Article ID: 839184
Article Last Modified on 10/27/2006
APPLIES TO
- Microsoft Operations Manager 2000 Service Pack 1
- Microsoft Internet Information Services 5.0
SYMPTOMS
After you install the Microsoft Internet Information Services (IIS) management pack module that is available for Microsoft Operations Manager 2000 Service Pack 1 (SP1), the following security rules may not work correctly if you are using Microsoft IIS 5.0.
Note The name of the management pack module is "Internet Information Server (IIS) Management Pack Module."
- Security: IIS Log: Error 401.1 - Logon failed
- Security: IIS Log: Error 401.2 - Logon failed due to server configuration
- Security: IIS Log: Error 401.3 - Unauthorized due to ACL on resource
- Security: IIS Log: Error 401.4 - Authorization failed by filter
For example, if you generate an Error 401.1 error by using Microsoft Internet Explorer, Microsoft Operations Manager (MOM) 2000 does not report the error.
If you have W3C Extended Logging turned on in IIS 5.0, the following is logged in the IIS 5.0 log file:
...GET / - 401 5 4644 584 47 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - - ...GET / - 401 5 4246 1070 16 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - - ...GET / - 401 5 4246 1070 16 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - - ...GET / - 401 5 4246 1070 0 HTTP/1.1 imerep Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322) - -
CAUSE
This problem occurs because IIS 5.0 does not log the substatus code of the 401 error. When MOM 2000 reads the IIS 5.0 log file, "GET / - 401 5" is interpreted as a 401.5 error because the "5" is read as a separate parameter. By default, the OnePoint service does not alert on 401.0 and 401.5 errors.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
MORE INFORMATION
For additional information about the IIS management pack module that is available for MOM 2000 SP1, visit the following Microsoft Web site:
Keywords: kbtshoot kbhttp404 kbreport kbserver kbevent kbperformance kbinterop kbnofix kbbug KB839184
