IIS Server Audit Events
Event ID Description
6 6: FTP Daemon event cannot create connection socket
7 7: FTP Daemon event cannot create connection socket
8 8: FTP Daemonÿevent cannot create client thread
9 9: FTP Daemonÿevent system call failed
10 10: FTP Daemon event client timeout
11 11: FTP Daemon event anonymous logon
12 12: FTP Daemon event nonanonymous logon
13 13: FTP Daemon event bad home directory
14 14: FTP Daemon event retro access denied
15 15: FTP PassivePortRange metabase access failed
16 16: FTP PassivePortRange invalid value
1000 1000: IIS WMSvc startup unable to delete directoryÿ
1001 1001:ÿIIS WMSvc startupÿunable to create directory
1002 1002: IIS WMSvc startup unable to create configuration
1003 1003: IIS WMSvc startup unable to ACL path
1003 1003: IIS WMSvc startup unable to ACL path
1004 1004: IIS WMSvc startup unable to lock file
1004 1004: IIS WMSvc startup unable to lock file
1005 1005: IIS WMSvc startup unable to read settings
1005 1005: IIS WMSvc startup unable to read settings
1006 1006: IIS WMSvc startup unable to activate HWC
1007 1007: IIS WMSvc startup unable to read certificate
1007 1007: IIS WMSvc startup unable to read certificate
1016 1016: W3SVC event logging failure
1018 1018: W3SVC performance counter initialization failure
1019 1019: W3SVC performance counter timer failure
1020 1020: W3SVC HTTP control channel config failed
1029 1029: W3SVC event binding failure 2
1032 1032: W3SVC event log directory mapped network drive
1033 1033: W3SVC event log directory machine or share invalid
1034 1034: W3SVC event log directory access denied
1035 1035: W3SVC event log directory not fully qualified
1037 1037: W3SVC HTTP control channel open failed
1041 1041: W3SVC event WMS range error
1043 1043: W3SVC event WMS site binding error
1044 1044: W3SVC event WMS site app pool ID error
1062 1062: W3SVC HTTP control channel logging config failedÿ
1071 1071: W3SVC HTTP Packet Scheduler not installed site
1072 1072: W3SVC HTTP config group bandwidth setting failed
1073 1073: W3SVC HTTP Packet Scheduler not installedÿ
1083 1083: W3SVC HTTP site encounter size failure
1095 1095: W3SVC event delete config group failed
1096 1096: W3SVC event removing all URLs failed
1097 1097: W3SVC event set application pool for CG in HTTP failed
1098 1098: W3SVC event set site maximum connections failed
1099 1099: W3SVC event set site connection timeout failed
1100 1100: IIS WMSvc login unknown error
1101 1101: IIS WMSvc login error instantiating provider
1102 1102: IIS WMSvc authorization unable to read configuration
1104 1104: IIS WMSvc authorization server not allowed
1105 1105: IIS WMSvc authorization not allowed
1106 1106: IIS WMSvc authentication unable to read configuration
1107 1107: IIS WMSvc authentication failed
1109 1109: W3SVC HTTP control channel filter config failed
1120 1120: W3SVC performance counter HTTP globals failure
1121 1121: W3SVC performance counter HTTP site failure
1122 1122: W3SVC performance counter publishing failure
1123 1123: W3SVC performance counter gather timer cancel failure
1124 1124: W3SVC performance counter timer cancel failure
1125 1125: W3SVC performance counter gather timer begin failure
1126 1126: W3SVC WMS failed to copy change not
1128 1128: W3SVC ASP performance counter initialization failure
1129 1129: W3SVC event binding failure invalid access
1130 1130: W3SVC event binding failure unreachable
1131 1131: W3SVC event binding failure out of space
1133 1133: W3SVC WS03 event centralized and W3C logging enabled
1134 1134: W3SVC WS03 event centralized W3C logging not configured
1135 1135: W3SVC WS03 event HTTP control channel W3C logging config failed
1168 1168: W3SVC failed to relate HTTP protocol to application
1172 1172: W3SVC event W3SVC site binding error
1173 1173: W3SVC failed to initialize
1174 1174: W3SVC invalid site binding error
1175 1175: W3SVC HTTP control channel endpoint sharing failed
1300 1300: IIS WMSvc service handler unknown error
1900 1900: IIS WMSvc shutdown unable to delete directory
1901 1901: IIS WMSvc shutdown failed
2000 2000: W3 unable query W3SVC data
2001 2001: W3 W3SVC refresh taking too long
2002 2002: W3 W3SVC registration may be bad
2003 2003: W3 W3SVC refresh taking too long stopping logging
2201 2201: W3 event cannot initialize security
2203 2203: W3 event cannot initialize Winsock
2204 2204: W3 event out of memory
2206 2206: W3 event cannot create connection socket
2208 2208: W3 event cannot create client connectionÿ
2214 2214: W3 event filter DLL load failed
2216 2216: W3 event killing scriptÿ
2218 2218: W3 message SSI errorÿ
2219 2219: W3 event extension exception
2220 2220: W3 event extension load failed
2221 2221: W3 message SSI too many nested includesÿ
2223 2223: W3 message loaded filter from registry
2227 2227: W3 event CAL SSL exceeded
2230 2230: W3 event cannot read file exist
2231 2231: W3 event cannot read fileÿ
2232 2232: W3 event cannot read file size
2233 2233: W3 event cannot read file memory
2258 2258: W3 event failed close cc shutdown
2261 2261: W3 message read raw not supported
2264 2264: W3 event compression directory invalid
2268 2268: W3 event all filters did not load
2270 2270: W3 event certificate mapping could not be loaded
2271 2271: W3 event logging module failed to load
2274 2274: W3 event filters DLL load failed bad exe
2293 2293: W3 event module register failed
2295 2295: W3 event module get proc address failed
2296 2296: W3 event module bad precondition
2298 2298: W3 event no global moduleÿ
5024 5024: WAS log file truncate size
5043 5043: WAS event WMS site binding error
5046 5046: WAS event WMS server command error
5047 5047: WAS event WMS application pool ID empty error
5048 5048: WAS event WMS application pool ID invalid error
5052 5052: WAS event WMS application site invalid error
5055 5055: WAS event WMS site application pool invalid error
5056 5056: WAS event WMS site root application invalid error
5094 5094: WAS event disassociate application failed
5100 5100: WAS application create failed
5102 5102: WAS site create failed
5103 5103: WAS application delete failed
5105 5105: WAS site delete failed
5106 5106: WAS application modify failed
5108 5108: WAS site modify failed
5143 5143: WAS failed site protocol lists update
5149 5149: WAS event WMS global range no high low error
5150 5150: WAS event failed to send application config to protocol
5151 5151: WAS event failed to send application unconfig to protocol
5161 5161: WAS event WMS application no appication root error
5185 5185: WAS site create succeeded
8001 8001: IIS UI message WMSvc no response