Collecting ETW traces for FTP Sessions

SuDT — Thu, 28 Aug 2008 23:28:27 GMT

Having problems with FTP Server not returning the expected return code? You have checked the detailed error message, nt event log and ftp log files, still can not get to the bottom of the problem?

Here are few simple steps you can follow to trace your ftp session and uncover the real cause. This feature is supported on Microsoft FTP Sever 7.0, which can be downloaded from http://www.microsoft.com/downloads/details.aspx?familyid=2ECCF14A-5C4F-4CFB-9153-CFE1204B346A&displaylang=en, and above.

1. Start FTP ETW Session using logman.exe

Note: You need to be a system administrator on the FTP Server to be able to execute this command.

logman start "ftp" -p "IIS: Ftp Server" 255 5 –ets

2. Reproduce the error you are hitting

3. Stop FTP ETW Session using logman.exe

Note: You need to be a system administrator on the FTP Server to be able to execute this command.

logman stop "ftp" –ets

4. Parse the etw log file using logparser.exe

Note: LogParser can be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

<Path To LogParser>\logparser "select EventTypeName, UserData from ftp.etl" -e 20 -o:DATAGRID -rtp 20 -compactModeSep " | "

The final step will open the etw log in the following grid format

In the above case the error is (Event #18) 0x8007002 (Specified File Not Found).

-Suditi

IIS7 Upgrade from IIS5.1 with out URLScan

SuDT — Thu, 12 Apr 2007 02:05:00 GMT

I assume, after upgrading your IIS5.1 box, which was happily hosting your personal web site for last 5 years, to IIS7.0, no more works. Not to worry, check the following few things and you should be able to get back working web site again.

Keeping security threat in mind, we have taken some security steps to prevent any malicious attack by the “not so good internet citizens” on your box. If you did not have URLScan installed with your IIS5.1, then on upgrade, IIS services will be disabled. You can start IIS Admin UI (inetmgr.exe) and a pop up should appear with the right set information on why and what services are disabled and how to enable them. The same set of services will also be disabled if you had Front Page Server Extensions installed on your XP install. Mainly the following services will be disabled.

1> World Wide Publishing Service (w3svc)

2> IIS Admin Service (iisadmin)

3> Microsoft FTP Service (msftpsvc)

You can simply go to services.msc (start > services.msc) and enable the above mentioned services first and then start them OR simply type the following lines in a command prompt

SC CONFIG <service name> start= demand

NET START <service name>

You can use RequestFiltering module in IIS7.0 in the place of UrlScan tool and configure your server appropriately.

sudt

Collecting ETW traces for FTP Sessions

IIS7 Upgrade from IIS5.1 with out URLScan