Perform the following to verify that GFI EventsManager can access and collect W3C logs:
- Take note of the ip address of the machine where the log files are located (e.g. 192.168.0.21), and the path where the W3C logs are located (e.g. <C:\WINDOWS\system32\Logfiles\W3SVC1>
- Logon to the computer where GFI EventsManager is running
- Go to Start -> Run
- Type \\<ip address of machine>\<path to log file, using admin shares>"
Using the example above, we would use \\192.168.0.21\C$\WINDOWS\system32\Logfiles\W3SVC1"
- Ensure that you can open the W3C log files using a text editor such as Notepad
The verification process described above simulates the W3C event retrieval operation normally performed by GFI EventsManager. Hence, if you managed to successfully open and access the W3C log file, then GFI EventsManager will be able to effectively retrieve events from the machine.
If you failed to successfully open and access the W3C log file, verify that:
- The W3C log file is located in a path which is shared. This can be either an administrative share, or a normal share. For example, all the W3C logs can be found in a share called LogFiles . In GFI EventsManager, we need to specify LogFiles\*.* . In this case, GFI EventsManager will connect to \\192.168.0.21\LogFiles, and retrieve all the files from this location
- The account under which GFI EventsManager is running has access/read privileges over the share where the W3C log file is located. To verify access privileges, navigate to the share using windows explorer, right click on the share and select Sharing and Security -> Permissions
- The target W3C log files are not locked/opened exclusively by another application such as Microsoft Internet Information Server (IIS). This would block GFI EventsManager from accessing and collecting events from the source log. To avoid this, configure your applications to create new log files more frequently. For example, a new IIS W3C log file can be created once every hour. This will allow GFI EventsManager to be up to date till the last hour