Microsoft IIS - need to remove the web_cookie cs_cookie field from parser
Per Microsoft's guidance on IIS logging, busy websites may need to disable the logging of cookies in their W3C logs due to significant storage and processing implications.
When we disable the cookie field under IIS logging options, enVision runs into problems parsing the logs.
We've tried to manually edit the micrsofotiismsg.xml to remove the web_cookie field. Couple of observations about that:
1. When we loaded the microsoftiismsg.xml in the ESI tool, the web_cookie and web_referral fields did not appear to be assigned to any fields in the Web Accounting table (unlike the rest of the variables).
2. CONTENT field of each message in the parser includes the statement:
We've tried removing it as well as the web_cookie field in each message, but it hasn't helped much.
As of now, the log files WITHOUT the cookie field are not parsing correctly using the ORIGINAL parser.
1. PARMVAL is supposed to assign a value of one variable (already parsed in) to another variable. What is fld3 then and where is it stored in the Web Accounting table?
2. Is there an easy, documented, supported method of removing undesired fields from a parser without breaking the rest of the parsing logic?
At this point we're looking at having to recreate the IIS parser through the ESI tool just to get this functionality.
Turns out that it is possible to remove references to the cs_cookie field from the microsoftiismsg.xml.
Also be sure to remove any references to that field (or whichever field you choose to eliminate) from the header portion of the xml as well.
Create a new FileReader definition under UDS configs (call it IIS_nocookie or something like that). Use 16, SP, CR.
Change the xml entries reading %IIS- to read %IIS_nocookie- (or whatever you named your custom FileReader entry) - this ensures that once the messages are read in they get passed to the correct parser.
That's about it. Setup your SFTP agent and watch the events come in.