0

I'm giving some of our customers the ability to manage their sites via IIS Feature Delegation and IIS Manager for Remote Administration.

One feature I'm unsure about permitting access to is Failed Request Tracing for the following reasons:

  • Customers will forget to turn it off
  • The server will be taking a performance hit (especially if 500 sites all have it turned on)
  • The server will become littered with old FRT's
  • The potential to leak sensitive information about how the server is configured thus providing useful information to would-be intruders.

Should we just keep this as a troubleshooting tool for our own admins?

1

I've heard it said that the performance overhead to have FRT enabled and listening on all page requests is about 5%. I haven't confirmed that personally, but if it's anywhere in that ballpark, it's really not a lot of overhead.

Additionally, the FRT default is to keep 50 log files per site and overwrite the oldest once more than 50 files exist.

Furthermore, the default path where the logs are stored are under your shared log folder, so end users don't have access to view the logs.

And a final note before I come to my conclusion is that the delegation defaults allow people to create their own rules, but they can't enable FRT without an administrator enabling it at the site or global level.

So, with the defaults to allow them to create the rules on their own you should be safe. They can't do anything with the rules. If they want to actually rule them, they will need to contact a system admin anyway. And, after it's been run, they'll need someone to zip up and send them the actual logs generated, unless you remap the folder or give them FTP access to their FRT log folder.

If you do want to allow them full access then you can enable it at the global level and give them FTP access to the log files. I don't think you need to go that far unless you find that you have a lot of users requesting this. For the most part people only need it enabled for short term troubleshooting. With all that said, hopefully it helps you make a decision for your particular environment.

|improve this answer|||||
  • Thanks for the reply Scott, kinda along the lines of where my own thoughts were going. – Kev Feb 7 '11 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.