Caroline, What version of the IIS filter are you using? It looks like the IP mismatch should only be reported to the Event Viewer if <WriteDataToEventViewer> is set to "true". I'd recommend setting this to "false" unless you're trying to troubleshoot something.
The reason this event is interesting to cosign is it is letting you know that a user has changed IP addresses since logging in and it is possible somebody is trying to replay their service cookie. (Of course, there are many other benign reasons for an IP address change.) Jarod On Apr 28, 2009, at 10:16 AM, Caroline Couture wrote: > Hi Folks! > > We have been getting this cosign warning since we installed it. It > seems to be happening every time a user authenticates. They have no > problems authenticating or using the application in question. > > I think this means we are missing something in our cosign set up. > > Any clues as to what this means? > > Event Type: Information > Event Source: CosignFilter > Event Category: (1) > Event ID: 1 > Date: 4/28/2009 > Time: 12:19:14 AM > User: N/A > Computer: WEBxxx > Description: > The description for Event ID ( 1 ) in Source ( CosignFilter ) cannot > be found. The local > computer may not have the necessary registry information or message > DLL files to display messages from a remote computer. You may be > able to use the /AUXSOURCE= flag to retrieve this description; see > Help and Support for details. The following information is part of > the event: Server IP info for client 130.91.241.xxx does not match > browser IP 130.91.240.xxx. > > Thanks! > Caroline > > Caroline Couture > College House Computing > 3702 Spruce Street > Philadelphia, PA 19104 > > You must never confuse faith that you will prevail in the end -- > which you can never afford to lose -- with the discipline to > confront the most brutal facts of your current reality, whatever > they might be. > -- Vice Admiral James Bond Stockdale > ------------------------------------------------------------------------------ > Register Now & Save for Velocity, the Web Performance & Operations > Conference from O'Reilly Media. Velocity features a full day of > expert-led, hands-on workshops and two days of sessions from industry > leaders in dedicated Performance & Operations tracks. Use code > vel09scf > and Save an extra 15% before 5/3. http://p.sf.net/sfu/velocityconf > _______________________________________________ > Cosign-discuss mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/cosign-discuss > > ------------------------------------------------------------------------------ Register Now & Save for Velocity, the Web Performance & Operations Conference from O'Reilly Media. Velocity features a full day of expert-led, hands-on workshops and two days of sessions from industry leaders in dedicated Performance & Operations tracks. Use code vel09scf and Save an extra 15% before 5/3. http://p.sf.net/sfu/velocityconf _______________________________________________ Cosign-discuss mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/cosign-discuss
