IIS log ingestion using AMA Agents for multiple IIS sites

AdamBaumgartner-4096 0

I have installed an AMA agent on an internal IIS server via Azure ARC in an attempt to ingest logs into Microsoft Sentinel.

The ingestion works for a single site, but we have multiple sites on the single IIS server, and the data source only allows specifying a single log location for IIS.

Our logging is configured on a per site basis, so logs are stored as;

C:\inetpub\logs\LogFiles\W3SVC1

C:\inetpub\logs\LogFiles\W3SVC2

C:\inetpub\logs\LogFiles\W3SVC3

Under Home > Monitor > Data Collection Rules > Data Sources > Data Source > File Pattern

Only a single location can be specified, otherwise the collection does not work.

Does anyone know what file pattern can be used for multiple locations? Using the root, commas for multiple locations, or leaving it empty does not work.

User's image

1 answer

tbgangav-MSFT 10,386 Reputation points

2023-01-27T04:39:10.8833333+00:00

Hi,

As explained here, you can use a file wildcard * i.e., C:\inetpub\logs\LogFiles\W3SVC*
Please sign in to rate this answer.
AdamBaumgartner-4096 0 Reputation points

2023-01-29T21:04:05.04+00:00

Thanks for the reply.

This is for custom log collection and does not seem to work for IIS logs, additionally the article states the following in relation to files patterns "There is no support for directory wildcards."

AdamBaumgartner-4096 0 Reputation points

2023-01-30T03:21:03.12+00:00

@tbgangav-MSFT Thanks for the reply.

Unfortualty this applies to custom logs and not IIS logs, additionally the article states the following in regard to file patterns.

"To collect log data in this scenario, you can use a file wildcard. Use the format C:\directoryA\directoryB\*MyLog.txt for Windows and /var/*.log for Linux. There is no support for directory wildcards."

Cheers.

tbgangav-MSFT 10,386 Reputation points

2023-01-30T03:27:14.9933333+00:00

Hi,

Thanks for the update. Yes, the provided document reference was intentional because if https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-iis doesn't help in your use case i.e., having multiple sites on single IIS server then you may follow https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-text-log approach to see if it helps and the note was around file wildcard * as of course currently there is no support for directory wildcards as mentioned in the referred Azure document.

If interested, as shown in below screenshot please go to Feedback section in https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-iis and click on "This product" option and share feature request to support directory wildcards which helps in your use case. In general, Azure product or feature team would check feasibility of a feature request, prioritize against existing feature backlog, add in roadmap as appropriate and would announce and/or update related Azure document once a feature request is addressed.
Sign in to comment