Re: IIS 6 Logging

From: Bernard (qbernard_at_hotmail.com)
Date: 07/14/03 

Date: Mon, 14 Jul 2003 10:24:04 +0800

Why so ? such information give you the info on any attacks.
and I don't think you can turn it off, unless you disable
entire logging in IIS. 

-- 
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...
"Microsoft" <lachev@comcast.net> wrote in message
news:OAG#dwHSDHA.2256@TK2MSFTNGP11.phx.gbl...
> Is there any way to prevent IIS 6 to log certain requests, such as the
worm
> virus attempts:
>
> 2003-07-06 04:36:28 W3SVC1 MILLENNIA 192.168.1.101 GET /scripts/root.exe
> /c+dir 80 - 66.56.41.105 HTTP/1.0 - - www 404 0 64 0 72 1361
> 2003-07-06 04:36:32 W3SVC1 MILLENNIA 192.168.1.101 GET /MSADC/root.exe
> /c+dir 80 - 66.56.41.105 HTTP/1.0 - - www 404 0 64 0 70 1622
>
> I understand that those are "not found" benign messages but they are
filling
> up my IIS logs and affecting the way the log analyzers interpret the
> results. I tried the UrlScan 2.5 but it doesn't prevent these messages to
be
> logged. Ideally, I would like these rejected before the request reaches
IIS.
>
>

Relevant Pages

  • Re: IIS Warm Up Period
    ... With stable web components, IIS will run ... > Is there a way to tell the IIS to start accepting the requests only after ... >> website, though. ... The load time for those settings is about 3 ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: IIS Warm Up Period
    ... With stable web components, IIS will run ... > Is there a way to tell the IIS to start accepting the requests only after ... >> website, though. ... The load time for those settings is about 3 ...
    (microsoft.public.inetserver.iis)
  • Re: IIS Vulnerability Content-Type overflow
    ... > vulnerability i found that a specially malformed http request to an IIS ... > Webserver can allow a buffer overflow. ... > and requests are not being logged by IIS. ...
    (Vuln-Dev)
  • Re: web site hammering
    ... kinds of attacks while they're in-process and defend against them. ... If we get 10 requests per-second for the same page from the same IP, ... > attacker's IP into IIS IP restriction list: ... > ISP about this incident, ask them to block the attacker's IP at ISP ...
    (microsoft.public.inetserver.iis)
  • Re: Multiple instances of app under IIs and global com object - is it a problem?
    ... beware that storing objects in Session variables ... this multiplicity of Module-level data means that you ... Module-level data is only useful in an IIS context for fixed ... >> requests. ...
    (microsoft.public.vb.general.discussion)