HI,

Thank you for your help.
But in the drop-down menu when configuring the connector there is no u_in*.log type.

Hey   did you follow steps in the guide already? 

https://community.microfocus.com/t5/ArcSight-Connectors/SmartConnector-for-Microsoft-Exchange-Message-Tracking-Log/ta-p/1588543

if you have any further issue, just call out for help.

<update> sorry... p 13 of the MicrosoftIISMultiServerConfig.pdf Shows basically the concept. You need to call runagentsetup to make the config change or connect via arcMC to the connector (if remote-Management is configured/ you run on an appliance) and then modify the parameters of the connector; no need to touch the agent.properties manually.

</update>

Cheers

Andreas

To support team

how we map X-Forwarded-For . what thas mean the maping:

Address source==> oneOf ( c-ip, X-Forwarded-For)  that is mean the field IIS msu called OneOf?

It is not obvious!

thanks to your helpd

As per , can you please make sure the documentation is clear that the log folder should NOT include W3SVC1, but be the parent folder.

Documentation and screenshot is misleading.