How to capture logs in ISA Servers

[eantonio]

How do we capture logs/data from ISA Servers? Are there any special considerations when setting up UF installed in ISA Servers?

[_d_ · Accepted solution]

Well, I would first start with this link: http://technet.microsoft.com/en-us/library/bb838824.aspx#ActionLogValues - it contains possible ISA Server 2006 Logging Fields and Values. I wouldn't know what other people log but i would say that it depends a lot on what you're trying to achieve. I would definitely log the following: source/dest ip port and host, action, resultcode, rule, sessionid, connectionid.

- please upvote if you find this answer useful

[_d_]

Yes. Basically you'll want Splunk to monitor this file/folder continuously for new events. Enjoy it 🙂

[eantonio]

I change the logging so it will create w3c file instead. Do I just add that folder where it saves the w3c files and Splunk will be able to index it?

[_d_]

I suppose you'd need to configure your ISA server to log in text format (i think mdf, ldf and ndf are some sort of database formats). If you go here: http://msdn.microsoft.com/en-us/library/aa503236.aspx you'll see that that is an option. "Text log files in the World Wide Web Consortium (W3C) extended file format." Splunk will take in the text files and then you'll be able to query/search/report/chart.

Best.

d.

[eantonio]

d

I checked my ISA Server and I have those fields checked for monitoring. i then ran the command "splunk add monitor c:XXXXXXX and specified the ISALog folder in my ISA Server. That folder contains mdf, ldf, ndf files. Will Splunk be able to use to those to see the actual logs? or will it just show up as mdf, ldf, ndf files when I do a search in Splunk Web UI?

[_d_]

I believe if you setup a UF monitor in your \ISALogs folder you should be OK.
Check this link for more info on how to setup an input monitor:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

[eantonio]

What are the common fields/logs people monitor in ISA?