Collect IIS logs with AMA agent into Log Analytics

Silberman, Oleg 5

It does not matter, if this optional field "File pattern" is empty or filled in the error is "InvalidIisLogsDirectory" (see the error in JSON format below).

Update Error - 'Log Directories' value 'E:\LOGS-IIS\Default Web Site\W3SVC1

{
  "code": "DeploymentFailed",
  "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
  "details": [
    {
      "code": "InvalidIisLogsDirectory",
      "message": "'Log Directories' value 'E:/LOGS-IIS/myWebApp/*.log' is invalid."
    }
  ]
}

2 answers

Stanislav Zhelyazkov 21,101 Reputation points MVP

2023-02-02T09:22:29.3533333+00:00

Hi,

It is unclear what is the value for your logs directory in your data collection rule but I would assume it is "E:/LOGS-IIS/myWebApp/*.log". I believe you do not have to define wild cards, you need to define only the path like "E:\LOGS-IIS\myWebApp". The data collection rule will automatically pick the logs from there. You only need to make sure that your IIS server is set to write into that directory, format is W3C, encoding is UTF-8 and that for example new logs are created on schedule Hourly.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Silberman, Oleg 5 Reputation points

2023-02-06T07:55:59.3333333+00:00

Hi thank you! I have entered only the path and I could create the Data Collection Rule.

But still IIS logs are not ingested into Log Analytics using AMA, i.e. data collection rule does not pick the logs from there.

Do you have any suggestions how to troubleshoot AMA?

Thanks

AnuragSingh-MSFT 19,691 Reputation points

2023-02-06T08:05:07.1733333+00:00

@Silberman, Oleg thank you for the reply. Here are some of the steps that can be followed for troubleshooting this issue:-

Ensure that the "Resource" in "Data collection Rule" settings has the correct VM mentioned from where the IIS logs need to be collected.

Ensure that the agent has been installed successfully and is in running state. A detailed step-by-step guideline is available here - Basic troubleshooting steps (installation, agent not running, configuration issues).

See if the prerequisites are met for the VM - (for example, the IIS log file in W3C format must be stored on the local drive of the machine on which Azure Monitor Agent is running. Based on the configuration, is E: a local drive or mapped share/drive?)

The Troubleshoot section of the configuration doc also contains steps to be performed specifically to troubleshoot this issue.

In case all the steps above have been taken and it does not help, I would suggest reaching out to Azure Support to investigate this issue 1:1. The Logs which would be of interest for investigation can be collected based on the steps mentioned here.

Hope this helps.

Silberman, Oleg 5 Reputation points

2023-02-06T09:11:06.7166667+00:00

@AnuragSingh-MSFT everything is fine with the agent up to IMDS. It is trying to access: Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -NoProxy -Uri "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | ConvertTo-Json -Depth 64

My VM is a on-prem VM connected to Azure Arc, as such the Azure private address 169.254.169.254 cannot be accessed. Can you please provide some information, how to configure access to IMDS from Azure Arc connected server

AnuragSingh-MSFT 19,691 Reputation points

2023-02-07T04:48:29.9266667+00:00

Silberman, Oleg, thank you for the reply. IMDS or HIMDS or Hybrid Instance Metadata service manages the connection to Azure and connected machine's Azure identity. You can see this link for more details about it.

Regarding IP 196.254.169.254, which is an APIPA address, it is a well-known, no-routable IP on which IMDS is available as a REST API. You can only access it from within the VM. Communication between the VM and IMDS never leaves the host. You can read more about it here - Azure Instance Metadata Service (Windows).

Regarding your reply - "everything is fine with the agent up to IMDS." - does it mean that you are seeing an error after this state? The following can be checked to ensure that the arc agent is able to communicate with the Azure platform

In Portal --> Azure Arc --> Servers. Check the status of this machine.

On the VM, use the cmd (azcmagent show) to check if the Arc agent is connected to the machine. See About the azcmagent tool

Hope this helps.

Silberman, Oleg 5 Reputation points

2023-02-07T09:47:30.42+00:00

@AnuragSingh-MSFT yes I see the error:

curl.exe : * Trying 169.254.169.254:80... At C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent\1.7.0.0\CollectAMALogs.ps1:309 char:22 + ... $imdsResponse = curl.exe -v -H "Metadata: true" $imdsEndpoint | conve ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (* Trying 169.254.169.254:80...:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError

...

...

failed: Timed out * Failed to connect to 169.254.169.254 port 80 after 21040 ms: Timed out 0 0 0 0 0 0 0 0 --:--:-- 0:00:21 --:--:-- 0 * Closing connection 0 curl: (28) Failed to connect to 169.254.169.254 port 80 after 21040 ms: Timed out ... ... ... ---------------------------------------------------------------------------------------------------- Skipping Azure subscription endpoint. Either connection to imds failed or parsing of subscription id was unsuccessful ---------------------------------------------------------------------------------------------------- Connecting to himds for ARC Machines curl.exe : * Trying 127.0.0.1:40342... At C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent\1.7.0.0\CollectAMALogs.ps1:322 char:3 + curl.exe -v "http://localhost:40342" >> $networkInfo 2>&1; + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (* Trying 127.0.0.1:40342...:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connected to localhost (127.0.0.1) port 40342 (#0) > GET / HTTP/1.1 > Host: localhost:40342 > User-Agent: curl/7.83.1 > Accept: */* > * Mark bundle as not supporting multiuse < HTTP/1.1 404 Not Found < Content-Type: text/plain; charset=utf-8 < X-Content-Type-Options: nosniff < Date: Sun, 05 Feb 2023 18:45:42 GMT < Content-Length: 19 < { [19 bytes data] 404 page not found 100 19 100 19 0 0 12541 0 --:--:-- --:--:-- --:--:-- 19000 * Connection #0 to host localhost left intact ---------------------------------------------------------------------------------------------------- Connecting to MCS endpoint curl.exe : % Total % Received % Xferd Average Speed Time Time Time Current At C:\Packages\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent\1.7.0.0\CollectAMALogs.ps1:325 char:3 + curl.exe -v "https://global.handler.control.monitor.azure.com" >> $ ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: ( % Total % ... Time Current:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 40.113.176.134:443... * connect to 40.113.176.134 port 443 failed: Connection refused * Failed to connect to global.handler.control.monitor.azure.com port 443 after 1075 ms: Connection refused 0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0 * Closing connection 0 curl: (7) Failed to connect to global.handler.control.monitor.azure.com port 443 after 1075 ms: Connection refused ---------------------------------------------------------------------------------------------------- Cannot find mcs config file under AMA datastore. Cannot parse endpoints information downloaded from AMCS.

To your questions:

In Portal --> Azure Arc --> Servers --> Status = Connected

On the VM, use the cmd (azcmagent show) the Arc agent = connected

We have also a proxy. Azure Arc agent is configured with the proxy (also the status = connected). Also AMA is configured with the proxy, I can see Heartbeat of the AMA in Loganalytics

If I use MMA, I can collect IIS logs, but MMA is deprecated and MS suggest to move to AMA ...

Any other suggestions?

Thank you for your help

AnuragSingh-MSFT 19,691 Reputation points

2023-02-08T05:10:50.2366667+00:00

Silberman, Oleg, thank you for the reply. This seems interesting - if the errors are being reported regularly, I would expect azcmagent show to not show connected. Does it also show that all dependent services are in running state?

I would request reaching out to Azure Support to investigate it 1:1, so that the relevant logs can be analyzed, and the status can be checked from backend, if required. Please let me know if you are facing issues opening a support ticket for this issue.

Regarding the original question (unable to create DCR in portal), as the response from Stan helped resolve that, please mark the answer as "Yes" so that it can help community looking for the specific issue (unable to create DCR).
Sign in to comment
Asa Engleman 5 Reputation points

2024-02-21T18:12:36.62+00:00

I saw a similar thread where wildcards are only accepted using AMA custom logs, not IIS. We have a similar issue as each web site creates its own subdirectory and AMA does not honor it. https://learn.microsoft.com/en-us/answers/questions/1164675/iis-log-ingestion-using-ama-agents-for-multiple-ii
Please sign in to rate this answer.

0 comments No comments
Sign in to comment