Wazuh agent stops collecting IIS server logs after a while
Alex
Hi everyone,
I am currently monitoring IIS server logs using the Wazuh agent. Initially, the logs are ingested and processed perfectly fine. However, after a certain period, the log flow silently stops and no new IIS logs are sent to the Wazuh Manager.
If I restart the Wazuh agent, it sometimes picks up the logs again for a short time, but the issue always repeats itself. The agent continues to send other logs (like Windows Event logs) without any problem, so the agent itself is not crashing or disconnecting; it just stops reading the IIS logs.
Has anyone experienced this specific issue with IIS log collection stopping abruptly? What could be the root cause (perhaps something related to IIS log rotation, file locking, or the agent losing track of the file descriptor?), and what is the proper solution to ensure continuous, uninterrupted log collection?
Thanks in advance,
Alex.
Configuration:
<agent_config>
<localfile>
<location>C:\inetpub\logs\LogFiles\*\*.log</location>
<log_format>iis</log_format>
</localfile>
<syscheck>
<directories check_all="yes" realtime="yes" restrict=".config$">C:\inetpub\wwwroot</directories>
</syscheck>
</agent_config>
Md. Nazmur Sakib
Hi Alex,
It is very common while monitoring IIS log files in Windows endpoints.
You can run PowerShell as administrator and run this command to find the error and warning logs from ossec.log Select-String -Path 'C:\Program Files (x86)\ossec-agent\ossec.log' -Pattern 'error|warning'
If you see a warning like this WARNING: (1960): File limit has been reached (200).
It indicates you have more than 200 folders in the IIS log folder. This exceeds the 200 file monitoring limit.
There is currently no official way to increase the limit, as it is limited to 200 due to the file descriptors being shared. Check the code for reference.
https://github.com/wazuh/wazuh/blob/v4.3.5/src/logcollector/config.c#L78-L82
https://github.com/wazuh/wazuh/blob/v4.3.5/src/logcollector/logcollector.h#L21
As a workaround, it is recommended to manually reduce the number of files that Logcollector attempts to open, either by using more specific file paths or by applying the <age> option.
Ex:
<localfile>
<log_format>iis</log_format>
<location>C:\inetpub\logs\LogFiles\*\*.log</location>
<age>1d</age>
</localfile>