How Do I Send IIS v8.5 Logs in W3C Format to a Linux Syslog Server?
2019-09-11 12:08:56 ERROR if-else failed at line 46, character 9 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 44, character 36 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; cannot parse integer "/", invalid modifier: '/'
This error message seems to indicate that one of the fields is expected to be an integer, but is seen as /
instead.
In our example in the manual (which looks like you are using), we are expecting the default fields. If the fields have changed or been modified in the IIS Manager, you will need to update the CSV fields appropriately. You can see the fields if you open the log file.
Below is an example log file from one of my test servers. You will notice that I have changed the fields at some point, so my #Fields
line was updated.
These are the fields you have to match in the xm_csv
Fields
/FieldTypes
sections. Again, make sure it matches the fields you see in the file on your system.
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2019-08-30 22:52:31
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2019-08-30 22:52:31 127.0.0.1 GET / - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 93
2019-08-30 22:52:31 127.0.0.1 GET /iisstart.png - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://127.0.0.1/ 200 0 0 0
2019-08-30 22:52:31 127.0.0.1 GET /favicon.ico - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 404 0 2 15
#Software: Microsoft Internet Information Services 10.0
#Version: 1.0
#Date: 2019-08-30 22:55:44
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2019-08-30 22:55:43 W3SVC1 WIN-LU43V8BOQ6J 127.0.0.1 GET /favicon.ico - 80 - 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 404 0 2 0