[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [ISSForum] Server Sensor 7.0 & ISS



Jean Paul,

thank you for the answer and yes, that was the one! Due to the moment of a
service binding to the port it worked OK for a while (a few months). I have
checked the other policies (we have about 8 different ones, for different
public services) and changed the settings according to their function. 

(it took you one day to get the right answer, where our Integrator takes
five weeks without an answer... makes me wonder... I should do more with
Site Protector!).

Mea 

> -----Original Message-----
> From: Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx] 
> Sent: Thursday, July 29, 2004 8:07 PM
> To: meaculpa; issforum@xxxxxxxxxxxxxxxx
> Subject: RE: [ISSForum] Server Sensor 7.0 & ISS
> 
> Mea,
> 
> You probably have set a policy to monitor for suspicious HTTP 
> connections. When you do this, Server Sensor hooks to port 80 
> and the Web server can't work.
> Suspicious connections can be monitored only for services 
> that aren't running.
> 
> Jean Paul
> 
> -----Original Message-----
> From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of meaculpa
> Sent: Thursday, July 29, 2004 6:24 PM
> To: issforum@xxxxxxxxxxxxxxxx
> Subject: [ISSForum] Server Sensor 7.0 & ISS
> 
> Hello list,
> 
> since a few weeks ago we are experiencing some problems with 
> the Server Sensor 7.0 running on a WIndows 2000 Server box 
> and IIS. What happens?
> 
> When the machine is booted, the web services and the 
> issdaemon service start as to be expected. However, when 
> looking in the IIS console, you can see that the web itself 
> is not started. This due to the fact that the Server Sensor 
> has a lock on port 80 on the machine. When I stop the 
> issdaemon services, start the web, and then start the 
> issdaemon again, then everything is going just fine... untill 
> the next reboot... 
> 
> I can solve this by first making sure that IIS and the web(s) 
> is (are) running, then start issdaemon. But, I don't want to 
> do that. Is it possible I have enabled some setting in the 
> policy of the Server Sensor that's causing this, or is it 
> more a timing issue between issdaemon en iss servervices?  
> 
> TIA
> 
> Mea
> 
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
> 
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
> https://atla-mm1.iss.net/mailman/listinfo/issforum
> 
> To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
> 
> The ISSForum mailing list is hosted and managed by Internet 
> Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
> 

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.