IIS logs will only ingest if their are in the IMMEDIATE directory

[kellino]

Using Log Insight 2.5.  Below the directory "IIS Logs", we have a W3SVC directory for each website (about 30 directories per web server).

When we point Log Insight to IIS Logs (parent directory) it will not ingest anything.  If we pick one (of the 30) subdirectories, it will ingest logs for that one site only.

How do we ingest all the logs without having to reconfigure IIS to dump everything in one place?  (which is not desired).  Thanks!

[sflanders]

You need to create a filelog section for every directory. You can do this client-side or server-side. You can also vote for this feature: Support globs for filelog directory option in Windows Agent - The VMware Log Insight Community

[kellino]

Thanks.  I was wondering about that but the documentation was so thin I wasn't sure if that was an option.  I'll try that.  Thanks!

[kellino]

Might there be a limit to the number of sections allowed?  I can get it to work on one folder, but when I have 50+ sections for the 50+ log directories I'm not seeing anything ingesting.  Thanks!

[sflanders]

No limit. Likely a configuration issue. If you search for "error" in the agent log you should be able to determine what is going on.

[kellino]

One more observation...

When I look at the liagent-effective file, only the first entry for IIS appears within it.

[kellino]

Seeing scores of lines in the agent log like below, suggesting to be that they are being ignored.

[sflanders · Accepted solution]

Looks like a configuration problem. Each configuration section needs a unique name so:

[filelog|log1]

directory=blah

[filelog|log2]

directory=blah2

[kellino]

ahh...I should have realized that but didn't think of syntax options.

I had each header as... [filelog|IIS]

I'll try adding #s to provide uniqueness.  Thx!