IIS parser will not parse all IIS information
I'm working with SA 10.3 and i have multiple IIS sites that i'm transferring the logs to SA using SFTP agent.
The problem i'm facing with is that most of the logs are not parsing in SA.
For example, the following log:
SA will not parse the webpage and only show me the information inside the msg container:
I followed the documentation here: http://sadocs.emc.com/@api/deki/files/40485/Microsoft_IIS.pdf
Anyone knows how can i fix this?
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
As I observed this issue is related to something issue with the parser of MS IIS in RSA SA. My suggestion would be to kindly update your server from 10.3.3 to 10.3.5, hope this will resolve the issue.
Or either I can share the latest parser for MS IIS from 10.4.2.
Thank you so much for the fast reply.
Can you please share your 10.4.2 MS IIS parser? I would like to check it before i'm upgrading the servers for nothing.
Kindly find the attached xml file for iis and replace the attached file with the below mentioned path.
Before replace the file, always remember to take the backup of the original file.
Hope this will work and solve your problem.
Thanks for the file, but this is the same file that i'm using today:
$ md5sum.exe ~/working/RSA/SecurityAnalytics/Parses/microsoftiis/backup/iis_tvm.xml
$ md5sum.exe ~/working/RSA/SecurityAnalytics/Parses/microsoftiis/iis_tvm.xml
Are you sure this is the file i need to change?
I think i need to change the two files in: /etc/netwitness/ng/envision/etc/devices/microsoftiis
Can you send them to me so i can compare?
Sorry to say, but those are also the same files as i have. Maybe there was no change in the IIS parser between the two upgrades.
Thanks for the help, can anyone think on another solution ?
It appears to be parsing correctly, what is the issue you are seeing? If you click on view details you will see all the meta.
msg = entire log message. You should not even be parsing that in your /etc/netwitness/ng/envision/etc/table-map.xml file, wastes too much space on your concentrator.
Some fields below might need to be modified in the table-map.xml.
To give you a rundown of what I am seeing.
Date/time = event.time
s-ip = ip.dst (top line on your image)
cs-method = msg.id
cs-uri-stem = web.page (if parsing it)
s-port = ip.dstport
cs-username = username
c-ip = ip.src (top line on your image)
cs(User-Agent) = client (or user.agent)
sc-status = result.code
sc-substatus = result
sc-win32-status = disposition
time-taken = duration
Thank you for the reply.
I read it twice (and even more), but i'm not sure i understand what you meant
I can see that the msg meta tag is holding all the information that i need. But i cant figure out how to access it in reports / investigation view.
The most important one is the webpage. I need to be able to search logs according to the webpage meta tag.
I can't find a way to grep / search by this criteria. Even when i' running regex on msg to find the correct word, i'm getting zero results.
I'm looking for a way to parse the webpage information - cs-uri-stem - in a way that will allow me to search for it in reports.
Can someone please assist me?