HTTP 404.x errors are not reported in Microsoft Operations Manager 2000

View products that this article applies to.

SYMPTOMS

After you install the Microsoft Internet Information Services (IIS) management pack module that is available for Microsoft Operations Manager 2000 Service Pack 1 (SP1), the following security rules may not work correctly if you are using Microsoft IIS 5.0.

Note The name of the management pack module is "Internet Information Server (IIS) Management Pack Module."

Security: IIS Log: Error 401.1 - Logon failed
Security: IIS Log: Error 401.2 - Logon failed due to server configuration
Security: IIS Log: Error 401.3 - Unauthorized due to ACL on resource
Security: IIS Log: Error 401.4 - Authorization failed by filter

For example, if you generate an Error 401.1 error by using Microsoft Internet Explorer, Microsoft Operations Manager (MOM) 2000 does not report the error.

If you have W3C Extended Logging turned on in IIS 5.0, the following is logged in the IIS 5.0 log file:

...GET / - 401 5 4644 584 47 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -
...GET / - 401 5 4246 1070 16 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -
...GET / - 401 5 4246 1070 16 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -
...GET / - 401 5 4246 1070 0 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -

Back to the top

CAUSE

This problem occurs because IIS 5.0 does not log the substatus code of the 401 error. When MOM 2000 reads the IIS 5.0 log file, "GET / - 401 5" is interpreted as a 401.5 error because the "5" is read as a separate parameter. By default, the OnePoint service does not alert on 401.0 and 401.5 errors.

Back to the top