Integrating with Microsoft Windows Internet Information Services

Overview

Internet Information Services (IIS) is Microsoft’s extensible web server software for the Windows NT operating system. It provides a modular and extensible platform for hosting websites, services and applications.

Before you begin

This integration requires Windows logging to be set up in order to also collect IIS logs. You can either use Blumira Agent or NXLog to collect IIS logs.

If you are using NXLog, a Blumira sensor is required to collect those logs. To set up a Blumira sensor, follow the steps in Building a Blumira sensor with Ubuntu.

A Blumira sensor is not necessary if using Blumira Agent to forward IIS logs from your Windows machines.

Setting up Windows logging

You can forward logs from Windows-based systems using one of the two methods below. There is no need to use both tools, as doing so would result in duplicate logging.

• Use Blumira Agent to collect logs directly from a Windows endpoint.
• Use Poshim to configure Window logging to a Blumira sensor.

Setting Up IIS Logging

You must configure IIS to stream events to the Windows Event service. Each IIS server's logging configuration must be modified to forward logs to the Windows Event service.

To configure IIS, do the following:

1. In IIS Manager, navigate to Server Configuration > Logging.
2. Under Log Event Destination, select Both log file and ETW event.
   
   
3. Click Save in the right sidebar menu when you are done.
   Note: This process must be done for each site. You can also change this at the IIS server level which will update each site setting and ensure each new site forwards logs appropriately. 

4. Do one of the following, depending on which method you are using for logging:

   • If you are using Blumira Agent for logging, run the following commands in an Administrative command prompt to enable logging:

     wevtutil sl Microsoft-IIS-Configuration/Administrative /e:true
     wevtutil sl Microsoft-IIS-Configuration/Operational /e:true
     wevtutil sl Microsoft-IIS-Logging/Logs /e:true

   • If you are sending Windows logs to the Blumira sensor, which includes NXLog, restart NXLog from the services console or by running the following command:
     

     net stop nxlog && net start nxlog

Viewing your IIS log data in Report Builder

To view the IIS data that Blumira has received, you can use the Report Builder to run a global report or create your a custom report with these data sources:

• HTTP Access (Apache/IIS/NginX)
• HTTP Error (Apache/IIS/NginX)
• IIS Configuration Events