Microsoft KB Archive/306183

= Repeated 426 Entries in the IIS FTP Log =

Article ID: 306183

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Internet Information Services 6.0
 * Microsoft Internet Information Services 5.0
 * Microsoft Internet Information Server 4.0

-



This article was previously published under Q306183



We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx



SYMPTOMS
In the Internet Information Services (IIS) File Transfer Protocol (FTP) log, you may see entries that resemble the following: 00:00:23 192.168.1.1 [766026]closed - 426 00:00:28 192.168.1.1 [766027]closed - 426 00:00:33 192.168.1.1 [766028]closed - 426 00:00:38 192.168.1.1 [766029]closed - 426 00:00:48 192.168.1.1 [766031]closed - 426 00:00:58 192.168.1.1 [766033]closed - 426 00:01:08 192.168.1.1 [766035]closed - 426 00:01:13 192.168.1.1 [766036]closed - 426



CAUSE
This only occurs when the FTP site is clustered. Because of the nature of a clustered environment, the cluster service must know what resources are available. The IIS cluster resource does this through the Is-Alive and Keep-Alive functionality of Clusiis4.dll, its resource dynamic-link libraray (DLL). Because RFC 959 defines error 426 as &quot;Connection closed; transfer aborted&quot; and the Is-Alive or Keep-Alive operation is not a true FTP session, the error is logged.



STATUS
This behavior is by design.

Additional query words: iis 5

Keywords: kbprb kbpending KB306183

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.