I got these errors about every 2 minutes for 5 hours last night and noticed it stopped. Any ideas on what it could be? I was doing some testing of custom journal types on my site. But not sure what this really was.

Event Type: Information Event Source: ASP.NET 2.0.50727.0
Event Category: Web Event Event ID: 1315 Date: 2/9/2011 Time: 9:21:24 AM User: N/A Computer: DNPSERVER01 Description: Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired. Event time:

2/9/2011 9:21:24 AM Event time (UTC): 2/9/2011 3:21:24 PM Event ID: d74b329ed83e41cc99ddd896864f0ef1 Event sequence: 998 Event occurrence: 299
Event detail code: 50202
Application information: Application domain: /LM/w3svc/777849497/root-35-129417205307927500 Trust level: Full Application Virtual Path: / Application Path: C:\HostingSpaces\homeschoolcommunity\homeschoolcommunity.com\wwwroot\ Machine name: DNPSERVER01 Process information:
Process ID: 6372
Process name: w3wp.exe Account name: NT AUTHORITY\NETWORK SERVICE Request information:

Request URL: http://www.homeschoolcommunity.com/...PortalId=0 Request path: /DesktopModules/activesocial/cb.ashx
User host address: 63.103.169.125 User: Is authenticated: False Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE Name to authenticate: Custom event details: For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This is quite common. It means that a user was logged in, but then expired and the ajax timed requests are still firing.

I am getting the same thing about once a minute. They all seem to come from the same IP address.

Could this be because of someone hitting my RS feed for one of my forums? If so, is there a way to turn this off. It's annoying that it is hitting ,y Windows Server log and filling it up


Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
Event time: 6/7/2011 4:46:08 AM
Event time (UTC): 6/7/2011 11:46:08 AM
Event ID: 5b31abe2c7c548c69ad68cfbf741e8cf
Event sequence: 6170
Event occurrence: 453
Event detail code: 50202

Application information:
Application domain: /LM/W3SVC/1458255115/Root-23-129518540301718750
Trust level: Full
Application Virtual Path: /
Application Path: C:\Inetpub\LightSwitch\
Machine name: NEW-6ZT844HS6NB

Process information:
Process ID: 5116
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE

Request information:
Request URL: http://lightswitchhelpwebsite.com/desktopmodules/activeforums/handlers/forumhelper.ashx?TabId=63&PortalId=0&moduleid=398&language=en-US
Request path: /desktopmodules/activeforums/handlers/forumhelper.ashx
User host address: 66.237.220.74
User:
Is authenticated: False
Authentication Type:
Thread account name: NT AUTHORITY\NETWORK SERVICE

Name to authenticate:

Custom event details:

Hi Michael,
This error in particular is coming from the the AF Online Status polling request. It is a client side request that happens about every minute. You may want to turn off Users Online in the control panel or maybe just block the IP address at the server.

Will

Posted By Will Morgenweck on 08 Jun 2011 01:53 AM
Hi Michael,
This error in particular is coming from the the AF Online Status polling request. It is a client side request that happens about every minute. You may want to turn off Users Online in the control panel or maybe just block the IP address at the server.

Will

Ok I went into IIS and then went to the "properties" for the node for the website, and then selected Directory Security, then clicked the Edit button under IP addresses, then entered the IP address to block it.

Problem solved.