Trigger Email Alert on KillW3wp Event

Question

There's an option to have an IIS Application Pool automatically kill w3wp if the process runs at over some threshold for some period. Ref: Kill w3wp.exe if it is working on 100% cpu over a period of time

When such an event occurs, I'd like to trigger a mail such that we're aware that there had been an issue; thus we'll know:

• any users reporting issues before the alert will likely have had their issue resolved by the KillW3wp event.
• any users reporting issues at the point of KillW3wp would suggest unwanted side effects caused by the kill.
• we can search for patterns in when this fix is needed / in data in the related logs from the same time, from which we can delve deeper into finding the underlying cause.

Question:

• Is it possible to trigger an email when KillW3wp is initiated?
• Alternatively, does anyone know the EventId, Source & Log we'd need to monitor to detect this issue (we could thus use the windows scheduler to trigger the mail; http://blogs.technet.com/b/jhoward/archive/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger.aspx)

Answer 1

The KillW3wp doesn't support additional actions that I am aware of.

Fret not, there is an event log for the action.

• Product: Internet Information Services
• ID: 5025
• Source: Microsoft-Windows-WAS
• Version: 7.0
• Symbolic Name: WAS_EVENT_JOB_LIMIT_HIT
• Message: Application pool '%1' exceeded its job limit settings.

Source: Technet Event ID 5025 — IIS Application Pool Availability