Logging Fails with Event ID 2 "The Data is the Error" in the Event Viewer (273777)

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx

SYMPTOMS

There are no corresponding logs in the c:\%Systemroot%\System32\LogFiles directory for any of the Web services included in Internet Information Server (IIS) 4.0.

NOTE: The drive letter may be different if Windows NT has been installed on a different partition.

The following error message is logged in the Event Viewer:

Event ID: 2
Source: IISLog
"The data is the error"

For each Web request from clients, there is a corresponding error message in the Event Viewer.

CAUSE

By default, IIS uses the user who is currently logged on to write the logs. It obtains the credentials of the current user from the current thread that is executing in the Identify.exe process.

When IIS is unable to run under the thread that is currently logged on, it reverts to the system account. In this case, the underlying NTFS permissions require the system account to have permissions to the c:\%Systemroot%\System32\LogFiles folder. The permission needed for the system account is Full Control.

RESOLUTION

To resolve this problem, do the following:

In Windows Explorer, open the c:\%Systemroot%\System32\LogFiles folder.
Right-Click the LogFiles folder, and then click Properties.
Click the Security tab, and then click Permissions.
Click Add, and then change the Type of Access for the system account to Full Control. Click OK three times.

To verify that the error message no longer occurs, check the c:\%Systemroot%\System32\LogFiles folder for log files being written.