If you see empty lines at the end of the CURRENT logfile when you read it with notepad, it is because IIS seems not to flush its write buffer on a continual basis. If you see blank lines in OLD logfiles you may have a problem.
Hope this helps Rick -----Original Message----- From: [email protected] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, October 05, 2006 2:09 AM To: [email protected] Subject: [ossec-list] Re: IIS Log Analyzing Importance: Low Well then something that I enabled for extended logging properties on IIS messes my IIS servers because everyday it stops logging and I see lots of empty chars at the end of IIS log files. I enabled default options plus cs-username, s-sitename, s-computername, cs-host and cs-referrer on my five IIS servers then that side effects happened on all of them. Now I am going to remove extended logging options that I enabled one by one so we will understand which extra option messes the IIS servers. Could you give me the exact extended logging options that agent requires ? Btw those are IIS 5.0
