- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a use case where about 50% of my windows clients have IIS running on them. I'd like to have a server class just for those 50% to ingest IIS logs. I have IIS logs coming in but I have to manually list each client in the whitelist. Is there a way to determine if a server has IIS, then deploy a specific server class? I was thinking by an installed Windows Feature perhaps? I'm at a loss.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Deployment servers are rather limited in how they can filter forwarders into classes. Consider deploying the IIS input to all Windows servers. Those servers without IIS installed will ignore the absent file(s).
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's probably the best plan. However, say I have 15 normal IIS servers, 5 SFTP servers, and 5 SSRS servers. All 25 run on IIS so the app the server class pushes out will go to one index. But all 3 log types parse differently from an identical location. This sounds like I would have to manually specify hosts for separate classes, right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


In that case, yes, I think you'd have to manually specify host names for 3 separate server classes.
If this reply helps you, Karma would be appreciated.
