topic Re: Why are IIS logs not reliably getting in? in Getting Data In

Why are IIS logs not reliably getting in?

paulgo — Wed, 01 Feb 2023 17:29:38 GMT

I am sending IIS logs to SplunkCloud. My inputs.conf looks like this:

[monitor://C:\inetpub\logs\LogFiles\W3SVC1]
ignoreOlderThan = 7d
sourcetype = web_log
initCrcLength = 400


[monitor://C:\inetpub\wwwroot\merge\requestlogs\...\*.csv]
ignoreOlderThan = 7d
sourcetype = csv_webrequest
crcSalt = <string>
recursive = true
initCrcLength = 400

It will work fine for a while, with SplunkCloud getting our data every second reliably as logs update.

The next day it will stop working, with log ingest slowing to a trickle: a few lines every few minutes. Restarting the forwarder occasionally works. Making a different change can work (changing the initCrcLength, adding or removing crcSalt, adding or removing alwaysOpenFile) but nothing works for more than a day or so.

Does anyone have any suggestions?

Thanks in advance.

Re: Why are IIS logs not reliably getting in?

shivanshu1593 — Wed, 01 Feb 2023 18:33:06 GMT

What are the internal logs saying about the server that is sending logs to SplunkCloud? Any warnings or error messages that you can share for further help?

index=_internal host=<host_sending_logs> log_level IN ("ERROR", "WARN")

Re: Why are IIS logs not reliably getting in?

isoutamo — Wed, 01 Feb 2023 19:59:07 GMT

have you try this app https://splunkbase.splunk.com/app/3185 to collect those or are you using your own inputs.conf without any other definitions?

I propose to use that TA on all relevant places (see installation & configuration instructions).

r. Ismo

Re: Why are IIS logs not reliably getting in?

paulgo — Mon, 06 Feb 2023 14:37:17 GMT

This worked. Thanks!