5 pts.
 windows server 2003 file auditing
I activated auditing on the local security policy and then defined auditing on a file being accessed as part of our site through IIS. Even tons of people are accessing that script to view our site, no events are appearing in the event viewer about this activity.

Software/Hardware used:
ASKED: May 12, 2008  8:17 AM
UPDATED: May 29, 2008  1:35 AM

Answer Wiki:
I think this happens because normally IIS has its own processes to access files and Windows 2003 doesn't audit <i>IUSR_xxxxx</i> and <i>IWAM_xxxxxx</i> users. Try and change the access information to that file to another user with not too much privileges and try again; this should populate your logs with audit information. Anyway if you are doing this for monitoring purposes this isn't the recommended solution. A better solution would probably be to include some code within the website file which logs into a database and logs the hits there. You could also setup the page to send a Microsoft Message Queue message so that if the database is down the data is still logged. This would require that some software be written to read the queue and process the data within the message.
Last Wiki Answer Submitted:  May 29, 2008  1:35 am  by  alessandro.panzetta   9,695 pts.
All Answer Wiki Contributors:  alessandro.panzetta   9,695 pts.
To see all answers submitted to the Answer Wiki: View Answer History.


Discuss This Question:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _