Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
The description for Event ID ( 54 ) in Source ( HTTP ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\Http\AppPool.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is a DLL?
What is causing the “The description for Event ID ( … ) in Source ( …. ) cannot be found… “?
What is an application pool?
From a post by a MS Engineer: "You may be running into a known issue. If you are on IIS 6.0 then we are aware of this issue - however it is not likely that a fix will be created at this time to address this issue. In stead I believe a KB article will be created informing you of the problem and what it means.
At this point I have only a scattered message of what the issue is but I'll do my best to explain:
When the IO Manager tries to cancel all pending I/O, if there are any pending IRP's left in the HTTP - those many not get cancelled. The IO manager waits 5 mins, then disassociates the IRP from the thread and write this event log. Then closes out the handle. Then the process is allowed to die.
Long story short, we are writing and event without any good detail to let you know what's going on, it's a flaw in how this event is handled... it is not a security concern, or a performance concern, it 's just an annoyance and not useful for you as an administrator."
The event description should read:
"An Io Request to the device \Device\Http\AppPool did not complete or canceled within the specific timeout. This can occur if the device driver does not set a cancel routine for a given IO request packet.". Typically, you will see the full description if you access the event log on the computer that recorded the error.
Look for various comments for other similar events. When possible, identify the software that installed the device and obtain the latests version, patch or hotfix. Contact the manufacturer and describe the problem. See the comments for event id 54 from AMBRIMCL.
|Private comment: Subscribers only. See example of private comment|
|Links: Event id 54 from AMBRIMCL|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
|Custom search for *****: Google - Bing - Microsoft - Yahoo|
Send comments or solutions
- Notify me when updated