[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] Server Sensor 7.0 & ISS



Mea,

You probably have set a policy to monitor for suspicious HTTP
connections. When you do this, Server Sensor hooks to port 80 and the
Web server can't work.
Suspicious connections can be monitored only for services that aren't
running.

Jean Paul

-----Original Message-----
From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of meaculpa
Sent: Thursday, July 29, 2004 6:24 PM
To: issforum@xxxxxxxxxxxxxxxx
Subject: [ISSForum] Server Sensor 7.0 & ISS

Hello list,

since a few weeks ago we are experiencing some problems with the Server
Sensor 7.0 running on a WIndows 2000 Server box and IIS. What happens?

When the machine is booted, the web services and the issdaemon service
start
as to be expected. However, when looking in the IIS console, you can see
that the web itself is not started. This due to the fact that the Server
Sensor has a lock on port 80 on the machine. When I stop the issdaemon
services, start the web, and then start the issdaemon again, then
everything
is going just fine... untill the next reboot... 

I can solve this by first making sure that IIS and the web(s) is (are)
running, then start issdaemon. But, I don't want to do that. Is it
possible
I have enabled some setting in the policy of the Server Sensor that's
causing this, or is it more a timing issue between issdaemon en iss
servervices?  

TIA

Mea

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.