Security Compliance

Unable to start the IIS Web or FTP server connector in SEM

The Microsoft Internet Information Services (IIS) Web Server or Microsoft IIS FTP Server connector does not start in the SEM console.

First published date

10/18/2018 6:36 PM

Last published date

11/14/2018 8:21 PM

Overview

The Microsoft Internet Information Services (IIS) Web Server or Microsoft IIS FTP Server connector does not start in the Security Event Manager (formerly Log & Event Manager) console.

Product section

Security Event Manager

Cause

This can occur when the logging levels are not disabled or are set too low in the IIS Manager.

Resolution

Stop the SEM Agent.
Open the Microsoft IIS Manager and configure the W3C format by selecting the following logging options using the Configure Logging at the Site Level (© 2019 Microsoft Corporation, available at http://www.microsoft.com, obtained on January 17, 2019) procedure from the Microsoft website:
- One log file per: Site
- Format: W3C
- W3C Logging Fields: All available fields
Go to the website and copy the logging options from the IIS instance.
Move the files currently in C:\inetpub\logs\LogFiles to a different location. Otherwise, SEM will attempt to read data from the old log files in this folder and the connector and may not start.
Start the SEM Agent.

If the connector still does not start. Try deleting and recreating the connector.

If your IIS log files have a "_x" suffix, that signifies enhanced logging. In this case, you should be using the Microsoft IIS W3C v8.5 Enhanced Logging connector.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.