topic Re: IIS Logs Forwarding in Splunk Enterprise

Why am I unable to see IIS logs from one of the servers that has forwarder installed?

shivamchopra — Wed, 30 Mar 2022 22:24:35 GMT

Splunk 6.4.3
I am unable to see IIS logs from one of the servers that has forwarder installed.
I have following configuration on the universal forwarder:

inputs.conf [monitor://$WINDIR\inetpub\logs\LogFiles\W3SVC2] sourcetype=iis disabled = 0 outputs.conf [tcpout:default-autolb-group] server = :9997

Would someone please advise what is the missing configuration?

Re: IIS Logs Forwarding

gcusello — Wed, 26 Jul 2017 07:19:31 GMT

Hi shivamchopra,
I don't see files in your monitor command

inputs.conf

[monitor://$WINDIR\inetpub\logs\LogFiles\W3SVC2\*.*]
sourcetype=iis
disabled = 0

or a limitated set
about outputs.conf I imagine that in your file you have the Indexer IP

outputs.conf

[tcpout:default-autolb-group]
server = xxx.xxx.xxx.xxx:9997

Bye.
Giuseppe

Re: IIS Logs Forwarding

shivamchopra — Wed, 26 Jul 2017 07:30:30 GMT

Thanks for your response. it still doesn't work.

inputs.conf
[monitor://$WINDIR\inetpub\logs\LogFiles\W3SVC2*.*]
sourcetype=iis
disabled = 0

in outputs.conf - the IP is for heavy forwarder and HF is directing to Indexer.

Re: IIS Logs Forwarding

gcusello — Wed, 26 Jul 2017 07:57:37 GMT

beware: there must be a backslash before stars

[monitor://$WINDIR\inetpub\logs\LogFiles\W3SVC2\*.*]

Bye.
Giuseppe

Re: IIS Logs Forwarding

shivamchopra — Wed, 26 Jul 2017 08:12:53 GMT

Sorry - i put blackslash before *, still doesnt work

inputs.conf
[monitor://$WINDIR\inetpub\logs\LogFiles\W3SVC2*.*]
sourcetype=iis
disabled = 0

Re: IIS Logs Forwarding

shivamchopra — Wed, 26 Jul 2017 08:13:32 GMT

inputs.conf
[monitor://$WINDIR\inetpub\logs\LogFiles\W3SVC2*.*]
sourcetype=iis
disabled = 0

Re: IIS Logs Forwarding

shivamchopra — Wed, 26 Jul 2017 08:14:12 GMT

when i post the answer on this screen, it automatically removes the backslash before *

Re: IIS Logs Forwarding

gcusello — Wed, 26 Jul 2017 08:55:15 GMT

to correctly show it use the Code Sample button (button with 101010).

Probably this is a stupid check: did you verified the log path?
because I read that sometimes IIS logs are in different folders as: %SystemDrive%\inetpub\logs\LogFiles or in %SystemDrive%\Windows\System32\LogFiles\HTTPERR or in C:\Windows\System32\LogFiles\W3SVC1.
you can see this in IIS console

Bye.
Giuseppe

Re: IIS Logs Forwarding

shivamchopra — Wed, 26 Jul 2017 10:00:48 GMT

Yes, i have already verified the path of log file.

Re: IIS Logs Forwarding

gcusello — Wed, 26 Jul 2017 10:54:28 GMT

try to put the absolute path not using $WINDIR.
Bye.
Giuseppe

Re: IIS Logs Forwarding

bheemireddi — Wed, 26 Jul 2017 15:09:37 GMT

shivamchopra,

You can always check the splunk logs on the universal forwarder to see if it has watch on that path or if it is actually complaining to read the path.

Make sure you have some events in the log files you are reading.

You mentioned sending to the HF first, make sure it is not indexing locally and in fact forwarding them across.
sometimes we miss the obvious, check if the forwarder is in fact talking to the indexer, check the _internal index for that forwarder host.

Re: IIS Logs Forwarding

shivamchopra — Thu, 27 Jul 2017 01:52:05 GMT

that doesn't fix even

Re: IIS Logs Forwarding

shivamchopra — Thu, 27 Jul 2017 01:54:16 GMT

Yes, i can see in the logs that UF has watch on the that path:

07-26-2017 04:07:06.194 -0400 INFO TailingProcessor - Adding watch on path: C:\Windows\inetpub\logs\LogFiles\W3SVC1

Yes, events are there in the log file.
HF is not indexing locally, it is just a forwarder. I can see windows logs from the same server on splunk server. just IIS logs are not appearing.

Re: IIS Logs Forwarding

bheemireddi — Thu, 27 Jul 2017 02:11:40 GMT

are you searching in the right index? you did not specify index name in your inputs.conf, which means you are expecting events in index=main?

If you are sure there is nothing wrong on the forwarder side/path etc. may be try index=* sourcetype=iis
OR may be search for index=* source="inetpub"
May be you do have events, or search in the right place?

Re: IIS Logs Forwarding

shivamchopra — Thu, 27 Jul 2017 02:34:33 GMT

i am doing below search:
index=* host=XXXX

Re: IIS Logs Forwarding

spodda01da — Tue, 14 Jan 2020 08:04:33 GMT

Hi Shivam, I have the same issue... did you manage to resolve it ?

Re: IIS Logs Forwarding

johneng89 — Wed, 30 Mar 2022 22:08:26 GMT

Hello there,

I encountered the same issue, did you get to resolve it?