Security

How to capture logs in ISA Servers

eantonio
Path Finder

How do we capture logs/data from ISA Servers? Are there any special considerations when setting up UF installed in ISA Servers?

Tags (4)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Well, I would first start with this link: http://technet.microsoft.com/en-us/library/bb838824.aspx#ActionLogValues - it contains possible ISA Server 2006 Logging Fields and Values. I wouldn't know what other people log but i would say that it depends a lot on what you're trying to achieve. I would definitely log the following: source/dest ip port and host, action, resultcode, rule, sessionid, connectionid.

- please upvote if you find this answer useful

View solution in original post

_d_
Splunk Employee
Splunk Employee

Well, I would first start with this link: http://technet.microsoft.com/en-us/library/bb838824.aspx#ActionLogValues - it contains possible ISA Server 2006 Logging Fields and Values. I wouldn't know what other people log but i would say that it depends a lot on what you're trying to achieve. I would definitely log the following: source/dest ip port and host, action, resultcode, rule, sessionid, connectionid.

- please upvote if you find this answer useful

_d_
Splunk Employee
Splunk Employee

Yes. Basically you'll want Splunk to monitor this file/folder continuously for new events. Enjoy it 🙂

0 Karma

eantonio
Path Finder

I change the logging so it will create w3c file instead. Do I just add that folder where it saves the w3c files and Splunk will be able to index it?

0 Karma

_d_
Splunk Employee
Splunk Employee

I suppose you'd need to configure your ISA server to log in text format (i think mdf, ldf and ndf are some sort of database formats). If you go here: http://msdn.microsoft.com/en-us/library/aa503236.aspx you'll see that that is an option. "Text log files in the World Wide Web Consortium (W3C) extended file format." Splunk will take in the text files and then you'll be able to query/search/report/chart.

Best.

d.

0 Karma

eantonio
Path Finder

d

I checked my ISA Server and I have those fields checked for monitoring. i then ran the command "splunk add monitor c:XXXXXXX and specified the ISALog folder in my ISA Server. That folder contains mdf, ldf, ndf files. Will Splunk be able to use to those to see the actual logs? or will it just show up as mdf, ldf, ndf files when I do a search in Splunk Web UI?

0 Karma

_d_
Splunk Employee
Splunk Employee

I believe if you setup a UF monitor in your \ISALogs folder you should be OK.
Check this link for more info on how to setup an input monitor:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

0 Karma

eantonio
Path Finder

What are the common fields/logs people monitor in ISA?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...