Microsoft Internet Information Services
Last Modified: Thursday, February 13, 2014
Event Source (Device) Product Information
Vendor Microsoft
Event Source (Device) Internet Information Services
Supported Versions 5.x, 6.x, 7.x
Note:The support for Microsoft Internet Information Services raw log collection requires RSA enVision 4.0 Service Pack 4 or later.
Additional Downloads sftpagent.conf.microsoftiis
RSA Product Information
Supported Version RSA enVision 4.0 and 4.1
Event Source (Device) Type microsoftiis, 55
Collection Method File Reader
Event Source (Device) Class.Subclass Host.Web Logs
Content 2.0 Table Web Logs
This document contains the following information for the Microsoft Internet Information Services (IIS) event source:
l Configuration Instructions l Content 2.0 Release Notes l Standard Content Release Notes
Microsoft Internet Information Services Configuration Instructions
Important:If you have already configured this event source as a monitored device, configure the event source as a multi-device.
To configure Microsoft IIS to work with enVision, complete the following tasks: I. Configure Microsoft IIS
II. Set Up the NIC SFTP Agent
Configure Microsoft IIS
Depending on your version of Microsoft IIS, complete one of the following tasks: l Configure Microsoft IIS 7.x
l Configure Microsoft IIS 6.x l Configure Microsoft IIS 5.x
Configure Microsoft IIS 7.x
To configure IIS 7.x:
1. Open the Microsoft IIS Server Manager Utility.
2. In the console tree, clickServer Manager >Roles>Web Server(IIS)>Internet Information Services (IIS) Manager.
3. Select the service for which you want to enable logging, for example,ComputerName >Sites> Default Web Site.
4. In theGroupsarea, double-clickLogging.
5. In theLog Filesection, from theFormatdrop-down list, selectW3C. 6. ClickSelect Fields.
7. In the W3C Logging Fields dialogue box, selectcs-methodand any other options that you want. Note:You must selectcs-method. All other selections are optional.
8. ClickOK.
9. In theLog File Rolloversection, selectSchedule, and from the drop-down list, selectDaily. 10. In theActionspane, clickApply.
11. Repeat steps 1 through 10 for each service for which you want to manage logs. Substitute the other services for theSitesfolder in step 3.
Configure Microsoft IIS 6.x
To configure IIS 6.x:
1. To open the Microsoft IIS Manager Utility, clickStart> Administrative Tools> Internet Information Services Manager.
2. In the console tree, browse to the network service that you want to monitor, for example, ComputerName>Web Sites.
3. Right-click theWeb Sitesfolder, and clickProperties.
4. On theWeb Sitetab, selectEnable Logging, and from theActive log formatdrop-down list, selectW3C Extended Log File Format.
5. ClickProperties.
6. In the Logging Properties window, in theNew log schedulefield, selectHourly.
7. Write down the directory shown in theLog file directoryfield at the bottom of the Logging Properties window. You need this information when you set up the NIC FTP Agent or NIC SFTP Agent.
8. On theExtended Propertiestab, ensure that the following extended logging options are selected: l Date
l Time
l All of theExtended Properties. 9. ClickApply.
10. In the Inheritance Override pop-up window, selectcs-methodand any other options that you want. Repeat this for each Inheritance Override pop-up window that opens.
Note:You must selectcs-method. All other selections are optional. 11. ClickOK.
12. Repeat steps 1 through 12 for each network service for which you want to manage logs. Substitute the other network services for the Web Site folder selected in step 3.
Configure Microsoft IIS 5.x
To configure IIS 5.x:
1. In the Microsoft IIS Management interface, on theWeb Sitestab, selectProperties.
2. SelectEnable Logging, and, from theActive log formatdrop-down list, selectW3C Extended Log File Format.
3. ClickProperties, and in theNew log time periodfield, selectHourly.
4. Write down the directory shown in theLog file directoryfield at the bottom of the Logging Properties window. You need this information when you set up the NIC FTP Agent or NIC SFTP Agent.
5. On theAdvancedtab, follow these steps to configure extended logging properties: a. SelectDate.
b. SelectTime
c. Select all of theExtended Properties. Note:Do not selectProcess Accounting. 6. ClickApply.
7. In the Inheritance Override pop-up window, selectcs-methodand any other options that you want. Repeat this for each Inheritance Override pop-up window that opens.
8. ClickOK.
9. Repeat steps 1 through 8 for each server type for which you want to manage logs. Substitute the server type name for theWeb Sitestab selected in step 1.
Set Up the NIC SFTP Agent
To set up the NIC SFTP Agent:
1. Download or navigate to thesftpagent.conf.microsoftiisfile.
Note:The SFTP sample file is available on RSA SecurCare Online (SCOL) and on the RSA enVision appliance. For details, seeRSA enVision NIC SFTP Agent Configuration.
2. Using thesftpagent.conf.microsoftiisfile, set up the NIC SFTP Agent.
Note:If you are upgrading Microsoft IIS to content 2.0, ensure that the sftpagent.conf.microsoftiisfile directs logs to the new FTP file location. To do this, in thesftpagent.conf.microsoftiisfile, you must include_TVM_before the IP address in thefileV.ftpparameter, for example,dir0.ftp=enVisionIP,nic_ sshd,publickey,IIS_TVM_IPaddress.
For instructions on installing theNIC SFTP Agent, seeRSA enVision NIC SFTP Agent Configuration, which is available on SecurCare Online.
Set Up the NIC File Reader Service
To add Microsoft IIS through the NIC File Reader Service:
1. Log on to enVision with administrator credentials.
2. SelectOverview>System Configuration>Services>Device Services>Manage File Reader Service.
3. ClickAdd.
4. Complete the fields as follows.
Field Action
IP address Enter the IP address of your Microsoft IIS event source.
File reader type SelectIIS.
If you are using Content 2.0 of the event source, selectIIS_TVM. 5. Ensure thatStart File Reader Service on Applyis selected.
6. ClickApply.
Content 2.0 Release Notes
Microsoft Internet Information Release Notes (20140213-121344)
New and Updated Event Messages in Microsoft IIS
For complete details on new and updated messages, see the Event Source Update Help.
Microsoft Internet Information Release Notes (20140109-164535)
New and Updated Event Messages in Microsoft IIS
For complete details on new and updated messages, see the Event Source Update Help.
Microsoft Internet Information Release Notes (20131211-220046)
New and Updated Event Messages in Microsoft IIS
For complete details on new and updated messages, see the Event Source Update Help.
Microsoft Internet Information Release Notes (20130731-180221)
New and Updated Event Messages in Microsoft IIS
For complete details on new and updated messages, see the Event Source Update Help.
Microsoft Internet Information Release Notes (20120305-123706)
New and Updated Event Messages in Microsoft IIS
Standard Content Release Notes
Microsoft Internet Information Release Notes (20120105-082058)
What's New in This Release
RSA has updated the configuration instructions for this release.
