1

We had an issue recently where our server started throwing 500 errors because an IP address was blocked that had already been blocked elsewhere. It -appears- that the IP was blocked on individual sites before, and then was added to the server. I would like to find out how this error was able to be triggered, but that's another question.

Is it possible to find logs on when those blocks were added?

Improve this question

1 Answer 1

Reset to default
2

There are no log entries for this kind of operation in the Windows event logs.

However assuming you are using IIS 7+ and the changes are not made in local web.config files there may be a way to find out when a configuration change occurred.

Open 'C:\inetpub\history' (you may need to do this as a elevated administrator) there are a bunch of CFGHISTORY_00000xxxxxx folders.

Each time you make configuration changes to IIS through the GUI, Script or API the previous version of the configuration files are saved here.

IP restrictions are stored in applicationHost.config, you can use a DIFF tool to compare files or manually look at the sections 'ipSecurity' (usually at the end of the file).

This may tell you when the change was made, but not by whom. You could check the event logs for a user who logged on to the server in the same time frame.

On a certain number of change-sets are stored and older history folders are deleted automatically.

EDIT: If you want to keep more history entries use:

appcmd.exe set config -section:system.applicationHost/configHistory /maxHistories:"50" /commit:apphost

More information about configuring the config history on iis.net

Improve this answer
2
  • Amazing. Thank you both for the confirmation there's no direct log file to access, and the nifty trick to see. Since I'm the only one who knows how/where to edit the config files, the CFGHISTORY would work. Unfortunately, it seems like it's only saving the past 10 changes, but it's something. Once again, thanks!
    – Codeacula
    May 9, 2013 at 13:33
  • 1
    You could check your backups. I backup the history folder every night in addition to the drive backups done by low-level administrators.
    – Peter Hahndorf
    May 9, 2013 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .