Advanced Topics

Re: which log should i concern about

qbernard — Tue, 30 Jun 2009 08:46:17 GMT

There're lot of scripts sample online... or you can get the book here
http://msmvps.com/blogs/bernard/archive/2005/06/26/55964.aspx

Unfortunately, the IIS sample chapter link is broken, I have yet to find a place to host it again.

Re: which log should i concern about

gwl7810 — Thu, 25 Jun 2009 07:37:21 GMT

I have gathered logs from several web site and stored it at sql server,now i wanna use a sql script find out useful information,but i don't know ,which log should i focus on?

any response will be appreciated

Re: which log should i concern about

steve schofield — Thu, 25 Jun 2009 04:03:56 GMT

%windir%\system32\logfiles\w3svcXXX on IIS 6

C:\Inetpub\Logs\Logfiles\w3svcXXX on IIS 7

These are the default paths.

Also look at c:\windows\system32\logfiles\httperr for 503 and 400 type hits.

Re: which log should i concern about

gwl7810 — Thu, 25 Jun 2009 01:38:02 GMT

sorry ,I wanna focus on iis log and find out evidence indicate threat of scan and invade ,

Re: which log should i concern about

qbernard — Wed, 24 Jun 2009 14:15:38 GMT

depend on what info you like to get.. then you will focus on those types of log.

Say - system events - then events log. if you say urlscan, then urlscan log.

which log should i concern about

gwl7810 — Wed, 24 Jun 2009 03:56:59 GMT

which log should i conern about? can someone tell me?

thx in advance .