SFTP agent on Windows 2008 server for IIS logs

[sandeepJain]

Hi friends, I have installed the SFTP agent on Windows 2008 server for collecting IIS logs, the logs are getting forwarded to the FTP folder in enViosion. The logs are even getting processed, but after that no device is being detected. Pls help me with this issue. Regards, Sandeep Jain

[RSAAdmin]

In managed monitored devices check for the IP address of the IIS server.  It is probably already there but as a windows device.  You will have to go into that device and mark it mult-device, restart the collector service and then it should discover the IIS logs.

Paul

[sandeepJain]

Hi, I have already kept the device as multi device. But still the device is not getting detected.

[RSAAdmin]

OK...so, you know they are being processed because they disappear from the folder or because you are seeing the the NIC message for FileReader that the messages are getting processed?

How many devices do you have under Managed Devices and what is your device limit? 

Paul

[sandeepJain]

I have 139 devices and this device is forwarding windows snare logs and IIS logs. But it is not getting detected as IIS.

[RSAAdmin]

Is it getting detected as unknown?

Paul

[sandeepJain]

No it is not atall getting detected.

[RSAAdmin]

Is your Windows 2008 server 64-bit or 32-bit? If it is 64-bit, what is the location of your IIS log files?

C:\Windows\system32\ is a "special case" for 32-bit processes (SFTP Agent) running on 64-bit Windows systems.

See the following article: Accessing files from System32 directory using 32 bit application on 64 bit machine http://social.msdn.microsoft.com/Forums/sl-SI/netfx64bit/thread/cfdf4474-266b-4ef5-8992-7fbdc3147521

[sandeepJain]

Its a 64bit server and we are storing the logs in E:\ drive in a seperate folder.

[RSAAdmin]

Can you go in the event viewer. from the dropdown, choose NIC System. Try to filter down with the IP address of the device. Chances are that the old logs didnt have all the fields enabled for logging. You will see this in red (something like cs-referer missing). If you see something along those lines, theres nothing to worry about, as long as you have followed the configuration guide to the dot.