IIS 7.0 : Setting Up Remote Logging by Using Appcmd & Remote Logging Using the FTP 7.0 Publishing Service

Setting Up Remote Logging by Using Appcmd

You can also use Appcmd to update the logfile directory for a specific Web site. The syntax for configuring UNC remote logging using Appcmd is shown here. (The line has been split to fit it on the printed page.)

//Appcmd to set the log directory path for Default Web Site
Appcmd set sites "Default Web Site"
    -logFile.directory:\\RemoteServerCMD.Contoso.com\LogFiles

Note

To automate configuring remote logging, you could put this example into a script to which you can pass variables.

Executing this command results in the following output:

SITE object "Default Web Site" changed

Remote Logging Using the FTP 7.0 Publishing Service

The FTP 7.0 Publishing Service is an out-of-band add-on that is meant to replace the built-in FTP service. The FTP 7.0 Publishing Service supports logs stored on a remote computer, which can enhance your ability to track down security breaches. Imagine a particular machine is compromised, but you have your logs stored on a remote system. When the infiltrator tries to cover her tracks by deleting the local log files, those log files will be unavailable because they are stored on a remote share. If your remote share uses DFS, the log files can even be replicated to multiple locations. Remote logging with replication can help in your forensic efforts. To configure the FTP logs to be stored on a remote server, you just have to configure your remote server that houses your logs files the same as you would configure a Web server. Figure 1 shows the FTP 7.0 Publishing Service configured to log remotely.

Figure 1. FTP 7.0 Publishing Service configured to store log files on a remote computer.