|
Home > Archive > IIS Server Security > February 2005 > IIS logging to remote server
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
IIS logging to remote server
|
|
|
| we run IIS 5.0, I would very much like to send all log files to a remote
server, but IIS doesn't allow changing to logging to a remote server, so I
got myself a copy of metaedit and changed it, it took the change but IIS is
unable to create the log folder regardless of all proper security in place,
event reports the following
Event Type: Error
Event Source: IISLOG
Event Category: None
Event ID: 2
Date: 2/13/2005
Time: 3:45:28 PM
User: N/A
Computer: IIS
Description:
IIS Logging was unable to create the directory \\server\share\W3SVC1. The
data is the error.
For additional information specific to this message please visit the
Microsoft Online Support site located at:
http://www.microsoft.com/contentredirect.asp.
Data:
0000: 7b 00 00 00 {...
Any possible workaround or do I need to upgrade to IIS 6.0, also can I
install IIS 6.0 as a separate component on my 2k box or do I have to upgrade
to 2k3
Thanks
| |
| Ken Schaefer 2005-02-13, 8:47 pm |
| What do you mean "proper security is in place"?
AFAIK, IIS Logfiles are written by LocalSystem, and LocalSystem can not be
assigned permissions to remote resources (such as file shares...)
Cheers
Ken
"Joe" <me@me.com> wrote in message
news:u3YpB%23gEFHA.2876@TK2MSFTNGP12.phx.gbl...
> we run IIS 5.0, I would very much like to send all log files to a remote
> server, but IIS doesn't allow changing to logging to a remote server, so I
> got myself a copy of metaedit and changed it, it took the change but IIS
> is unable to create the log folder regardless of all proper security in
> place, event reports the following
>
> Event Type: Error
> Event Source: IISLOG
> Event Category: None
> Event ID: 2
> Date: 2/13/2005
> Time: 3:45:28 PM
> User: N/A
> Computer: IIS
> Description:
> IIS Logging was unable to create the directory \\server\share\W3SVC1. The
> data is the error.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
> Data:
> 0000: 7b 00 00 00 {...
>
> Any possible workaround or do I need to upgrade to IIS 6.0, also can I
> install IIS 6.0 as a separate component on my 2k box or do I have to
> upgrade to 2k3
>
> Thanks
>
>
>
>
| |
| Phil Agcaoili 2005-02-14, 2:51 am |
| You can send the IIS logs using Snare to a Syslog server.
Try this FREE tool:
http://www.intersectalliance.com/pr...eIIS/index.html
Here are some guides to do this:
http://www.precision-guesswork.com/...ice-config.html
The old school technology to do this:
http://www.kiwisyslog.com/
"Joe" wrote:
> we run IIS 5.0, I would very much like to send all log files to a remote
> server, but IIS doesn't allow changing to logging to a remote server, so I
> got myself a copy of metaedit and changed it, it took the change but IIS is
> unable to create the log folder regardless of all proper security in place,
> event reports the following
>
> Event Type: Error
> Event Source: IISLOG
> Event Category: None
> Event ID: 2
> Date: 2/13/2005
> Time: 3:45:28 PM
> User: N/A
> Computer: IIS
> Description:
> IIS Logging was unable to create the directory \\server\share\W3SVC1. The
> data is the error.
> For additional information specific to this message please visit the
> Microsoft Online Support site located at:
> http://www.microsoft.com/contentredirect.asp.
> Data:
> 0000: 7b 00 00 00 {...
>
> Any possible workaround or do I need to upgrade to IIS 6.0, also can I
> install IIS 6.0 as a separate component on my 2k box or do I have to upgrade
> to 2k3
>
> Thanks
>
>
>
>
>
| |
| Jeff Cochran 2005-02-15, 2:54 am |
| On Sun, 13 Feb 2005 16:05:45 -0500, "Joe" <me@me.com> wrote:
>we run IIS 5.0, I would very much like to send all log files to a remote
>server, but IIS doesn't allow changing to logging to a remote server, so I
>got myself a copy of metaedit and changed it, it took the change but IIS is
>unable to create the log folder regardless of all proper security in place,
>event reports the following
>
>Event Type: Error
>Event Source: IISLOG
>Event Category: None
>Event ID: 2
>Date: 2/13/2005
>Time: 3:45:28 PM
>User: N/A
>Computer: IIS
>Description:
>IIS Logging was unable to create the directory \\server\share\W3SVC1. The
>data is the error.
>For additional information specific to this message please visit the
>Microsoft Online Support site located at:
>http://www.microsoft.com/contentredirect.asp.
>Data:
>0000: 7b 00 00 00 {...
>
>Any possible workaround or do I need to upgrade to IIS 6.0, also can I
>install IIS 6.0 as a separate component on my 2k box or do I have to upgrade
>to 2k3
IIS will not log to a remote server. You can do ODBC logging, or use
a script to copy the log to a remote server after it rolls over, but
there is no way to force IIS to log to a remote server.
Jeff
| |
|
| you think this might help
http://support.microsoft.com/defaul...kb;en-us;289655
and I guess when you say IIS will not log to a remote server you mean IIS
5.0
"Jeff Cochran" <jeff.nospam@zina.com> wrote in message
news:42187c4a.6633999@msnews.microsoft.com...
> On Sun, 13 Feb 2005 16:05:45 -0500, "Joe" <me@me.com> wrote:
>
>
> IIS will not log to a remote server. You can do ODBC logging, or use
> a script to copy the log to a remote server after it rolls over, but
> there is no way to force IIS to log to a remote server.
>
> Jeff
| |
|
|
| Jeff Cochran 2005-02-15, 8:03 am |
| On Tue, 15 Feb 2005 00:05:09 -0500, "Joe" <me@me.com> wrote:
>you think this might help
>http://support.microsoft.com/defaul...kb;en-us;289655
>
>and I guess when you say IIS will not log to a remote server you mean IIS
>5.0
Yes, IIS5. And Null session shares is inviting trouble from a
security standpoint, though I've never tried it for logging.
If you want to log to a remote share, you need to upgrade to Server
2003/IIS6. Sorry I didn't read the entire question before answering
just a piece of it.
Jeff
>"Jeff Cochran" <jeff.nospam@zina.com> wrote in message
>news:42187c4a.6633999@msnews.microsoft.com...
>
|
|
|
|
|