Solved

How to disable specific Event ID's from being logged in Event Viewer

Posted on 2009-07-07
5
4,121 Views
Last Modified: 2013-12-05
I have an event in my event viewer that I would like to simply not log at all. It's from my IIS FTP site, W2K3 SBS  which tells me that an FTP user has timed out after xxx seconds. The users are from PLC type controllers that send files to our server on the hour. Each hour I get many of these warnings as the controller finishes uploading it's log files. I have played with the timeout settingson the FTP site from 5 seconds to 240 seconds which is what it is set on now. The controller, once done uploading don't disconnect for some reaosn but in it's logs I can see it issue a Quit command at the end. It doesn't seem to hurt that they don't disconnect so I just want to stop the event log from logging this event.   What do I need to do to stop this?  The ID is:
Source: MSFTPSVC
Category: None
EventID: 10
User OMT2@omt.com at host 192.168.1.34 has timed-out after 240 seconds of inactivity.

Again, this login comes from a machine that uploads it's log files to an FTP folder on our server. I have messed with the controller settings, contacted the Manufacturer and, now, just want to disable this Warning in my event log. How do I go about this?
0
Comment
Question by:KellyOConnor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 37

Accepted Solution

by:
meverest earned 500 total points
ID: 24800114
Hi,

you can't stop it logging.  you can adjust the event viewer filter settings so that some items are not displayed if you want to.

remember that the 'event viewer' is just what the name implies - it is an application used to view the event logs.  if you don't like the way that event viewer works, there are third party alternatives available; just enter terms like "event viewer alternative" on your favorite search engine.

Cheers!
0
 

Author Comment

by:KellyOConnor
ID: 24816056
Is the inability to stop this particular event hold true for just for the IIS FTP site? I had a lot of Sharepoint errors in my event logs and was able to stop certain ones by making changes in the Sharepoint Administration. It actually stopped certain events from being logged at all. I really was hoping that there would be a way to stop the IIS FTP events from being logged.
0
 
LVL 37

Expert Comment

by:meverest
ID: 24830351
Hi,

You can control some logging, but not that one (I think)

take a look at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ftpsvc\Parameters

there is a key called 'LogNonAnonymous' - default is zero.  I suspect that your log event message is not one of these, but if the value is '1', set to zero and see if it makes a difference.  Otherwise, use a third party event viewer instead.

Cheers!
0
 

Author Comment

by:KellyOConnor
ID: 24839172
I have a key called: MSFTPSVC, there is no FTPSVC so I figured you meant the MSFTPSVC key. I looked and looked and didn't find an entry for LogNonAnonymous even doing a search for just that key or value. I did decide to try this: under HKLM\system\CCS\services\eventlog\system there is a dword called "sources"   In this value there is a list of event sources. In the registry, I found two places where this exists and edited the source list and removed MSFTPSVC. I doubt it will make any difference but you never know. At this point I will award the points since you did explain that this question may not be possible. Also, I bumped my FTP site timeout from 240 sec to 600 sec hoping that if the controllers actually disconnect on their own after 5 to ten mintues then a log entry won't be collected. One last thing, In IIS, I right clicked on the FTP folder, not the actual site and found a few settings that I had not encountered before. Logging was enabled for the folder. I doubt if this makes any difference either since on the site itself I had all logging disabled.
0
 

Author Closing Comment

by:KellyOConnor
ID: 31600558
I am awarding this because you are probably right there is no way to stop this from being logged. I am methodically increasing my site timeout to the point that the clients never timeout, hence, never logging a timeout entry..
0

Featured Post

Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As tax season makes its return, so does the increase in cyber crime and tax refund phishing that comes with it
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …

690 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question