Re: URLScan

Ok... since UrlScan is not inserting space characters when rejecting
requests (which would corrupt log field lines otherwise delimited by
space characters), what is your actual question?

I'm assuming your problem was with the space between
/<Rejected-By-UrlScan>
and
~/

And since you said that ~/ is another field, it seems that the space
between the two is perfectly justified.


//David
http://w3-4u.blogspot.com


Ok... then where is UrlScan inserting space characters into the log
file to confuse the log delimiter?

On Jan 10, 2:15 am, Kenny <subf...@xxxxxxxxx> wrote:
David,

Thanks for your time.

You state that "The delimiter of the log file is defined by W3C
specification". In fact, the W3C specification for field delimiters is
whitespace, not space characters: "Fields are separated by whitespace,
the use of tab characters for this purpose is encouraged" -http://www.w3.org/TR/WD-logfile.html

So the W3C in fact encourage anyone implementing the standard to do so
with tab characters delimiting fields.

You are quite correct - URLscan was not adding the trailling "~/" -
this just appears in another data field that I was not expecting.

Many thanks for your help.

Kind regards,

Kenny

On Jan 9, 8:49 pm, David Wang <w3.4...@xxxxxxxxx> wrote:



On Jan 9, 6:50 am, Kenny <subf...@xxxxxxxxx> wrote:

Hello,

URLScan breaks the formatting of the IIS 5.0 logs by including a
single space character in it's entry in the IIS log, for example, the
following entry:

/<Rejected-By-UrlScan> ~/

As each column in the IIS 5.0 log is delimited by the space character,
I can find no way to load the IIS log into SQL Server.

My IIS log file is rather too big to load into a text editor and
perform a find / replace, and I don't have access to sed or awk.

Is it possible to configure URLScan so that it leaves a different
message (with no whitespace) in the IIS log, such that the structure
of the log file is kept intact?

Or is it possible to configure IIS 5.0 to use Tabs to delimit the
columns in the log file?

Many thanks

Kenny

The delimiter of the log file is defined by W3C specification, so
there is no way that IIS can be configured to use Tabs to delimit
columns.

Are you sure that URLScan is inserting the white space? Where is the
~/ coming from -- it seems like you have something else modifying the
log entry.

URLScan does not insert white spaces anywhere. It does the fast path
rejection by rewriting the URL to: /<Rejected-By-UrlScan>  (no spaces
nor ~/). Thus, if you see any other characters in the log for that log
field, it is not coming from URLScan.

Now, you can configure URL to rewrite the URL to a different value
(look inside URLSCAN.INI for the property -- it is visible and
documented), and if that still has " ~/" trailing it, then the problem
is definitely not with URLScan because it does not append what you
claim.

Honestly, I do not see URLScan do what you claim, so I think you have
some other ISAPI Filter causing this issue.

//Davidhttp://w3-4u.blogspot.comhttp://blogs.msdn.com/David.Wang
//- Hide quoted text -

- Show quoted text -

.