Re: Clearing IIS logs

From: Shoten (shoten@starpower.net)
Date: 10/02/01 

Message-ID: <002f01c14b71$b7e35080$893fa4d8@cable.rcn.com>
From: "Shoten" <shoten@starpower.net>
To: "Travis Kiger" <Travis.Kiger@dig.com>, "Jason binger" <cisspstudy@yahoo.com>, <pen-test@securityfocus.com>
Subject: Re: Clearing IIS logs
Date: Tue, 2 Oct 2001 14:40:32 -0400

The problem with this method is that IIS will not continue the existing log
file, but rather create a new one.

> IIS keeps the log file open, so I don't know of a way to do it without
> stopping IIS. The easiest way to acccomplish this is to create an AT job
> that stops IIS, deletes the logs and then restarts IIS. The account that
the
> AT service runs as probably has permissions to do this. To cause even more
> confusion for the admin, copy an old log and give it the same name as
> todays' log. Some log types don't show the date in the individual entries,
> but the admin may not notice either way.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • Re: IIS : access to cmd.exe and multiple commands on one line
    ... Subject: IIS: access to cmd.exe and multiple commands on one line ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • RE: Clearing IIS logs
    ... IIS keeps the log file open, so I don't know of a way to do it without ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: IIS : access to cmd.exe and multiple commands on one line
    ... Subject: IIS: access to cmd.exe and multiple commands on one line ... that '&' is a reserved character, and that %-encoding them should modify the ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • Re: update on IIS 5.0 relative path vulnerability
    ... update on IIS 5.0 relative path vulnerability ... and you can obtain SYSTEM privilege. ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • Re: Clearing IIS logs
    ... Subject: Clearing IIS logs ... while the NT Service and IIS had it open. ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)