I was trying to trouble shoot a problem today with a client that was using frontpage extensions to post web page updates to their IIS 4.0 server. To make a long story short, if I do a sniff of traffic on the network passing to the IIS server, I clearly see the server issuing a HTTP 403 Access Denied error. My knowledge of IIS is somewhat limited, but I know in apache, that if the server issues something like this, it is not only logged but the reason why it was denied is shown (for example file permissions). I started having him go through the event logs and through the individual logs for IIS and it at least appears to me ATM that IIS only logs the HTTP GET/POST/OPTIONS requests and does not appear to log errors such as file not found, file permisisons, access denied, etc. I can see in the log where he issued the HTTP requests to the server, but I can' t see the status of them.

The question, 1) Does IIS or NT have a log somewhere for things like this ? 2) If so, is it not on by default ? If not, how do you turn it on and where will the logs be placed ?

Any help would be appreciated...

Neb