Prev: virtual directory password
Next: default apps pool stops
From: DY on 10 Sep 2010 09:56
Posted the question below in the System Center forums, and was informed that
it should be posted here. This is just a small piece of the log, but the
entries continue exactly as shown below. Also, if you look at the time stamp,
it's all in one giant lump.

Trying to determine what these log entries are, and how to stop them. We are
getting around 22MB/day of the exact same log entries in the IIS logs on our
SCE 2007 SP1 server.



#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2010-09-08 00:00:04
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port
cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607) 401 2 2148074254
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607) 401 1 0
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 domain\username 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607) 200 0 0
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607) 401 2 2148074254
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607) 401 1 0
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 domain\username 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607) 200 0 0
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607) 401 2 2148074254
2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
/ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
Mozilla/4.0+(compatible;+MSIE+6.0;

From: Ken Schaefer on 12 Sep 2010 07:26
What is the username in domain\username? Do you recognize it?

The pattern is "normal" - it's an NTLM challenge/response pattern (2 x 401
followed by a 200 for HTTP status), though it's unusual that you would see
that over and over again.

Cheers
Ken

"DY" <DY(a)discussions.microsoft.com> wrote in message
news:1FEB9056-79E2-42A2-B439-726FBE685B5E(a)microsoft.com...
> Posted the question below in the System Center forums, and was informed
> that
> it should be posted here. This is just a small piece of the log, but the
> entries continue exactly as shown below. Also, if you look at the time
> stamp,
> it's all in one giant lump.
>
> Trying to determine what these log entries are, and how to stop them. We
> are
> getting around 22MB/day of the exact same log entries in the IIS logs on
> our
> SCE 2007 SP1 server.
>
>
>
> #Software: Microsoft Internet Information Services 6.0
> #Version: 1.0
> #Date: 2010-09-08 00:00:04
> #Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query
> s-port
> cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607)
> 401 2 2148074254
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607)
> 401 1 0
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 domain\username 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607)
> 200 0 0
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607)
> 401 2 2148074254
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607)
> 401 1 0
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 domain\username 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607)
> 200 0 0
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.3607)
> 401 2 2148074254
> 2010-09-08 00:00:04 W3SVC1 10.0.0.103 POST
> /ReportServer$SCE/ReportService2005.asmx - 80 - 10.0.0.103
> Mozilla/4.0+(compatible;+MSIE+6.0;
>
 | 
Pages: 1
Prev: virtual directory password
Next: default apps pool stops