Backup plan for URLScan logfiles
From: dumbwabbit (dumbwabbit@yahoo.com)Date: 10/23/01
- Previous message: Frank Heyne: "Re: Flushing DLLs follow-up"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-ID: <20011023202320.46435.qmail@web20901.mail.yahoo.com> Date: Tue, 23 Oct 2001 13:23:20 -0700 (PDT) From: dumbwabbit <dumbwabbit@yahoo.com> Subject: Backup plan for URLScan logfiles To: focus-ms@securityfocus.com
I needed to do this, and also saw others asking about
it. So I put this together:
Backs up urlscan.log on a daily basis!!!
Written for NT4 - will need modifications to run for
IIS5 if you use the pid (Process ID) appendage to the
urlscan output.
mb.bat - Make Backup batch file for URLScan
Usage Notes:
1) Modify your own paths to fit the variables
2) Default installation of URLScan puts the log file
in
c:\winnt\system32\inetsrv\urlscan\urlscan*.log
3) Be aware that this batch file WILL stop your w3svc
service long enough to back up the urlscan.log file,
and then restart the service. You may want to consider
ensuring that you have enabled restart options in
Services for w3svc if running iis5.
4) This script assumes that your system uses "/" as
date separator (check Control Panel>Regional
Settings).
5) I am aware that this could be cleaned up a bit, but
I just wrote it this afternoon. Any *helpful*
modifications appreciated.
6) Distribute freely. Caveat emptor.
7) I am assuming you know what batch files are and how
to use them. If you don't, why the h**l are you
running a web server?
-----------Begin Batch File mb.bat-----------
@echo off
setlocal
rem -- following 'for' grabs system date and parses
rem -- system date format if using "/" - remember
rem -- you cannot use "/" in file or folder names!
rem -- therefore we replace "/" with "-"
rem -- if today=10/18/2001 then newname=10-18-2001
rem -- then use newname for new folder name for
archive
for /f "tokens=2-4 delims=/ " %%a in ('date /t') do (
set mm=%%a
set dd=%%b
set yyyy=%%c
set newname=%%a-%%b-%%c)
rem -- Modify the following paths as appropriate
rem -- to your system's configuration
rem -- Default urlscan installation location
set LOGPATH=C:\WINNT\System32\inetsrv\urlscan
rem -- Logfile name - remember to edit if using PID
set LOGFILE=URLScan.log
rem -- Backup Path - must be mapped drive i think
set BAKPATH=c:\Backup
rem -- the output from the 'for' above
set DATEVAL=%newname%
rem -- make new directory under Backup using
rem -- current date as name
md %BAKPATH%\%DATEVAL%
rem -- stop World Wide Web service
net stop w3svc
rem -- move urlscan.log to new folder
move %LOGPATH%\%LOGFILE% %BAKPATH%\%DATEVAL%\
rem -- restart World Wide Web service
net start w3svc
-----------End mb.bat---------------------
Place mb.bat in %systemroot% (or other location in
path)
Use the following file, mbcron.bat to schedule mb.bat
to run every night at 11:58 pm (if you do nightly
backups, schedule this process BEFORE your backup so
you get the archived urlscan.log file). Requires
Scheduling Service to be running. Also, realize that
Scheduling Service runs under context of Local System
account by default - make sure that System account has
rights to the backup and source locations, or change
the account that Scheduling Service runs under.
----------Begin mbcron.bat-----------------
AT 23:58 /interactive /every:M,T,W,Th,F,S,SU mb.bat
----------End mbcron.bat-------------------
__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com
- Previous message: Frank Heyne: "Re: Flushing DLLs follow-up"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
