Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
FTP Server could not create a client worker thread for user at host <ip address>. The connection to this user is terminated. The data is the error.
|English: Request a translation of the event description in plain English.|
|Concepts to understand:|
What is FTP?
In IIS6, when the FTP server is configured to accept connections only from specific addresses, and when a connection is attempted from a source IP not on that list, the connection is rejected, and event 8 is logged. This appears to be normal behavior.
As per Microsoft: "This problem can occur when the metabase flag for IP Security is not correctly removed from the metabase after changes are made to the IP Restrictions. Although the settings are changed so that everyone has access to the FTP site, the setting in the metabase is still flagged.". In certain conditions, this can be considered a sign of a denial of service attack. See the links below for more details.
|Private comment: Subscribers only. See example of private comment|
|Links: ME189262, ME293637|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated