Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 30 Source: W3SVC

The server was unable to read the file <file>. The file does not exist.
See the link to "WSUS Bug Event 30" for information about this event.
See ME242455 for a workaround.
Could be caused by the named file being missing, bad permissions on the named file, etc.
This event will also appear when Citrix server is installed and the system drive letter is changed to M:\. The registry entries relating to the configuration parameters are located under: HKLM\System\CurrentControlSet\Services\W3svc\Parameters\Virtual Roots - Check that they all point to the correct locations of the listed files.
For a file name like C:\WINNT\help\iishelp\common\404b.htm I have seen this error caused by a successful network attack. The cracker managed to delete some of these files due to poor IIS security configuration and no patching. Such files are an easy target when a breach exists because their location and names are well known. Any missing file on a server must be considered a very important (negative) event. A careful investigation, starting with IIS and OS logs should be started.

This problem also happens when you install IIS without the documentation. The directory under winnt\help\iishelp is not created. The quick fix is to install the documentation from the add remove programs >> Windows components >> IIS.
It is common practice to remove the iishelp files for security reasons. This can cause problems if you don't change the default errors. When the web server can't find a page requested by the user it sends out a "404-Page not found" message, but if you removed these files and haven't created any custom files then this error will get written to the event log. What has worked for me in the past is to copy the actual file that the error is reporting from another server.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.