Hello,
Let's say I have several kind of Windows Servers:
- IIS servers
- SQL Servers
- etc.
For each of them:
1. I want to collect a common set of data (application/system event logs, CPU/memory perfmon, etc.)
2. I want to collect dedicated data (specific perfmon counts for SQL servers, etc.)
What are the best practices to ensure efficiency and reusuability with a deployment server? I tried to deploy the TA Windows as a first app without any inputs.conf configured, then I deployed additional small apps with just a default/inputs.conf, but it did not work:
**...\etc\deployment-apps\TA_Windows**
(no modification inside, just the original files of the add-on)
**...\etc\deployment-apps\winevtlog-common**
- default/inputs.conf (common windows event log data collection inside)
**...\etc\deployment-apps\winevtlog-sql**
- default/inputs.conf (custom windows event log data collection for SQL server inside)
And so on, for perfmon, and others required custom config...
After deployment, and universal forwarder restarts, it does not work. No error visible in UF log, but no data collected. inputs.conf syntax is ok (because if I move it into TA_windows/etc/local/inputs.conf, it starts working).
Any idea how to achieve what I want without duplicating files (aka, copy-pasted the TA windows multiple times)?
Thanks.
↧