IIS Server Security - Questions URLSCAN

This is Interesting: Free IT Magazines  
Home > Archive > IIS Server Security > January 2004 > Questions URLSCAN





You are viewing an archived Text-only version of the thread. To view this thread in it's original format and/or if you want to reply to this thread please [click here]

Author Questions URLSCAN
BG

2004-01-24, 1:55 am

1. How can you test if URLSCAN is working?
2. When is a new dated log file created? It appears to be created only when
the IIS server is restarted.

The reason I am asking is my log file most recent date is 11172003.


Bernard

2004-01-24, 1:55 am

1) Try to access your site with .exe type of request,
by default this extension is blocked and it will be logged in urlscan
logfile.

2) yes. and it will create a new log for the day if there's a request that
has
been blocked.

--
Regards,
Bernard Cheah
http://support.microsoft.com/
Please respond to newsgroups only ...



"BG" <bg2@uasystem.ua.edu> wrote in message
news:OJEXMpquDHA.2244@TK2MSFTNGP09.phx.gbl...
quote:

> 1. How can you test if URLSCAN is working?
> 2. When is a new dated log file created? It appears to be created only


when
quote:

> the IIS server is restarted.
>
> The reason I am asking is my log file most recent date is 11172003.
>
>




Andrew Davis [MS]

2004-01-24, 1:55 am

BG,

Benard is right on, if there haven't been any requests rejected by URLScan
during that day then it won't create a log for that day. However if the IIS
services are restarted the filter will re-initialize create a log
populating it with the current config info.

Be aware there is PerDayLogging setting in the INI that will append
everything into a single logfile, but this has to be modified from the
default.

- PerDayLogging=1 By default, this option is set to 1. If this value is
set to 1, URLScan creates a new log file each day. Each log file is
named Urlscan.<MMDDYY>.log, where <MMDDYY> is the date of the log file.
If this value is set to 0, all logging is saved in the same file,
regardless of the date.

326444 HOW TO: Configure the URLScan Tool
http://support.microsoft.com/?id=326444

This posting is provided "AS IS" with no warranties, and confers no rights.

Thanks!
~Andrew Davis
Microsoft PSS Security

--------------------
| From: "Bernard" <qbernard@hotmail.com>
| References: <OJEXMpquDHA.2244@TK2MSFTNGP09.phx.gbl>
| Subject: Re: Questions URLSCAN
| Date: Fri, 5 Dec 2003 12:48:02 +0800
| Lines: 28
| Organization: -
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.3790.0
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Message-ID: <OUtK0ruuDHA.2508@TK2MSFTNGP12.phx.gbl>
| Newsgroups: microsoft.public.inetserver.iis.security
| NNTP-Posting-Host: 203.115.210.205
| Path:
cpmsftngxa07.phx.gbl!cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.
phx.gbl
| Xref: cpmsftngxa07.phx.gbl microsoft.public.inetserver.iis.security:7615
| X-Tomcat-NG: microsoft.public.inetserver.iis.security
|
| 1) Try to access your site with .exe type of request,
| by default this extension is blocked and it will be logged in urlscan
| logfile.
|
| 2) yes. and it will create a new log for the day if there's a request that
| has
| been blocked.
|
| --
| Regards,
| Bernard Cheah
| http://support.microsoft.com/
| Please respond to newsgroups only ...
|
|
|
| "BG" <bg2@uasystem.ua.edu> wrote in message
| news:OJEXMpquDHA.2244@TK2MSFTNGP09.phx.gbl...
| > 1. How can you test if URLSCAN is working?
| > 2. When is a new dated log file created? It appears to be created only
| when
| > the IIS server is restarted.
| >
| > The reason I am asking is my log file most recent date is 11172003.
| >
| >
|
|
|

BG

2004-01-24, 1:55 am

Ok - tried getting an exe from site and it created a new log file. Thanks
for the help, both you and Bernard.


""Andrew Davis [MS]"" <adavis@online.microsoft.com> wrote in message
news:a$wKdI1uDHA.2520@cpmsftngxa07.phx.gbl...
quote:

> BG,
>
> Benard is right on, if there haven't been any requests rejected by URLScan
> during that day then it won't create a log for that day. However if the


IIS
quote:

> services are restarted the filter will re-initialize create a log
> populating it with the current config info.
>
> Be aware there is PerDayLogging setting in the INI that will append
> everything into a single logfile, but this has to be modified from the
> default.
>
> - PerDayLogging=1 By default, this option is set to 1. If this value is
> set to 1, URLScan creates a new log file each day. Each log file is
> named Urlscan.<MMDDYY>.log, where <MMDDYY> is the date of the log file.
> If this value is set to 0, all logging is saved in the same file,
> regardless of the date.
>
> 326444 HOW TO: Configure the URLScan Tool
> http://support.microsoft.com/?id=326444
>
> This posting is provided "AS IS" with no warranties, and confers no


rights.
quote:

>
> Thanks!
> ~Andrew Davis
> Microsoft PSS Security
>
> --------------------
> | From: "Bernard" <qbernard@hotmail.com>
> | References: <OJEXMpquDHA.2244@TK2MSFTNGP09.phx.gbl>
> | Subject: Re: Questions URLSCAN
> | Date: Fri, 5 Dec 2003 12:48:02 +0800
> | Lines: 28
> | Organization: -
> | X-Priority: 3
> | X-MSMail-Priority: Normal
> | X-Newsreader: Microsoft Outlook Express 6.00.3790.0
> | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
> | Message-ID: <OUtK0ruuDHA.2508@TK2MSFTNGP12.phx.gbl>
> | Newsgroups: microsoft.public.inetserver.iis.security
> | NNTP-Posting-Host: 203.115.210.205
> | Path:
>


cpmsftngxa07.phx.gbl!cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP12.
quote:

> phx.gbl
> | Xref: cpmsftngxa07.phx.gbl microsoft.public.inetserver.iis.security:7615
> | X-Tomcat-NG: microsoft.public.inetserver.iis.security
> |
> | 1) Try to access your site with .exe type of request,
> | by default this extension is blocked and it will be logged in urlscan
> | logfile.
> |
> | 2) yes. and it will create a new log for the day if there's a request


that
quote:

> | has
> | been blocked.
> |
> | --
> | Regards,
> | Bernard Cheah
> | http://support.microsoft.com/
> | Please respond to newsgroups only ...
> |
> |
> |
> | "BG" <bg2@uasystem.ua.edu> wrote in message
> | news:OJEXMpquDHA.2244@TK2MSFTNGP09.phx.gbl...
> | > 1. How can you test if URLSCAN is working?
> | > 2. When is a new dated log file created? It appears to be created


only
quote:

> | when
> | > the IIS server is restarted.
> | >
> | > The reason I am asking is my log file most recent date is 11172003.
> | >
> | >
> |
> |
> |
>




Sponsored Links






Free braindumps | Software forum | Database administration forum

Copyright 2003 - 2008 webservertalk.com