John Gietzen's questions

I'm trying to set up a scheduled task on my server 2003 box (that is sitting on the WWW) to read web logs into a database.

When I run the .cmd file that I have set up using runas, the task succeeds. However, when I try to schedule the task under the user, I get the following error:

"ImportToday.job" (ImportToday.cmd) 9/15/2010 2:37:30 PM ** ERROR **
    Unable to start task.
    The specific error is:
    0x80070005: Access is denied.
    Try using the Task page Browse button to locate the application.

Adding the account logimporter into the Administrators group lets the scheduled task succeed, but this is really not a long-term option.

I have tried adding the Log on as a service right, and the account currently has the Log on as a batch job right.

What do I need to do?

I'm having trouble setting up our external web server.

Since we have a pretty small audience, we got one cheap server and are using SQL Server Express for the database and ASP.NET for the application, all on one box. (We are using GoDaddy for the hosting.)

Regardless of how bad these constraints are, this is where I'm stuck.

Everything is working OK, except that SQL Server will not successfully complete an install. Originally I was using the Web Platform Installer for it, but it was trying to read the entire installer into memory to calculate the file hash.

Running the installer works almost all of the way to the end, which verifies to me that the server meets the minimum reqs to install.

GlobalRules:

AclPermissionsFacet           Passed
MediaPathLength               Passed
OsVersionCheck                Passed
RebootRequiredCheck           Passed
ThreadHasAdminPrivilegeCheck  Passed
WmiServiceStateCheck          Passed

InstallGlobalRules:

SSMS_IsInternetConnected         Not applicable    This rule does not apply to your system configuration.
AclPermissionsFacet              Passed
Bids2005InstalledCheck           Passed
BlockInstallSxS                  Passed
FacetDomainControllerCheck       Passed
FacetPowerShellCheck             Passed
FacetWOW64PlatformCheck          Passed
FusionRebootCheck                Passed
IsFirewallEnabled                Passed
PerfMonCounterNotCorruptedCheck  Passed
SqlUnsupportedProductBlocker     Passed

My most recent failure was "FixSqlRegistryKey_x86.exe - Application Error"

Any Ideas?

I'm trying to configure Splunk to properly parse the fields of the W3C log format.

Now, I'm running into configuration confusion: where and how do I specify how to split up the log format?

My Inputs.conf looks like this:

[monitor://C:\WINDOWS\system32\LogFiles\W3SVC98989898]
disabled = false
host = mywebsite.net
sourcetype = iis

I tried adding this to my sourcetypes.conf:

[iis_w3c_default]
DELIMS = " "
FIELDS = "date", "time", "cs-method", "cs-uri-stem", "cs-uri-query", "cs-username", "c-ip", "cs-version", "cs(User-Agent)", "cs(Referer)", "sc-status", "sc-bytes"

But using ths as a sourcetype failed to extract any meaningful fields.

I guess I just don't grasp everything that Splunk is doing...

Once i have this working, I plan on reindexing all of my data with the new fields (which will be an ordeal in-and-of-itself).

I really, really want to like Splunk but configuration is just too wonky...