iis management pack - useless rules

i was running a couple of mom sql scripts that generate most common events and most common alerts. (if you're not doing this yet, you probably should make a point of doing this about once a week or so... just to make sure you're not getting any event storms.) anyway, turns out two rules were generating about 80,000 events in a 4 day window on one management group. it generated about 750,000 events on another management group. that's right - 750,000. i would categorize that as a complete and ridiculous oversight when MS was building this particular MP. these were picked up as "informational". i'm going to equate that to useless in this case. if you load up the IIS MP, i strongly suggest disabling the following two rules:
  • All HTTP 400 Errors
  • All HTTP 500 Errors
you can locate these rules under this path: microsoft windows internet information services\internet information services x.x\core services\world wide web publishing service. note that the x.x represents 5.0 and 6.0. needs to be disabled in both places.

Comments

  1. you are making that up - matthew

    ReplyDelete
  2. in my environment these are mostly 401,1 and 401,2 events, but for some weird reason the subcode is parameter 30 (or something) and you can only match up to parameter 25 (according to the gui) Just the sort of thing that really gets my goat....

    ReplyDelete

Post a Comment