Repeated 426 Entries in the IIS FTP Log (306183)
The information in this article applies to:
- Microsoft Internet Information Services version 6.0
- Microsoft Internet Information Services 5.0
- Microsoft Internet Information Server 4.0
This article was previously published under Q306183 We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site: SYMPTOMS
In the Internet Information Services (IIS) File Transfer Protocol (FTP) log, you may see entries that resemble the following:
00:00:23 192.168.1.1 [766026]closed - 426
00:00:28 192.168.1.1 [766027]closed - 426
00:00:33 192.168.1.1 [766028]closed - 426
00:00:38 192.168.1.1 [766029]closed - 426
00:00:48 192.168.1.1 [766031]closed - 426
00:00:58 192.168.1.1 [766033]closed - 426
00:01:08 192.168.1.1 [766035]closed - 426
00:01:13 192.168.1.1 [766036]closed - 426
CAUSE
This only occurs when the FTP site is clustered. Because of the nature of a clustered environment, the cluster service must know what resources are available. The IIS cluster resource does this through the Is-Alive and Keep-Alive functionality of Clusiis4.dll, its resource dynamic-link libraray (DLL). Because RFC 959 defines error 426 as "Connection closed; transfer aborted" and the Is-Alive or Keep-Alive operation is not a true FTP session, the error is logged.
STATUS
This behavior is by design.
| Modification Type: | Minor | Last Reviewed: | 6/23/2005 |
|---|
| Keywords: | kbpending kbprb KB306183 |
|---|
|