topic Re: IIS Monitor causing tail errors on universal forwarder in Getting Data In

IIS Monitor causing tail errors on universal forwarder

BP9906 — Fri, 20 Apr 2012 17:16:57 GMT

I added this to my inputs.conf:

[monitor://C:\WINDOWS\system32\LogFiles\W3SVC*\]
disabled = false
followTail = 0
recursive = true
index=iis
ignoreOlderThan = 7d

When the deployment server gets the deployment app and reloads, the splunkd.log on the universal forwarder errors many times this error:

04-20-2012 10:14:14.368 -0700 ERROR TailingProcessor - matching C:\WINDOWS\system32\LogFiles\Cluster\ against ^C:\\WINDOWS\\system32\\LogFiles\\W3SVC[^\\]*\\$
04-20-2012 10:14:14.368 -0700 ERROR TailingProcessor - matching C:\WINDOWS\system32\LogFiles\HTTPERR\ against ^C:\\WINDOWS\\system32\\LogFiles\\W3SVC[^\\]*\\$

How do I get rid of this repeat error message?

Re: IIS Monitor causing tail errors on universal forwarder

BP9906 — Fri, 20 Apr 2012 19:01:52 GMT

I resolved it by removing the wildcard char. It must be a splunk forwarder error to repeat the error in the log.

[monitor://C:WINDOWS\system32\LogFiles] 
disabled = false 
followTail = 0 
recursive = true 
index=iis 
ignoreOlderThan = 7d

Re: IIS Monitor causing tail errors on universal forwarder

BP9906 — Tue, 30 Oct 2012 20:57:37 GMT

I found this to work the best.

[monitor://C:\WINDOWS\system32\LogFiles\*\*.log]

disabled = false
followTail = 0
recursive = true
index=iis
ignoreOlderThan = 7d
sourcetype=MSWindows:2003:IIS

[monitor://C:\inetpub\logs\LogFiles\*\*.log]
disabled = false
followTail = 0
recursive = true
index=iis
ignoreOlderThan = 7d
sourcetype=MSWindows:2008R2:IIS