Repeated 426 Entries in the IIS FTP Log

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:For more information about IIS 7.0, visit the following Microsoft Web site:


In the Internet Information Services (IIS) File Transfer Protocol (FTP) log, you may see entries that resemble the following:

00:00:23 [766026]closed - 426
00:00:28 [766027]closed - 426
00:00:33 [766028]closed - 426
00:00:38 [766029]closed - 426
00:00:48 [766031]closed - 426
00:00:58 [766033]closed - 426
00:01:08 [766035]closed - 426
00:01:13 [766036]closed - 426


This only occurs when the FTP site is clustered. Because of the nature of a clustered environment, the cluster service must know what resources are available. The IIS cluster resource does this through the Is-Alive and Keep-Alive functionality of Clusiis4.dll, its resource dynamic-link libraray (DLL). Because RFC 959 defines error 426 as "Connection closed; transfer aborted" and the Is-Alive or Keep-Alive operation is not a true FTP session, the error is logged.


This behavior is by design.

ID articol: 306183 - Ultima examinare: 30 iul. 2008 - Revizie: 1