Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 54 Source: HTTP

The description for Event ID ( 54 ) in Source ( HTTP ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\Http\AppPool.
From a post by a MS Engineer: "You may be running into a known issue. If you are on IIS 6.0 then we are aware of this issue - however it is not likely that a fix will be created at this time to address this issue. In stead I believe a KB article will be created informing you of the problem and what it means.

At this point I have only a scattered message of what the issue is but I'll do my best to explain:

When the IO Manager tries to cancel all pending I/O, if there are any pending IRP's left in the HTTP - those many not get cancelled. The IO manager waits 5 mins, then disassociates the IRP from the thread and write this event log. Then closes out the handle. Then the process is allowed to die.

Long story short, we are writing and event without any good detail to let you know what's going on, it's a flaw in how this event is handled... it is not a security concern, or a performance concern, it 's just an annoyance and not useful for you as an administrator."
The event description should read:
"An Io Request to the device \Device\Http\AppPool did not complete or canceled within the specific timeout. This can occur if the device driver does not set a cancel routine for a given IO request packet.". Typically, you will see the full description if you access the event log on the computer that recorded the error.

Look for various comments for other similar events. When possible, identify the software that installed the device and obtain the latests version, patch or hotfix. Contact the manufacturer and describe the problem. See the comments for event id 54 from AMBRIMCL.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.