1

We have an internal web application hosted on IIS 8 that exposes some REST services through HTTPS. Since it's accessed by other applications, we require client certificates. We are getting some authentication failures due to missing or bad client certificate, but we need them to be recorded as Windows Events so we can use our monitoring infrastructure. How can we properly configure IIS 8, running on Windows Server 2012, to forward client certificate authentication failures errors so they appear on Windows Events? Is there any special server Feature that needs to be installed and running in order for this to work?

Improve this question

1 Answer 1

Reset to default
1

As far as I know there is no built-in way to forward any IIS request related errors to the Windows event log.

Certificate related errors should show up in the http logs with a special sub-code (403.7,403.13,403.16,403.17) so you can write a short PowerShell script to run once an hour, going through all log files and looking for these subcodes. Then for each matching request or an aggregated summary writing an entry to the Windows event log.

Improve this answer
1
  • One alternative to running a script would be to use a real-time log file monitoring solution to log contents from a log file (e.g. IIS log) to the event log. We develop EventSentry (eventsentry.com), and the free edition EventSentry Light does exactly that. You just configure to look for certain text patterns (e.g. 403.7), and when found it logs the entire line of the log file to the event log.
    – Lucky Luke
    Nov 8, 2013 at 4:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .