microsoft group of iis with multiple //logs locatin

[eladbub]

Hi ,

I have iis content pack and 6 iis servers.

4 are in the same log location

C:\Windows\System32\LogFiles\1\W3SVC2

and 2 are logged at a different location

D:\Windows\System32\LogFiles\W3SVC2

i cant put them in the same group since log location are different and can't create 2 different group since "duplication error" will rized

tryed to put two folder in the group without success

[filelog|IIS]

; IMPORTANT: Change the directory as per the environment

directory=C:\inetpub\logs\LogFiles\W3SVC2\

directory=D:\Windows\System32\LogFiles\1\W3SVC2

include=*.log

event_marker=^\d{4}-\d{2}-\d{2}

tags={"ms_product":"iis"}

parser=iisLogParser

[parser|iisLogParser]

base_parser=csv

delimiter=" "

fields=ms_iis_date,ms_iis_time,ms_iis_site_id,ms_iis_server_ip,ms_iis_method_type,ms_iis_url,,ms_iis_port,ms_iis_username,ms_iis_client_ip,,ms_iis_all_status,ms_iis_sub_status,,ms_iis_response_time

your help needed.

[MichaelRyom · Accepted solution]

Hi

Haven't had this issue, but there should be multiple ways to fix it

Think the easiest would be to make another filelog config. That force log insight to look at both locations

Fx.

[filelog|IIS_Drive_C]

; IMPORTANT: Change the directory as per the environment

directory=C:\inetpub\logs\LogFiles\W3SVC2\

include=*.log

event_marker=^\d{4}-\d{2}-\d{2}

tags={"ms_product":"iis"}

parser=iisLogParser

[filelog|IIS_Drive_D]

; IMPORTANT: Change the directory as per the environment

directory=D:\Windows\System32\LogFiles\1\W3SVC2

include=*.log

event_marker=^\d{4}-\d{2}-\d{2}

tags={"ms_product":"iis"}

parser=iisLogParser

If this does not work for you. You can create another agent group, but with a different name and directory config.

Hope this helps

[eladbub]

i love you!!! (:

thanks.