Alert:IIS Stop Command

Issue:Two alerts are generated as part of the SharePoint 2007 management pack when IIS is stopped and started. These are the "IIS Stop Command" and "IIS Start Command". Each is generated by a rule so they do not auto resolve. The stop command is generated from a Source of IISCTLS with event ID 2. The start command is generated from the same source with an event ID of 1. Since these do not auto resolve but they have both a warning and healthy state condition it seems far more logical to put these into a monitor within the IIS management pack but this does not appear to be included in that management pack from what we are seeing in our environments.

Resolution:Created a custom monitor in the IIS_Overrides management pack using this criteria below as part of the IIS_Overrides management pack. Targeted to Windows Server – disabled. Enabled this monitor for the IIS Computer Group. Created an override to disable both rules (IIS Stop Command and IIS Start Command) after verifying that the new monitor functioned correctly. Details as follows:

Created a new Unit monitor which has a event condition which indicates both an unhealthy and healthy condition called “IIS Stop and Start Monitor”. Chose the Application log for the unhealthy event:


Specified the event id of 2 and the event source of IISCTLS identified in the IIS Stop Command rule discussed in this article.


Chose the Application log for the healthy condition and specified the event id of 1 and the event source of IISCTLS identified in the IIS Start Command rule discussed in this article.


Chose the first event raised to be a warning event, and the second event to be a healthy event.


Created a warning alert for the new monitor.


Created the monitor as disabled (targeted at Windows Server Operating System), and use an override for the IIS Computer Group to set the enabled to True for this specific group of servers.



Submitted By:Cameron Fuller [MVP]