Repeated 426 Entries in the IIS FTP Log

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:For more information about IIS 7.0, visit the following Microsoft Web site:

Symptoms

In the Internet Information Services (IIS) File Transfer Protocol (FTP) log, you may see entries that resemble the following:


00:00:23 192.168.1.1 [766026]closed - 426
00:00:28 192.168.1.1 [766027]closed - 426
00:00:33 192.168.1.1 [766028]closed - 426
00:00:38 192.168.1.1 [766029]closed - 426
00:00:48 192.168.1.1 [766031]closed - 426
00:00:58 192.168.1.1 [766033]closed - 426
00:01:08 192.168.1.1 [766035]closed - 426
00:01:13 192.168.1.1 [766036]closed - 426

Cause

This only occurs when the FTP site is clustered. Because of the nature of a clustered environment, the cluster service must know what resources are available. The IIS cluster resource does this through the Is-Alive and Keep-Alive functionality of Clusiis4.dll, its resource dynamic-link libraray (DLL). Because RFC 959 defines error 426 as "Connection closed; transfer aborted" and the Is-Alive or Keep-Alive operation is not a true FTP session, the error is logged.

Status

This behavior is by design.
Proprietăți

ID articol: 306183 - Ultima examinare: 30 iul. 2008 - Revizie: 1

Feedback