New random node showing as a hypen name???

lveitch

All,

So I have a new random node that appears and it has no connectors and just shows up using a hypen as its name.

When I try and search the historical records to see if I can find any events from this node, nothing appears.

I will admit there is a good chance I am missing the node in my searches but I have searched by the SourceMachine, DestinationMachine,InsertionIP, DestinationIP and nothing appears.

Can anyone help me to track down where this node is coming from or the logs associated to it so I can try and track down whats going on?

broeben

I had the same issue.  It turned out to be a node that had an IIS 10.0 connector enabled on it.   The connector was expecting fields that are not enabled by default in IIS.   This link shows how to adjust the fields in the IIS web site.   Just enable all the fields.

 https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis