Skip to content

Commit ae97ab5

Browse files
bwrenbwren
committed
Add IIS to text logs
1 parent 1608d6f commit ae97ab5

File tree

2 files changed

+110
-17
lines changed

2 files changed

+110
-17
lines changed

‎articles/azure-monitor/agents/data-collection-text-log.md

Lines changed: 109 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,19 @@
11
---
2-
title: Collect text logs with Azure Monitor agent (preview)
2+
title: Collect text and IIS logs with Azure Monitor agent (preview)
33
description: Configure collection of filed-based text logs using a data collection rule on virtual machines with the Azure Monitor agent.
44
ms.topic: conceptual
55
ms.date: 04/08/2022
66

77
---
88

9-
# Collect text logs with Azure Monitor agent (preview)
10-
This tutorial shows you how to configure the collection of file-based text logs with the [Azure Monitor agent](azure-monitor-agent-overview.md) and sending the collected data to a custom table in a Log Analytics workspace. This feature uses a [data collection rule](../essentials/data-collection-rule-overview.md) that you can use to define the structure of the log file and its target table.
9+
# Collect text and IIS logs with Azure Monitor agent (preview)
10+
This articles describes how to configure the collection of file-based text logs, including logs generated by IIS on Windows computers, with the [Azure Monitor agent](azure-monitor-agent-overview.md). This feature uses a [data collection rule](../essentials/data-collection-rule-overview.md) that you can use to define the structure of the log file and its target table.
1111

1212
> [!NOTE]
1313
> This feature is currently in public preview and isn't completely implemented in the Azure portal. This tutorial uses Azure Resource Manager templates for steps that can't yet be performed with the portal.
1414
15-
In this tutorial, you learn to:
16-
17-
> [!div class="checklist"]
18-
> * Create a custom table in a Log Analytics workspace.
19-
> * Create a data collection endpoint to receive data from an agent.
20-
> * Create a data collection rule that collects data from both a custom text log file.
21-
> * Create an association to apply the data collection rule to agents.
2215
## Prerequisites
23-
To complete this tutorial, you need the following:
16+
To complete this procedure, you need the following:
2417

2518
- Log Analytics workspace where you have at least [contributor rights](../logs/manage-access.md#manage-access-using-azure-permissions) .
2619
- [Permissions to create Data Collection Rule objects](/azure/azure-monitor/essentials/data-collection-rule-overview#permissions) in the workspace.
@@ -33,6 +26,7 @@ The log file must meet the following criteria to be collected by this feature:
3326
- Each entry in the log file must be delineated with an [ISO 8601 formatted](https://www.iso.org/standard/40874.html) time stamp or an end of line.
3427
- The log file must not allow circular logging, log rotation where the file is overwritten with new entries, or the file is renamed and the same file name is reused for continued logging.
3528

29+
##
3630

3731
## Steps to collect text logs
3832
The steps to configure log collection are as follows. The detailed steps for each are provided in the sections below:
@@ -45,7 +39,10 @@ The steps to configure log collection are as follows. The detailed steps for eac
4539
## Create new table in Log Analytics workspace
4640
The custom table must be created before you can send data to it. When you create the table, you provide its name and a definition for each of its columns.
4741

48-
Use the **Tables - Update** API to create the table with the PowerShell code below. This code creates a table called *MyTable_CL* with two columns. You can modify this schema to collect a different table.
42+
>[!NOTE]
43+
> This step isn't required to collect an IIS log. The table [W3CIISLog](/azure/azure-monitor/reference/tables/w3ciislog) will be used for IIS logs.
44+
45+
Use the **Tables - Update** API to create the table with the PowerShell code below. This code creates a table called *MyTable_CL* with two columns. Modify this schema to collect a different table.
4946

5047
> [!IMPORTANT]
5148
> Custom tables must use a suffix of *_CL*.
@@ -96,7 +93,6 @@ A [data collection endpoint (DCE)](../essentials/data-collection-endpoint-overvi
9693
9794
:::image type="content" source="../logs/media/tutorial-ingestion-time-transformations-api/edit-template.png" lightbox="../logs/media/tutorial-ingestion-time-transformations-api/edit-template.png" alt-text="Screenshot that shows portal blade to edit Resource Manager template.":::
9895
99-
10096
```json
10197
{
10298
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -143,6 +139,7 @@ A [data collection endpoint (DCE)](../essentials/data-collection-endpoint-overvi
143139
}
144140
```
145141
142+
146143
4. On the **Custom deployment** screen, specify a **Subscription** and **Resource group** to store the data collection rule and then provide values a **Name** for the data collection endpoint. The **Location** should be the same location as the workspace. The **Region** will already be populated and is used for the location of the data collection endpoint.
147144
148145
:::image type="content" source="../logs/media/tutorial-ingestion-time-transformations-api/custom-deployment-values.png" lightbox="../logs/media/tutorial-ingestion-time-transformations-api/custom-deployment-values.png" alt-text="Screenshot that shows portal blade to edit custom deployment values for data collection endpoint.":::
@@ -173,7 +170,7 @@ The [data collection rule (DCR)](../essentials/data-collection-rule-overview.md)
173170
174171
:::image type="content" source="../logs/media/tutorial-ingestion-time-transformations-api/build-custom-template.png" lightbox="../logs/media/tutorial-ingestion-time-transformations-api/build-custom-template.png" alt-text="Screenshot that shows portal blade to build template in the editor.":::
175172
176-
3. Paste the Resource Manager template below into the editor and then change the following values:
173+
3. Paste on of the Resource Manager templates below into the editor and then change the following values:
177174
178175
You may choose to modify the following details in the DCR defined in this template:
179176
@@ -186,6 +183,7 @@ The [data collection rule (DCR)](../essentials/data-collection-rule-overview.md)
186183
187184
:::image type="content" source="../logs/media/tutorial-ingestion-time-transformations-api/edit-template.png" lightbox="../logs/media/tutorial-ingestion-time-transformations-api/edit-template.png" alt-text="Screenshot that shows portal blade to edit Resource Manager template.":::
188185
186+
**Data collection rule for text log**
189187
190188
```json
191189
{
@@ -235,7 +233,7 @@ The [data collection rule (DCR)](../essentials/data-collection-rule-overview.md)
235233
"name": "[parameters('dataCollectionRuleName')]",
236234
"location": "[parameters('location')]",
237235
"apiVersion": "2021-09-01-preview",
238-
"properties": {
236+
"properties": {
239237
"dataCollectionEndpointId": "[parameters('endpointResourceId')]",
240238
"streamDeclarations": {
241239
"Custom-MyLogFileFormat": {
@@ -283,7 +281,6 @@ The [data collection rule (DCR)](../essentials/data-collection-rule-overview.md)
283281
},
284282
"name": "myLogFileFormat-Linux"
285283
}
286-
287284
]
288285
},
289286
"destinations": {
@@ -318,6 +315,102 @@ The [data collection rule (DCR)](../essentials/data-collection-rule-overview.md)
318315
}
319316
```
320317
318+
**Data collection rule for IIS log**
319+
320+
```json
321+
{
322+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
323+
"contentVersion": "1.0.0.0",
324+
"parameters": {
325+
"dataCollectionRuleName": {
326+
"type": "string",
327+
"metadata": {
328+
"description": "Specifies the name of the Data Collection Rule to create."
329+
}
330+
},
331+
"location": {
332+
"type": "string",
333+
"defaultValue": "westus2",
334+
"allowedValues": [
335+
"westus2",
336+
"eastus2",
337+
"eastus2euap"
338+
],
339+
"metadata": {
340+
"description": "Specifies the location in which to create the Data Collection Rule."
341+
}
342+
},
343+
"workspaceName": {
344+
"type": "string",
345+
"metadata": {
346+
"description": "Name of the Log Analytics workspace to use."
347+
}
348+
},
349+
"workspaceResourceId": {
350+
"type": "string",
351+
"metadata": {
352+
"description": "Specifies the Azure resource ID of the Log Analytics workspace to use."
353+
}
354+
},
355+
"endpointResourceId": {
356+
"type": "string",
357+
"metadata": {
358+
"description": "Specifies the Azure resource ID of the Data Collection Endpoint to use."
359+
}
360+
}
361+
},
362+
"resources": [
363+
{
364+
"type": "Microsoft.Insights/dataCollectionRules",
365+
"name": "[parameters('dataCollectionRuleName')]",
366+
"location": "[parameters('location')]",
367+
"apiVersion": "2021-09-01-preview",
368+
"properties": {
369+
"dataCollectionEndpointId": "[parameters('endpointResourceId')]",
370+
"dataSources": {
371+
"iisLogs": [
372+
{
373+
"streams": [
374+
"Microsoft-W3CIISLog"
375+
],
376+
"logDirectories": [
377+
"C:\\inetpub\\logs\\LogFiles\\*.log"
378+
],
379+
"name": "myIisLogsDataSource"
380+
}
381+
]
382+
},
383+
"destinations": {
384+
"logAnalytics": [
385+
{
386+
"workspaceResourceId": "[parameters('workspaceResourceId')]",
387+
"name": "[parameters('workspaceName')]"
388+
}
389+
]
390+
},
391+
"dataFlows": [
392+
{
393+
"streams": [
394+
"Microsoft-W3CIISLog"
395+
],
396+
"destinations": [
397+
"[parameters('workspaceName')]"
398+
],
399+
"transformKql": "source"
400+
}
401+
]
402+
}
403+
}
404+
],
405+
"outputs": {
406+
"dataCollectionRuleId": {
407+
"type": "string",
408+
"value": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]"
409+
}
410+
}
411+
}
412+
```
413+
321414
5. On the **Custom deployment** screen, specify a **Subscription** and **Resource group** to store the data collection rule and then provide values defined in the template. This includes a **Name** for the data collection rule and the **Workspace Resource ID** and **Endpoint Resource ID**. The **Location** should be the same location as the workspace. The **Region** will already be populated and is used for the location of the data collection rule.
322415
323416
:::image type="content" source="media/data-collection-text-log/custom-deployment-values.png" lightbox="media/data-collection-text-log/custom-deployment-values.png" alt-text="Screenshot that shows portal blade to edit custom deployment values for data collection rule.":::

‎articles/azure-monitor/toc.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -502,7 +502,7 @@ items:
502502
- name: Collect events and performance
503503
displayName: data collection rule,Azure Monitor agent
504504
href: agents/data-collection-rule-azure-monitor-agent.md
505-
- name: Collect text Logs
505+
- name: Collect text and IIS Logs
506506
displayName: data collection rule,Azure Monitor agent
507507
href: agents/data-collection-text-log.md
508508
- name: Use data collection endpoints

0 commit comments

Comments
 (0)