topic Forwarding IIS6 Logfiles Using Universal Forwarder in Getting Data In

Forwarding IIS6 Logfiles Using Universal Forwarder

andiih — Mon, 28 Sep 2020 13:35:09 GMT

My IIS 6 logfiles (W2K3) are getting stuck in the parsingQueue of the SUF - this means that no data gets received from this server. Prior to adding the stanzas below, data was being received normally.

Now I have the following in Metrics.log



03-22-2013 16:46:15.317 +0000 INFO  Metrics - group=queue, name=parsingqueue, max_size_kb=512, current_size_kb=449, current_size=8, largest_size=8, smallest_size=8

and splunkd.log



03-22-2013 16:35:36.222 +0000 INFO  TailingProcessor - Could not send data to output queue (parsingQueue), retrying...

03-22-2013 16:35:36.222 +0000 INFO  BatchReader - Could not send data to output queue (parsingQueue), retrying...

The following inputs.conf on the forwarder (in local)



[monitor://c:\WINDOWS\system32\LogFiles]

disabled=false

recursive=true

followTail = 0

sourcetype=MSWindows:2003:IIS

and props.conf



[MSWindows:2003:IIS]

CHECK_FOR_HEADER = false

I've only just added the props.conf file and sourcetype, but that has not helped (in fact I think it made it worse - I didn't have the BatchReader errors before that)

Any help to configuring IIS to use with a SUF and (debian) indexer would be appreciated!

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

tgow — Fri, 22 Mar 2013 17:07:29 GMT

Might be a long shot but I noticed you don't have a slash on the monitor stanza, ie:

[monitor://C:\Windows\system32\LogFiles]

Also make sure that the Windows firewall is not blocking the TCP connection between the UF and the Indexer.

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

andiih — Fri, 22 Mar 2013 17:21:43 GMT

I do have the slashes, its just my (lack of) competence in formatting on this forum. Firewall isn't blocking, as I get the WinEventLog* events through if I take the monitor stanza out

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

jstockamp — Fri, 22 Mar 2013 17:41:13 GMT

You might want to add a whiltelist to your input:

whitelist=*.log

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

andiih — Fri, 22 Mar 2013 17:56:41 GMT

nice idea, but this doesn't seem to have helped.

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

jstockamp — Fri, 22 Mar 2013 18:12:36 GMT

Are you seeing messages in splunkd.log that you are connected to the indexer? Do you have any other inputs on the forwader that are making it to the indexer?

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

tgow — Fri, 22 Mar 2013 18:45:11 GMT

What Windows user are you running the splunkforwarder service as? Most of the Windows problems I see are related to permissions. Make sure the Windows user has access to the IIS logs directory.

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

andiih — Fri, 22 Mar 2013 18:56:10 GMT

I'll check this next week. It's certainly plausible!

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

andiih — Fri, 22 Mar 2013 18:58:07 GMT

If I take this logfile stanza out,then I get connections and data flows from the windows event logs. When I add it, the parsing queue dies and no data flows

Re: Forwarding IIS6 Logfiles Using Universal Forwarder

andiih — Thu, 28 Mar 2013 11:01:57 GMT

Back on site today, and temporarily swapped from Local System to a "God" account with local and network permissions. No luck. It does seem to be the ParsingQueue that dies with the IIS logfiles.