Page Comparison

...

IIS uses a flexible and efficient logging architecture. When a loggable event—usually an HTTP transaction—occurs, IIS calls the selected logging module.

Configuration

IIS logs

1. Open IIS Manager.

2. In the Connections tree view, select your website.

3. In Features View, double-click Logging.

4. On the Logging page, in the Log file section under Format, select W3C log file format (with default fields).

5. Under Directory, specify the path where the log file should be stored. The default is %SystemDrive%\inetpub\logs\LogFiles.

6. Click Apply in the Actions pane.
   Configuration sample:
   

...

1. Image Added

Endpoint Agent Manager

Using ansible roles (recommended)

1. Locate the inventory file we used in our Devo EA Manager deployment.

2. Open it with your preferred text editor, search for deam_fleet_config_devoext_fetchfiles_paths_win(or add it under vars if you have no previously configured fetchfiles) and add a new pattern with our previously configured log file path and a custom tag.

   The following screenshots shows a configuration sample:

...

1. Image Added

If you are running a new deployment, continue with the normal process of deployment, the change will not be applied until the devo-endpoint-agent playbook is run.

...

1. Log in to your Devo EA Manager administration console (https://<devo_ea_manager_ip>:8080)

2. Once logged in, access the osquery configuration in https://<DEAM_IP:8080>/ -> settings -> Global agent options
   

   Image Modified

3. Here, we will see a text editor with the default configuration values and the ones loaded from DEA Manager inventory file as in the following screenshot:

   Image Modified

    

4. We need to search for the windows -> devo_extensions -> fetchfiles section and add our previously configured log file path with a custom tag as in the following sample:
   

...

1. Image Added

...