URLScan

Hello,

URLScan breaks the formatting of the IIS 5.0 logs by including a
single space character in it's entry in the IIS log, for example, the
following entry:

/<Rejected-By-UrlScan> ~/

As each column in the IIS 5.0 log is delimited by the space character,
I can find no way to load the IIS log into SQL Server.

My IIS log file is rather too big to load into a text editor and
perform a find / replace, and I don't have access to sed or awk.


Is it possible to configure URLScan so that it leaves a different
message (with no whitespace) in the IIS log, such that the structure
of the log file is kept intact?

Or is it possible to configure IIS 5.0 to use Tabs to delimit the
columns in the log file?

Many thanks

Kenny

.

Relevant Pages

  • Re: URLScan
    ... single space character in it's entry in the IIS log, for example, the ... As each column in the IIS 5.0 log is delimited by the space character, ... I can find no way to load the IIS log into SQL Server. ... Is it possible to configure URLScan so that it leaves a different ...
    (microsoft.public.inetserver.iis.security)
  • RE: Suspicious IIS Log entry
    ... The first entry is the Code Red II Worm: ... Subject: Suspicious IIS Log entry ... I found the following suspicious entries in my IIS log files. ...
    (Security-Basics)
  • Re: Access Denied to Portal Site
    ... > Hi Howard, ... At the IIS log, after ... THEN there appears to be an entry for the same page WITH my username ... It appears that whenever it logs an entry for my authenticated username, ...
    (microsoft.public.sharepoint.portalserver.development)
  • Re: web.configs session timeout doesnt take effect
    ... Check IIS log on the "never ending" server. ... Is there any entry for your ... Mobile: +972-58-888377 ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: web.configs session timeout doesnt take effect
    ... Check IIS log on the "never ending" server. ... Is there any entry for your ... Mobile: +972-58-888377 ...
    (microsoft.public.dotnet.framework.aspnet)