2 Replies Latest reply on Nov 6, 2018 11:57 PM by eladbub

    microsoft group of iis with multiple //logs locatin

    eladbub Novice

      Hi ,

      I have iis content pack and 6 iis servers.

      4 are in the same log location

      C:\Windows\System32\LogFiles\1\W3SVC2

      and 2 are logged at a different location

      D:\Windows\System32\LogFiles\W3SVC2

       

      i cant put them in the same group since log location are different and can't create 2 different group since "duplication error" will rized

      tryed to put two folder in the group without success

       

      [filelog|IIS]

      ; IMPORTANT: Change the directory as per the environment

      directory=C:\inetpub\logs\LogFiles\W3SVC2\

      directory=D:\Windows\System32\LogFiles\1\W3SVC2

      include=*.log

      event_marker=^\d{4}-\d{2}-\d{2}

      tags={"ms_product":"iis"}

      parser=iisLogParser

       

       

      [parser|iisLogParser]

      base_parser=csv

      delimiter=" "

      fields=ms_iis_date,ms_iis_time,ms_iis_site_id,ms_iis_server_ip,ms_iis_method_type,ms_iis_url,,ms_iis_port,ms_iis_username,ms_iis_client_ip,,ms_iis_all_status,ms_iis_sub_status,,ms_iis_response_time

       

       

      your help needed.

        • 1. Re: microsoft group of iis with multiple //logs locatin
          MichaelRyom Hot Shot
          vExpert

          Hi

           

          Haven't had this issue, but there should be multiple ways to fix it

           

          Think the easiest would be to make another filelog config. That force log insight to look at both locations

           

          Fx.

          [filelog|IIS_Drive_C]

          ; IMPORTANT: Change the directory as per the environment

          directory=C:\inetpub\logs\LogFiles\W3SVC2\

          include=*.log

          event_marker=^\d{4}-\d{2}-\d{2}

          tags={"ms_product":"iis"}

          parser=iisLogParser

           

          [filelog|IIS_Drive_D]

          ; IMPORTANT: Change the directory as per the environment

          directory=D:\Windows\System32\LogFiles\1\W3SVC2

          include=*.log

          event_marker=^\d{4}-\d{2}-\d{2}

          tags={"ms_product":"iis"}

          parser=iisLogParser

           

          If this does not work for you. You can create another agent group, but with a different name and directory config.

           

           

          Hope this helps

          • 2. Re: microsoft group of iis with multiple //logs locatin
            eladbub Novice

            i love you!!! (:

             

            thanks.