We are excited to announce that the IIS.NET Forums are moving to the new Microsoft Q&A experience. Learn more >

Log File WeirdnessRSS

1 reply

Last post Feb 13, 2005 09:55 PM by Qbernard

  • Log File Weirdness

    Feb 09, 2005 12:16 PM|ojm37|LINK

    I have an ISAPI Filter that grabs a cookie and sets the username for the logfile. Seems to work OK in IIS6.0. However, we're seeing some weirdness with the logfile and don't know if it's the ISAPI filter (or if it could be the filter) or something else. Here's what's happening: some entries in the logfile do not seem to know what browser is being used OR show the cookies or referrer. There will be two entries in the logfile for the same IP Address: one has the cookies, etc. and the other does not. We have code in place that is not supposed to let people get to these URLs on our site unless they have cookies enabled. Here's an example of the two entries:#Fields: date time cs-method cs-uri-stem cs-uri-query cs-username c-ip cs(User-Agent) cs(Cookie) cs(Referer) sc-status sc-bytes 2004-12-20 03:21:05 GET /qmachine.asp UID=13R0WGM1&userid=username username 148.78.2xx.25 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1) SiteDisplayedCookie=languageDisplayed=146&SiteDisplayed=www%2Esitename% 2Ecom;+FormsAuth=;+User=PWD=708A78B4F6EBA36&UBID=F73A302F5726F0613A821D7A8 AADDFF0;+AMFORMSAUTH=username;+Discuss=med=12%2F7%2F2004+6%3A32% 3A44+PM&UID=username http://www.sitename.com/index.asp?sec=def 200 27044 2004-12-20 03:21:05 GET /ad.aspx ZoneID=4&Keywords=sec_edu_cotd&Task=Get&Mode=HTML&SiteID=1&PageID=80048&Adv ertiserID=1&BannerID=11368&CampaignID=10568 - 148.78.2xx.25 Mozilla/3.01+ (compatible;-) - - 302 645 Note how the 2nd line has "-" for both cs(Cookie) and cs(Referer), while the 1st has data values. Also, sometimes the call to /ad.aspx WILL have data and sometimes it will not. Sometimes requests for images have no data as well. (I've modified the data to protect privacy) Any ideas? TIA,
    Owen
  • Re: Log File Weirdness

    Feb 13, 2005 09:55 PM|qbernard|LINK

    My guess is that the 2nd request has a status code of 302. 302 - Object moved / redirected
    Cheers,
    Bernard Cheah