LI 3.6 - Windows Agent - Cannot exclude default Channels

[srodenburg]

Hello,

I'm using LogInsight 3.6 and i'm not interested in ingesting Windows system event logs at all.

I'm am however interested in ingesting the windows event-log channels of certain non-microsoft applications. No more, no less. That's all I need. The application is so nice to have it's own event-log channel so I don't need to muck about with logfiles etc. Just ingest the channel.

Inspired by a Blog-article about getting Veeam into LI, I got to work. And failed.

In the Blog they create a copy of the default Windows template and give it a name. They then tell the new template to disable all the standard Microsoft channels and create a new, custom channel X and enable it. That is the general idea I had also.

The problem is, I use a newer version of LI (v3.6, blog is at 3.3.1) and in 3.6 i cannot, for the life of me, copy a windows-template and save it.

I go to the dropdow, scroll all the way down, click the "copy icon" to the right of the dropdown-entry for the Windows template and enter the new name of the template. All just like in the LI 3.6 manual and in the blog.

I then give it a filter ("hostname contains applicationX.domain.local") and click "Save new group". But it cannot save it. It says: "Failed to save configuration" immediately.

The view jumps from "build" to "edit" and shows the same error that for each built-in section saying that the name is already defined in com.microsoft.windows.Microsoft etc. etc.  (see attached screenshot)

To summarize:  Copy a Windows template, give it a name, enter the filter, click on "Save new group" and bang, it cannot be saved. I have not even done anything else yet, just wanted to save the newly copied template.

So i'm stuck. Totally stuck.

My goal is to say "disabled" to all the standard channels (winlog | application / winlog | Security  etc. etc.) and only add and enable a section "winlog | Custom" and enter the eventlog-channel that I want to ingest.

We have 7 application-servers and all we want is to ingest (just ingest) a very specific event-log channel and NOTHING else.

Any help would be greatly appreciated.

Steve

[srodenburg]

Being stuck on the server-side, i thought i'd set the config on the client side. I edited the liagent.ini to what i want, restarted the agent and this results in the following "liagent-effective.ini"

; Dynamic file representing the effective configuration of VMware Log Insight Agent (merged server-side and client-side configuration)

;     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

; Creation time: 2016-10-15T13:28:32.657655

[server]

hostname=syslog.domain.local

[winlog|Application]

channel=Application

enabled=no

[winlog|Security]

channel=Security

enabled=no

[winlog|System]

channel=System

enabled=no

[winlog|Custom]

channel=Veeam Backup

[winlog|com.microsoft.active-directory.win2012_DirectoryService]

channel=Directory Service

[winlog|com.microsoft.active-directory.win2012_DNS_Server]

channel=DNS Server

[winlog|com.microsoft.active-directory.win2012_DFS_Replication]

channel=DFS Replication

[winlog|com.microsoft.active-directory.win2012_Security]

channel=Security

[winlog|com.microsoft.active-directory.win2012_DNS_Server_Audit]

channel=Microsoft-Windows-DNSServer/Audit

[winlog|com.microsoft.windows.Custom]

channel=veeam backup

[update]

package_type=msi

[filelog|com.microsoft.active-directory.win2012_WindowsDNS]

directory=C:\Windows\Sysnative\dns\dns.log

tags={"ms_product":"activedirectory"}

[filelog|com.microsoft.sql.MSSQL]

; IMPORTANT: Change the directory as per the environment

directory=D:\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Log

tags={"ms_product":"mssql"}

charset=UTF-16LE

exclude=*.trc

But LI still ingests EVERYTHING. It totally ignores the fact that i said "enabled=no" to [winlog|Security] for example. It sucks it all in.

The windows server is a 2008 R2 server by the way so I assume that those .win2012. entries do nothing (it is also not a domain controller)

What is going on. I can read blogs until hell freezes over bit LI simply does not do what I tell it to. Assuming the fault is with me, what am i'm doing wrong??

I don't want to edit client-side liagent.ini files as I want do it centrally. Edit the config client-side was an act of desperation. But neither works anyway.

[srodenburg]

I think I found a bug:  Look (screenshot attached) at how the default stuff for Windows 2012 has "illegal characters" so the section does not get parsed. It's not related to me because I have a 2008 R2 server and the eventlog does not have those sections anyway. But on a 2012 server this would create a problem.

I now tried to re-create the Veeam Backup configuration from the blog. But the same issues are there: Despite sections/channels not being enabled, the agent sends everything regardless. I could stand on my head and it would not make a damn difference.

I now modified (or tried to modify) the channels: what i'd like to ingest and not, and the agent still send everything. It totally ignores my efforts despite me not making syntax errors (according to the agents logs) and the "liagent-effective" config-file reflects what I need after it is rebuild during agent-(re)start.

What on earth is going on...

[sflanders]

Hey Steve,

It looks like you are experiencing three different issues. Let me start with the issue reported in your first message. It sounds like you are trying to create a custom agent group for your application and starting by trying to clone an existing agent group. Tip 1 would be, if the agent group you are cloning does not have the configuration you want do not clone it. Instead, just create a brand new agent group. When you do this, you can use the build tab on the lower part of the page and fill in the relevant sections to build your custom agent group. Now, in your case, you cloned an existing agent group, made some edits and tried to save. The error states that the names of the configuration sections are already in use and as such the save operation fails -- as seen in your screenshot. This means, you have another agent group configuration enabled on the system with the same exact configuration section names -- this is not allowed. You can verify this by selecting the "Microsoft - Windows Test (not saved)" drop-down, and selecting one of the other agent configurations you have enabled. To work around this issue, do what the message says -- rename the configuration sections to something else. For example, you have "[winlog|Application]" call it "[winlog|Application2]". Now this will solve your problem, however you already stated you do not want to collect the default Microsoft event viewer channels so I would again advise you just create a brand new agent group and use the builder.

Moving on to your second post, you switched to client-side configuration. Tip 2 would be, always use server-side configuration. There are many reasons for this including server-side overriding client-side, configuration management, etc. In your case, you edited the client side and checked liagent-effective.ini (good!). You are correct that you disabled the default channels, however the win2012 configuration sections DO apply. Why? "[winlog|com.microsoft.active-directory.win2012_DNS_Server_Audit]" is of the format "[winlog|<name of configuration section>]" sure the name of the configuration section has win2012 in it, however if that is not defined as part of the agent group filters server-side (clearly it is not as you see it on your Windows 2008 system) then it will still collect. Also, given that the name of the configuration section starts with com.microsoft.active-directory, I now know that you do have the AD agent group configured server-side. You should edit the server-side configuration since you have made it clear you do not want this.

Finally your third issue -- I think something else is going on, but there is not enough information to tell. Can you attach the liagent-effective.ini?

My apologies on all the problems you are experiencing -- I hope we can work this out for you quickly.

[sflanders]

Where you able to get this resolved?