MSFTPSVC Errors -- iis ftp

Joe NO[at]SPAM SAA
11/24/2004 8:13:02 AM

Over last weekend, I received several ID 100 MSFTPSVC login failures by bogus
account names. There were also ID 10 MSFTPSVC time-out messages. While
trying to research this, I looked at the IIS 5 log to get more detail. There
are entries with the bogus account names and an IP address, but I'm having
difficulty interpreting the rest of the log file. The log file is capturing
time, c-ip, cs-username, s-ip, s-port, cs-method, cs-uri-stem, sc-status,
sc-win32-status, & cs-(User-Agent). Is there info on what each of these
field codes means? I'm trying to figure out if someone got into the system

Bernard
11/25/2004 12:08:23 PM

That should be some failed login attempts you see in event log.
You learn more about the log field here,
http://www.microsoft.com/resources/documentation/IIS/6/all/techref/en-us/iisRG_LOG_4.mspx

For status code, you can refer -
IIS Status Codes
http://support.microsoft.com/?id=318380

--
Regards,
Bernard Cheah
http://www.tryiis.com/
http://support.microsoft.com/
http://www.msmvps.com/bernard/

[quoted text, click to view]

iis ftp : MSFTPSVC Errors