Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm giving some of our customers the ability to manage their sites via IIS Feature Delegation and IIS Manager for Remote Administration.

One feature I'm unsure about permitting access to is Failed Request Tracing for the following reasons:

  • Customers will forget to turn it off
  • The server will be taking a performance hit (especially if 500 sites all have it turned on)
  • The server will become littered with old FRT's
  • The potential to leak sensitive information about how the server is configured thus providing useful information to would-be intruders.

Should we just keep this as a troubleshooting tool for our own admins?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I've heard it said that the performance overhead to have FRT enabled and listening on all page requests is about 5%. I haven't confirmed that personally, but if it's anywhere in that ballpark, it's really not a lot of overhead.

Additionally, the FRT default is to keep 50 log files per site and overwrite the oldest once more than 50 files exist.

Furthermore, the default path where the logs are stored are under your shared log folder, so end users don't have access to view the logs.

And a final note before I come to my conclusion is that the delegation defaults allow people to create their own rules, but they can't enable FRT without an administrator enabling it at the site or global level.

So, with the defaults to allow them to create the rules on their own you should be safe. They can't do anything with the rules. If they want to actually rule them, they will need to contact a system admin anyway. And, after it's been run, they'll need someone to zip up and send them the actual logs generated, unless you remap the folder or give them FTP access to their FRT log folder.

If you do want to allow them full access then you can enable it at the global level and give them FTP access to the log files. I don't think you need to go that far unless you find that you have a lot of users requesting this. For the most part people only need it enabled for short term troubleshooting. With all that said, hopefully it helps you make a decision for your particular environment.

share|improve this answer
    
Thanks for the reply Scott, kinda along the lines of where my own thoughts were going. –  Kev Feb 7 '11 at 20:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.