Re: URLScan

David,

Thanks for your time.

You state that "The delimiter of the log file is defined by W3C
specification". In fact, the W3C specification for field delimiters is
whitespace, not space characters: "Fields are separated by whitespace,
the use of tab characters for this purpose is encouraged" -
http://www.w3.org/TR/WD-logfile.html

So the W3C in fact encourage anyone implementing the standard to do so
with tab characters delimiting fields.

You are quite correct - URLscan was not adding the trailling "~/" -
this just appears in another data field that I was not expecting.

Many thanks for your help.

Kind regards,

Kenny

On Jan 9, 8:49 pm, David Wang <w3.4...@xxxxxxxxx> wrote:
On Jan 9, 6:50 am, Kenny <subf...@xxxxxxxxx> wrote:



Hello,

URLScan breaks the formatting of the IIS 5.0 logs by including a
single space character in it's entry in the IIS log, for example, the
following entry:

/<Rejected-By-UrlScan> ~/

As each column in the IIS 5.0 log is delimited by the space character,
I can find no way to load the IIS log into SQL Server.

My IIS log file is rather too big to load into a text editor and
perform a find / replace, and I don't have access to sed or awk.

Is it possible to configure URLScan so that it leaves a different
message (with no whitespace) in the IIS log, such that the structure
of the log file is kept intact?

Or is it possible to configure IIS 5.0 to use Tabs to delimit the
columns in the log file?

Many thanks

Kenny

The delimiter of the log file is defined by W3C specification, so
there is no way that IIS can be configured to use Tabs to delimit
columns.

Are you sure that URLScan is inserting the white space? Where is the
~/ coming from -- it seems like you have something else modifying the
log entry.

URLScan does not insert white spaces anywhere. It does the fast path
rejection by rewriting the URL to: /<Rejected-By-UrlScan> (no spaces
nor ~/). Thus, if you see any other characters in the log for that log
field, it is not coming from URLScan.

Now, you can configure URL to rewrite the URL to a different value
(look inside URLSCAN.INI for the property -- it is visible and
documented), and if that still has " ~/" trailing it, then the problem
is definitely not with URLScan because it does not append what you
claim.

Honestly, I do not see URLScan do what you claim, so I think you have
some other ISAPI Filter causing this issue.

//Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang
//

.

Relevant Pages

  • Re: Lengthy merge code
    ... Do any of your data fields contain any of the delimiter characters (i.e. the ... the chances are that the problem has nothing to do with memory. ... proprietary software package - I don't dare name it - and the merge ...
    (microsoft.public.word.mailmerge.fields)
  • Re: [man bash] section "Word Splitting" - IFS
    ... > sing explanation of IFS varible in EXPANSION section, ... then any sequence of IFS characters serves to delimit words. ... >> also treated as a delimiter. ...
    (comp.unix.shell)
  • Re: URLScan
    ... since UrlScan is not inserting space characters when rejecting ... You state that "The delimiter of the log file is defined by W3C ... I can find no way to load the IIS log into SQL Server. ...
    (microsoft.public.inetserver.iis.security)
  • awk question
    ... delimiter) is, eg, exactly 5 lower case characters ... If ";" is the delimiter character, ... Oliver Fromme, secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing b. ... Handelsregister: Registergericht Muenchen, HRA 74606, Geschäftsfuehrung: ...
    (freebsd-questions)
  • Re: Variable width fixed width text files
    ... 2003 are 69 characters long. ... dynamically set the file/column properties for each file before ... Doing so you will always see only one variable lenght column delimited by the Row delimiter. ... ' Visual Basic Transformation Script ...
    (microsoft.public.sqlserver.dts)
Loading