topic Re: Defining clients for a server class based on installed Windows feature? in Deployment Architecture

How to define clients for a server class based on installed Windows feature?

paulcurry — Thu, 08 Dec 2022 19:23:31 GMT

I have a use case where about 50% of my windows clients have IIS running on them. I'd like to have a server class just for those 50% to ingest IIS logs. I have IIS logs coming in but I have to manually list each client in the whitelist. Is there a way to determine if a server has IIS, then deploy a specific server class? I was thinking by an installed Windows Feature perhaps? I'm at a loss.

Re: Defining clients for a server class based on installed Windows feature?

richgalloway — Tue, 06 Dec 2022 17:06:16 GMT

Deployment servers are rather limited in how they can filter forwarders into classes. Consider deploying the IIS input to all Windows servers. Those servers without IIS installed will ignore the absent file(s).

Re: Defining clients for a server class based on installed Windows feature?

paulcurry — Thu, 08 Dec 2022 15:11:25 GMT

That's probably the best plan. However, say I have 15 normal IIS servers, 5 SFTP servers, and 5 SSRS servers. All 25 run on IIS so the app the server class pushes out will go to one index. But all 3 log types parse differently from an identical location. This sounds like I would have to manually specify hosts for separate classes, right?

Re: Defining clients for a server class based on installed Windows feature?

richgalloway — Thu, 08 Dec 2022 16:21:00 GMT

In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.