Re: IIS FTP Problem

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

This is typical probing or attack to your ftp server.
It's normal if you have a ftp server that is facing the internet publicly.

As for the monitoring, well - you can try google, some utility monitor event
log, and triggered email base on event logged, in your case event id 100. or
you can also use log parser to parse the log file on certain time, then use
smtp to send out the mail.

--
Regards,
Bernard Cheah
http://www.iis-resources.com/
http://www.iiswebcastseries.com/
http://msmvps.com/blogs/bernard/


"Rob Madison" <none> wrote in message
news:ebt9QRZQGHA.1728@xxxxxxxxxxxxxxxxxxxxxxx
The system is fully patched. I was at the system Sunday, wading through
event viewer & MSFTPSVC1 log files. One day in Feb had 300+ attempts in a
2-3min period using varuious usernames such as "admin", "guest", "test",
"adminitrator" and my favorite "Administrateur". I've created rules in our
firewall (Sonicwall Pro) to block that IP. But it's still a crap shoot. In
March, same thing happened again with a different IP. Most of those
attempts used "Administrator" at login.

I'm also trying to find some type of IIS Monitoring software that will
look at the MSFTPSVC log files and send some type of alert to me when it
sees a certain amount of failed login attempts.

Rob Madison
MCP, MCSA

Chris Crowe [MVP 1997 -> 2006] wrote:
It sounds like a problem in authenticating with the domain (if they are
domain accounts)

Are you fully patches and with the latest service pack?

Chris




.

Relevant Pages

  • Re: Pinning down a SYSTEM-F-EXQUOTA
    ... SYS$OUTPUT is the log file, unless it's been redirected to a mailbox, ... If it's the log file, or redirected to another file, then you're probably ... you might be able to affect that with a SET RMS command. ... By comparison, I've never had a browser, ftp server, or ftp client ...
    (comp.os.vms)
  • Re: managment software for FTP server.
    ... like the log file. ... But in real time and with graphic interface. ... that's one part ftp server can provide. ... > remote desktop, vnc, pcanywhere, TS and etc. ...
    (microsoft.public.inetserver.iis.ftp)
  • Re: logrotate and perl file handles. How do I know when to reopen my log file?
    ... I'm not monitoring the log file, I'm writing to it. ... logrotate and perl file handles. ...
    (perl.beginners)
  • Re: OMVS txt file problem
    ... I didn't provide for supplying the ID and password to the FTP server. ... If your program is not expected to close its log file in a reasonable ... For IBM-MAIN subscribe / signoff / archive access instructions, ... send email to listserv@xxxxxxxxxxx with the message: GET IBM-MAIN INFO ...
    (bit.listserv.ibm-main)
  • Re: Oracle Performance on V240
    ... The config sounds ... Log file protection is a crucial ... plan on monitoring and tweaking. ... > Canada-wide Oracle training and consulting ...
    (comp.databases.oracle.server)