Hi there,
we are looking to do some analysis of Vault Server traffic patterns. We can certainly generate traffic in the lab using simulated user workflows, etc, but that's just ... fake and unsatisfying. We'd much rather get a picture of what's going on in the real world.
Now for the "ask": I am hoping the community here would be willing to share with us some IIS logs from production ADMS servers. These logs don't contain any Vault data, just facts about Vault API calls. Be aware that these logs can contain IP addresses from your network and some Vault-related metadata (vault name, numeric user id, etc). This doesn't seem like super-secret stuff, but I wanted you to be aware of this. See example at the end of this message.
If you are willing to share these logs with us:
1. Please DM me and let me know - I'll give you a location to put the logs
2. Configure your IIS server so that logs contain all the fields highlighted in this image
3. Note the date and time when you did this, come back a week or so later, collect all the log files for the last ~ week and ship them to us
Thank you in advance!
Oleg
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2019-08-20 00:00:26 1.2.3.4 POST /AutodeskDM/Services/Filestore/v23/AuthService.svc - 80 - 1.2.3.4 - - 200 0 0 1043 1027 15
2019-08-17 00:01:48 1.2.3.4 POST /AutodeskDM/Services/v23/DocumentService.svc op=GetFolderRoot&uid=1234&vaultName=myvault&sessID=4321&app=I 80 - 1.2.3.4 - - 200 0 0 1126 1301 62
