"pj_servadmin" <pjservadmin@discussions.microsoft.com> wrote in message
news:7EC86006-523E-474D-B4A1-65ADD94FD1D9@microsoft.com...
>I have a script running on a <remotehost> that can currently contact a
>2000AC
> box and retrieve & then delete all the available log files for each vhost
> via
> ftp, which looks like this:
>
> 06:02:00 <remotehost> [23]USER iislog 331
> 06:02:00 <remotehost> [23]PASS - 230
> 06:02:02 <remotehost> [23]sent /iislog/W3SVC1/ex050508.log 226
> 06:02:02 <remotehost> [23]DELE /iislog/W3SVC1/ex050508.log 250
> 06:02:02 <remotehost> [24]USER iislog 331
> 06:02:02 <remotehost> [24]PASS - 230
> 06:02:03 <remotehost> [24]sent /iislog/W3SVC3/ex050508.log 226
> 06:02:03 <remotehost> [24]DELE /iislog/W3SVC3/ex050508.log 250
> etc...
>
> I also have a new Windows2k3 box that has been setup exactly the same way,
> AFAIK. That box gets this for logs:
>
> 07:12:11 <remotehost> [3]USER <domain>\<username> 331 0
> 07:12:11 <remotehost> [3]PASS - 230 0
> 07:12:11 <remotehost> [3]CWD W3SVC1088925775 250 0
> 07:12:11 <remotehost> [3]sent /W3SVC1/ex050412.log 426 64
> 07:14:12 <remotehost> [3]sent /W3SVC1/ex050413.log 426 64
> 07:16:11 <remotehost> [3]sent /W3SVC1/ex050414.log 426 64
> 07:18:11 <remotehost> [3]sent /W3SVC1/ex050415.log 426 64
> 07:20:11 <remotehost> [3]sent /W3SVC1/ex050426.log 226 0
> 07:20:11 <remotehost> [3]sent /W3SVC1/ex050427.log 226 0
> 07:20:11 <remotehost> [3]sent /W3SVC1/ex050502.log 226 0
> 07:20:11 <remotehost> [3]sent /W3SVC1/ex050504.log 226 0
> 07:20:11 <remotehost> [3]sent /W3SVC1/ex050505.log 226 0
> 07:20:11 <remotehost> [3]sent /W3SVC1/ex050506.log 426 64
> 07:22:12 <remotehost> [3]CWD .. 250 0
>
> The only thing that looks really out of the ordinary is the new notation
> "426 64", and the fact that the <remotehost> was making an ftp request
> every
> two minutes, when these are extremely small log files which should only
> take
> like 1-2 seconds to transfer.
>
> Any thoughts?