Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1003 Source: w3ctrs

Unable to query the W3SVC (HTTP) service performance data. The error code returned by the service is data DWORD 0.
I had this error every minute on a Windows 2000 server using IIS 5. Googling led to this solution from Dave Patrick:

Run the following in a cmd window:

winmgmt /clearadap
winmgmt /resyncperf

Then cut and paste the following into a notepad and name it w3ctrs.bat:

unlodctr w3svc
unlodctr msftpsvc
unlodctr asp
unlodctr inetinfo
lodctr w3ctrs.ini
lodctr ftpctrs.ini
lodctr axperf.ini
lodctr infoctrs.ini

Reboot. For me the event stopped after these steps.
According to Microsoft this event is logged when a performance monitoring application, such as System Monitor, is unable to retrieve performance counter information from a service, such as FTP, SMTP or NNTP, hosted in Inetinfo.exe. This can occur if none of the IIS services are currently running, or if an error occurs when calling Inetinfo.exe. See the link to "EventID 1003 from source IISInfoCtrs" for more information about this event.
As per Microsoft: "These errors are caused when a server is being analyzed using Performance Monitor and the IIS Admin Service is stopped or restarted, or when the IIS counters are added when the IIS Admin Service is not running". Check the following Microsoft articles for more details: ME201638 and ME226512.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.