Web Server logs

  • From: isa@xxxxxxxxx
  • To: isalist@xxxxxxxxxxxxx
  • Date: Thu, 25 Apr 2002 02:54:16 -0600

Hi ISAlist
I need to know who is visiting my websites. My Webserver is published
behind the ISA server. When i look at the WWW Server logs all i get is
....
172.20.1.15 - - [24/Apr/2002:15:30:23 +0200] "GET /index HTTP/1.0" 404
4184
172.20.1.15 - - [24/Apr/2002:15:30:29 +0200] "GET
/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.0" 404 4184
172.20.1.15 - - [24/Apr/2002:15:30:44 +0200] "GET
/_vti_bin/..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\
HTTP/1.0" 500 0
172.20.1.15 - - [24/Apr/2002:15:30:51 +0200] "GET
/winnt/system32/cmd.exe?/c+dir+c:\ HTTP/1.0" 404 4184
172.20.1.15 - - [24/Apr/2002:15:31:15 +0200] "GET
/cgi-bin/..%5c..%5c..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe?/c+dir+c:\
HTTP/1.0" 500 0....

The ISA Server address is 172.20.1.15. I can't see any IP's from outside.
Is there a way i can monitor this?


Other related posts: