W3CIISLog query no longer returning results

%3CLINGO-SUB%20id%3D%22lingo-sub-1408303%22%20slang%3D%22en-US%22%3EW3CIISLog%20query%20no%20longer%20returning%20results%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1408303%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3EI%20wonder%20if%20you%20can%20help.%20We%20have%20a%20problem%20where%20IIS%20Logs%20have%20stopped%20appearing%20in%20Log%20Analytics.%20The%20query%20I%20am%20running%20to%20try%20and%20view%20data%20is%3A%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3EW3CIISLog%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3C%2FDIV%3E%3CP%3EI%20can%20confirm%20that%20the%20VM%20is%20connected%20with%3A%3C%2FP%3E%3CDIV%3E%3CSPAN%3EHeartbeat%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3E%7C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Esummarize%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3Barg_max(TimeGenerated%2C%20*)%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eby%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3BComputer%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EW3C%20IIS%20Logs%20are%20being%20generated%20on%20the%20VM%20when%20I%20look%20in%20Windows%20Explorer.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3ECapturing%3CSPAN%3E%26nbsp%3Bthe%20logs%20has%20been%20enabled%20in%3A%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3ELog%20Analytics%20workspace%20(Advanced%20Settings%20%26gt%3B%20Data%20%26gt%3B%20IIS%20Logs).%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EDoes%20anyone%20have%20any%20suggestions%20what%20else%20I%20can%20check%3F%20As%20I%20say%20this%20was%20working%20previously.%20This%20is%20our%20test%20environment%2C%20I%20have%20the%20same%20setup%20with%20the%20live%20servers%20and%20they%20are%20still%20working%20fine.%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3EThank%20you%20in%20advance%20of%20any%20suggestions.%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Regular Visitor

Hi,

I wonder if you can help. We have a problem where IIS Logs have stopped appearing in Log Analytics. The query I am running to try and view data is: 

W3CIISLog
 

I can confirm that the VM is connected with:

Heartbeat
summarize arg_max(TimeGenerated, *) by Computer
 
W3C IIS Logs are being generated on the VM when I look in Windows Explorer.
 
Capturing the logs has been enabled in:
Log Analytics workspace (Advanced Settings > Data > IIS Logs).
 
Does anyone have any suggestions what else I can check? As I say this was working previously. This is our test environment, I have the same setup with the live servers and they are still working fine.
 
Thank you in advance of any suggestions.
0 Replies