the iishelp files for security reasons. This can cause problems if you don't change the default errors. When the web server can't find a page requested by the user it sends out a "404-Page not found" message, but if you removed these files and haven't created any custom files then this error will get written to the event log. What has worked for me in the past is to copy the actual file that the error is reporting from another server.
|Private comment: Subscribers only. See example of private comment|
|Links: ME242455, WSUS Bug Event 30|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated