Security

How to capture logs in ISA Servers

Path Finder

How do we capture logs/data from ISA Servers? Are there any special considerations when setting up UF installed in ISA Servers?

Tags (4)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Well, I would first start with this link: http://technet.microsoft.com/en-us/library/bb838824.aspx#ActionLogValues - it contains possible ISA Server 2006 Logging Fields and Values. I wouldn't know what other people log but i would say that it depends a lot on what you're trying to achieve. I would definitely log the following: source/dest ip port and host, action, resultcode, rule, sessionid, connectionid.

- please upvote if you find this answer useful

View solution in original post

Splunk Employee
Splunk Employee

Well, I would first start with this link: http://technet.microsoft.com/en-us/library/bb838824.aspx#ActionLogValues - it contains possible ISA Server 2006 Logging Fields and Values. I wouldn't know what other people log but i would say that it depends a lot on what you're trying to achieve. I would definitely log the following: source/dest ip port and host, action, resultcode, rule, sessionid, connectionid.

- please upvote if you find this answer useful

View solution in original post

Splunk Employee
Splunk Employee

Yes. Basically you'll want Splunk to monitor this file/folder continuously for new events. Enjoy it 🙂

0 Karma

Path Finder

I change the logging so it will create w3c file instead. Do I just add that folder where it saves the w3c files and Splunk will be able to index it?

0 Karma

Splunk Employee
Splunk Employee

I suppose you'd need to configure your ISA server to log in text format (i think mdf, ldf and ndf are some sort of database formats). If you go here: http://msdn.microsoft.com/en-us/library/aa503236.aspx you'll see that that is an option. "Text log files in the World Wide Web Consortium (W3C) extended file format." Splunk will take in the text files and then you'll be able to query/search/report/chart.

Best.

d.

0 Karma

Path Finder

d

I checked my ISA Server and I have those fields checked for monitoring. i then ran the command "splunk add monitor c:XXXXXXX and specified the ISALog folder in my ISA Server. That folder contains mdf, ldf, ndf files. Will Splunk be able to use to those to see the actual logs? or will it just show up as mdf, ldf, ndf files when I do a search in Splunk Web UI?

0 Karma

Splunk Employee
Splunk Employee

I believe if you setup a UF monitor in your \ISALogs folder you should be OK.
Check this link for more info on how to setup an input monitor:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

0 Karma

Path Finder

What are the common fields/logs people monitor in ISA?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!