We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

How to disable specific Event ID's from being logged in Event Viewer

Medium Priority
6,342 Views
Last Modified: 2013-12-05
I have an event in my event viewer that I would like to simply not log at all. It's from my IIS FTP site, W2K3 SBS  which tells me that an FTP user has timed out after xxx seconds. The users are from PLC type controllers that send files to our server on the hour. Each hour I get many of these warnings as the controller finishes uploading it's log files. I have played with the timeout settingson the FTP site from 5 seconds to 240 seconds which is what it is set on now. The controller, once done uploading don't disconnect for some reaosn but in it's logs I can see it issue a Quit command at the end. It doesn't seem to hurt that they don't disconnect so I just want to stop the event log from logging this event.   What do I need to do to stop this?  The ID is:
Source: MSFTPSVC
Category: None
EventID: 10
User OMT2@omt.com at host 192.168.1.34 has timed-out after 240 seconds of inactivity.

Again, this login comes from a machine that uploads it's log files to an FTP folder on our server. I have messed with the controller settings, contacted the Manufacturer and, now, just want to disable this Warning in my event log. How do I go about this?
Comment
Watch Question

Top Expert 2008
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION

Author

Commented:
Is the inability to stop this particular event hold true for just for the IIS FTP site? I had a lot of Sharepoint errors in my event logs and was able to stop certain ones by making changes in the Sharepoint Administration. It actually stopped certain events from being logged at all. I really was hoping that there would be a way to stop the IIS FTP events from being logged.
Top Expert 2008

Commented:
Hi,

You can control some logging, but not that one (I think)

take a look at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ftpsvc\Parameters

there is a key called 'LogNonAnonymous' - default is zero.  I suspect that your log event message is not one of these, but if the value is '1', set to zero and see if it makes a difference.  Otherwise, use a third party event viewer instead.

Cheers!

Author

Commented:
I have a key called: MSFTPSVC, there is no FTPSVC so I figured you meant the MSFTPSVC key. I looked and looked and didn't find an entry for LogNonAnonymous even doing a search for just that key or value. I did decide to try this: under HKLM\system\CCS\services\eventlog\system there is a dword called "sources"   In this value there is a list of event sources. In the registry, I found two places where this exists and edited the source list and removed MSFTPSVC. I doubt it will make any difference but you never know. At this point I will award the points since you did explain that this question may not be possible. Also, I bumped my FTP site timeout from 240 sec to 600 sec hoping that if the controllers actually disconnect on their own after 5 to ten mintues then a log entry won't be collected. One last thing, In IIS, I right clicked on the FTP folder, not the actual site and found a few settings that I had not encountered before. Logging was enabled for the folder. I doubt if this makes any difference either since on the site itself I had all logging disabled.

Author

Commented:
I am awarding this because you are probably right there is no way to stop this from being logged. I am methodically increasing my site timeout to the point that the clients never timeout, hence, never logging a timeout entry..
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.