IIS Server Audit Event: 2003

2003: W3 W3SVC refresh taking too long stopping logging

The IIS World Wide Web Publishing Service is responsible for managing the HTTP protocol and HTTP performance counters. It collects HTTP-specific performance counters for web sites. It initializes the counters and receives them from HTTP.Sys, the protocol listener for HTTP. If W3SVC is not available, HTTP performance counter data cannot be gathered.

Event 2003 is generated when it has taken too long to refresh W3SVC counters and the stale counters are being used instead. This is the second message in a certain period of time. No more stale counter messages will be logged for the specified client session until the time limit expires.

How could you resolve this situation?

If updated performance counters are required by the web sites, restart the World Wide Web Publishing Service.

IIS Server Log Analysis Tool

EventLog Analyzer is a comprehensive log management software with which you can centrally collect, analyze, and manage logs from all the different log sources in your network. You also get reports and alerts on your network security, making it a power-packed IT security tool.