IIS Log exactly 65.536 bytes ???

Hi,

i have a strange behaviour on my IIS 5 box.

I administer my Web Server via Terminal Services and i check the IIS Logfiles on a daily basis.

>From time to time i encounter a LogFiles which, when opened in Notepad,
freezes the whole system. No Terminal Service reconnect - nothing. I have to reboot the machine.

I then copied this suspicious Logfile to another machine and open it via Notepad - only empty lines. Opened it in a Hex Editor. Only 00 (ASCII 00).

Each Logfiles showing this behaviour has a size of exactly 65.536 Bytes.

Another thing that makes me wonder is, that normally every logfile gets created by IIS at exactly 01.00. Only these suspicious Logfiles were created at a different time.

The setup is IIS5 (fully patched) and URLScan 2.1

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Has anybody encoutered such a behaviour - speculations also welcome.

greetings
dominick Received on Tue Nov 26 19:12:14 2002