Gathering IIS Logs from Multiple Source Directories

Graylog Central (peer support)
, ,
1

Hello,

I have successfully setup the sending of IIS Logs to GrayLog for one of our web sites. However, we are running several sites on one web server and the logs for each site are put in separate directories. I know that I could tell IIS to just put all the logs in one folder but I would prefer not doing that if possible. Here is what the input looks like:

Module im_file File "C:\inetpub\logs\LogFiles\W3SVC5\u_ex*" SavePos TRUE 
Exec		if $raw_event =~ /^#/ drop();                    \
            else                                             \
            {                                                \
                w3c->parse_csv();                            \
                $EventTime = parsedate($date + " " + $time); \
                $EventTime = parsedate($date + " " + $time + "Z");          \
                $SourceName = "Source";    					 \
                $raw_event = to_json();    					 \
            }

I tried putting in a wildcard that looks like C:\inetpub\logs\LogFiles\W3SVC*\u_ex* but nxlog reports that it can’t find that directory and thus no logs are being sent. For the time being I have one site logging. Does any one know the correct syntax to do this? Any help is appreciated.

Thanks,
Adam

1 Like
2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.