IIS Log - is it really strange one or it is ok?

[vladibo]

I am not IIS Administration expert so I may be wrong but as I look on our production IIS log there are serveral stange thinds there the logs look like that

date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2005-09-16 04:00:01 10.222.19.103 GET / - 443 - 10.222.19.3 - 401 2 2148074254

this is a single record but all the records are like that. So I'll start with the strange issus one by one:

1. Why I don't see here pages being hit (cs-uri-stem and cs-uri-query )?

2. Why HTTP status sc-status is 401 that means Unothorized. EACH request is like that. Is that normal?

3. What means sc-win32-status = 2148074254? I got very often sc-win32-status = 64 and if I check it with

net helpmsg 64 it gives me
"The specified network name is no longer available"

What does it mean?

Thank you for any comments on those questions.

 

[ChrisHirst]

A virus infiltration attempt on port 443

the URI stem is the root thats why "/" is there and cs-uri-query would be where the query string would be shown.

Chris.

Indifference will be the downfall of mankind, but who cares?
Woo Hoo! the cobblers kids get new shoes.
People Counting Systems

So long, and thanks for all the fish.