IIS Integration Wazuh

[John Carry]

Dear Wazuh Team,

I have installed a windows machine with Wazuh and  its successfully been integrated and Alerts are been received at wazuh, but when I am trying to integrate IIS by following the official method I am not observing  IIS relevant logs at wazuh end.

Further be noted that I have successfully enabled IIS application and IIS logs are successfully been populated inside file:

Logs inside above file:

Below is the configuration added in ossec.conf at Windows machine end:

Please help out to resolve the issue.

[John Carry]

Dear Wazuh Team,

Any progressive update ?

[John Carry]

Anyone there to respond?

[Miguel Casares]

Hello John,

Can you share with us the version of the Wazuh agent, the ossec.log file and a sample of the logs so I can test this in my environment?

Bear in mind that after adding the configuration you should restart the agent and the agent will automatically detect new lines in the file. Just to discard no new lines are being added and for that reason the agent is not reading them.

Looking forward to your response.

Regards,

Miguel