IIS Server Security - IIS logging to remote server

This is Interesting: Free IT Magazines  
Home > Archive > IIS Server Security > February 2005 > IIS logging to remote server





You are viewing an archived Text-only version of the thread. To view this thread in it's original format and/or if you want to reply to this thread please [click here]

Author IIS logging to remote server
Joe

2005-02-13, 5:50 pm

we run IIS 5.0, I would very much like to send all log files to a remote
server, but IIS doesn't allow changing to logging to a remote server, so I
got myself a copy of metaedit and changed it, it took the change but IIS is
unable to create the log folder regardless of all proper security in place,
event reports the following

Event Type: Error
Event Source: IISLOG
Event Category: None
Event ID: 2
Date: 2/13/2005
Time: 3:45:28 PM
User: N/A
Computer: IIS
Description:
IIS Logging was unable to create the directory \\server\share\W3SVC1. The
data is the error.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
Data:
0000: 7b 00 00 00 {...

Any possible workaround or do I need to upgrade to IIS 6.0, also can I
install IIS 6.0 as a separate component on my 2k box or do I have to upgrade
to 2k3

Thanks




Ken Schaefer

2005-02-13, 8:47 pm

What do you mean "proper security is in place"?

AFAIK, IIS Logfiles are written by LocalSystem, and LocalSystem can not be
assigned permissions to remote resources (such as file shares...)

Cheers
Ken

"Joe" <me@me.com> wrote in message
news:u3YpB%23gEFHA.2876@TK2MSFTNGP12.phx.gbl...
> we run IIS 5.0, I would very much like to send all log files to a remote
> server, but IIS doesn't allow changing to logging to a remote server, so I
> got myself a copy of metaedit and changed it, it took the change but IIS
> is unable to create the log folder regardless of all proper security in
> place, event reports the following
>
> Event Type: Error
> Event Source: IISLOG
> Event Category: None
> Event ID: 2
> Date: 2/13/2005
> Time: 3:45:28 PM
> User: N/A
> Computer: IIS
> Description:
> IIS Logging was unable to create the directory \\server\share\W3SVC1. The
> data is the error.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
> Data:
> 0000: 7b 00 00 00 {...
>
> Any possible workaround or do I need to upgrade to IIS 6.0, also can I
> install IIS 6.0 as a separate component on my 2k box or do I have to
> upgrade to 2k3
>
> Thanks
>
>
>
>



Phil Agcaoili

2005-02-14, 2:51 am

You can send the IIS logs using Snare to a Syslog server.

Try this FREE tool:
http://www.intersectalliance.com/pr...eIIS/index.html

Here are some guides to do this:
http://www.precision-guesswork.com/...ice-config.html

The old school technology to do this:
http://www.kiwisyslog.com/


"Joe" wrote:

> we run IIS 5.0, I would very much like to send all log files to a remote
> server, but IIS doesn't allow changing to logging to a remote server, so I
> got myself a copy of metaedit and changed it, it took the change but IIS is
> unable to create the log folder regardless of all proper security in place,
> event reports the following
>
> Event Type: Error
> Event Source: IISLOG
> Event Category: None
> Event ID: 2
> Date: 2/13/2005
> Time: 3:45:28 PM
> User: N/A
> Computer: IIS
> Description:
> IIS Logging was unable to create the directory \\server\share\W3SVC1. The
> data is the error.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
> Data:
> 0000: 7b 00 00 00 {...
>
> Any possible workaround or do I need to upgrade to IIS 6.0, also can I
> install IIS 6.0 as a separate component on my 2k box or do I have to upgrade
> to 2k3
>
> Thanks
>
>
>
>
>

Jeff Cochran

2005-02-15, 2:54 am

On Sun, 13 Feb 2005 16:05:45 -0500, "Joe" <me@me.com> wrote:

>we run IIS 5.0, I would very much like to send all log files to a remote
>server, but IIS doesn't allow changing to logging to a remote server, so I
>got myself a copy of metaedit and changed it, it took the change but IIS is
>unable to create the log folder regardless of all proper security in place,
>event reports the following
>
>Event Type: Error
>Event Source: IISLOG
>Event Category: None
>Event ID: 2
>Date: 2/13/2005
>Time: 3:45:28 PM
>User: N/A
>Computer: IIS
>Description:
>IIS Logging was unable to create the directory \\server\share\W3SVC1. The
>data is the error.
>For additional information specific to this message please visit the
>Microsoft Online Support site located at:
>http://www.microsoft.com/contentredirect.asp.
>Data:
>0000: 7b 00 00 00 {...
>
>Any possible workaround or do I need to upgrade to IIS 6.0, also can I
>install IIS 6.0 as a separate component on my 2k box or do I have to upgrade
>to 2k3


IIS will not log to a remote server. You can do ODBC logging, or use
a script to copy the log to a remote server after it rolls over, but
there is no way to force IIS to log to a remote server.

Jeff
Joe

2005-02-15, 2:54 am

you think this might help
http://support.microsoft.com/defaul...kb;en-us;289655

and I guess when you say IIS will not log to a remote server you mean IIS
5.0


"Jeff Cochran" <jeff.nospam@zina.com> wrote in message
news:42187c4a.6633999@msnews.microsoft.com...
> On Sun, 13 Feb 2005 16:05:45 -0500, "Joe" <me@me.com> wrote:
>
>
> IIS will not log to a remote server. You can do ODBC logging, or use
> a script to copy the log to a remote server after it rolls over, but
> there is no way to force IIS to log to a remote server.
>
> Jeff



Bernard

2005-02-15, 8:03 am

remote share logging only supported in IIS6.0

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/



"Joe" <me@me.com> wrote in message
news:uAr%23juxEFHA.3368@TK2MSFTNGP10.phx.gbl...
> you think this might help
> http://support.microsoft.com/defaul...kb;en-us;289655
>
> and I guess when you say IIS will not log to a remote server you mean IIS
> 5.0
>
>
> "Jeff Cochran" <jeff.nospam@zina.com> wrote in message
> news:42187c4a.6633999@msnews.microsoft.com...
>
>



Jeff Cochran

2005-02-15, 8:03 am

On Tue, 15 Feb 2005 00:05:09 -0500, "Joe" <me@me.com> wrote:

>you think this might help
>http://support.microsoft.com/defaul...kb;en-us;289655
>
>and I guess when you say IIS will not log to a remote server you mean IIS
>5.0


Yes, IIS5. And Null session shares is inviting trouble from a
security standpoint, though I've never tried it for logging.

If you want to log to a remote share, you need to upgrade to Server
2003/IIS6. Sorry I didn't read the entire question before answering
just a piece of it.

Jeff


>"Jeff Cochran" <jeff.nospam@zina.com> wrote in message
>news:42187c4a.6633999@msnews.microsoft.com...
>


Sponsored Links






Free braindumps | Software forum | Database administration forum

Copyright 2003 - 2008 webservertalk.com