Security

Re: URLScan Recycle

wadeh — Fri, 05 Sep 2008 22:34:36 GMT

We will write the log headers every time UrlScan is initialized and every time that the configuration changes.

UrlScan is loaded when the IIS worker process initializes, before any request is processed. And it is unloaded when the worker process shuts down, after the last request is done. There is no window of time where a request could be processed without UrlScan.

If you are seeing multiple log headers per day and are not changing the configuration, then it means that your worker process is recycling. This is a normal part of IIS operation and is nothing to worry about.

Thanks,
-Wade

Re: URLScan Recycle

naziml — Fri, 05 Sep 2008 19:18:58 GMT

We will insert the header in the log everytime you make changes to your urlscan configuration and save it. If there are errors with the changes you have made to config, this header will also contain warnings.

URLScan Recycle

jeremyn11 — Fri, 05 Sep 2008 18:24:12 GMT

In our URLScan logs we get the following quite a bit

- - - - - - - - - - - - - - - - - - - - - - - -

#Software: Microsoft UrlScan 3.0

#Version: 1.0

#Date: 2008-09-04 01:01:20

- - - - - - - - - - - - - - - - - - - - - - - -

Does anyone know if this means that UrlScan is recycling and we have a period of time where something like an SQL injection (if you setup the filters of course) can get through?

Respectfully,

-Jeremy