Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 37 Source: W3SVC

Out of process application /LM/W3SVC/<path the application> terminated unexpectedly.
In my case, I discovered this event was apparently caused by my user ID being a member of too many security groups for a web application on the server where the events occurred to be able to process at login. For this site (locally developed) each user receives different options and abilities in the site depending on their group membership. Special circumstances required me to temporarily add my login ID to a fairly large number of security groups (about 35 new groups and a total of about 50 groups). The very next time I attempted to logon to the website involved, my screen would simply freeze in IE 7.0, while in Firefox I'd get a screen saying "The Remote Procedure Call failed and did not execute". At the same time, an event 37 from source W3SVC would appear in the event viewer along with a 401 HTTP return code message in the w3svc log files on the server hosting the website. Since the programmer of the site told me that no code had been changed and all other users could still access the site, I slowly reduced the number of security groups of which I was a member and was eventually able to logon and the event was no longer logged.
This issue occurs when the Davex.dll and Exprox.dll files are not running in the Inetinfo.exe process. See ME926085 for information on fixing this problem.

This problem can occur when an access violation in SQL Server CE Replication Provider (SSCERP20.DLL) occurs. See ME909475 for a hotfix applicable to Microsoft SQL Server 2000 Windows CE Edition 2.0.

See ME919789, "AspFAQ ID 2267" for additional information about this event.
The link (ME282073) below may apply for certain instances of this error. As per IIS FAQ article 220, in some conditions this might be fixed by applying the latests security fixes from Microsoft.

To identify the faulty IIS instance use the suggestions from IIS FAQ article 495.

ME243059 describes the procedure to enable logging for process accounting in IIS 5.

On one of our servers, we have updated all the software packages installed (related to IIS) and the problem disappeared. This included latest FrontPage Extensions, all IIS fixes and the latest MDAC (Microsoft Data Access Components). Most probably it was the MDAC update that fixed the problem.
This error was the result of VBScript no longer being registered on our customers’ server. We have no idea why it would have unregistered as no one had made any changes to the server. Error received when attempting to access a .vbs file was: Can't find script engine "VBScript" for script “scriptname.vbs”.
We re-registered vbscript with "regsvr32 vbscript" and an "iisreset" just to be sure, and then the site began to function correctly again.
See ME236019 and ME841546 for details on this event.

As per ME284716, "Each time IIS 4.0 or 5.0 has to restart a failed out-of-process Web application, an error message similar to the following is logged in the event log".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.