Microsoft Log Parser Beginners Guide

Feb 4, 2011, 5:12 AM -06:00

Log Parser 2.2 is a free command line tool available from Microsoft. It provides universal query access to text-based data such as log files, XML files, and CSV files. It also can query Windows system data sources such as the Event Log, the Registry, the file system, Active Directory, and NetMon captures. You can pick the information you want returned in the results and those results can be sent to a text file, SQL Server, or SYSLOG. This tool basically reads your log files and lets you query them as if they were in a SQL Server database. It is also light weight at only 1.4 MB download.

The possible uses for the Log Parser are endless, but I use is specifically for querying IIS logs when trouble shooting problems. For example, using this tool makes it easy to find all the requests made by a specific signed in user. Since this application is ran at the command like it can take a little time to get your query right, but after you get it working you can add the commands to a .bat file for future reference or scheduled tasks. Here are some examples: [more]

Search IIS Logs for User Requests
Here is an example batch file that when run searches a directory of IIS log files for all requests made by users signed in with a username ending in “@example.com” and saves the results to a text file:
cd "C:\Program Files\Log Parser 2.2\"
logparser.exe "select logrow, date, time, c-ip, cs-username, cs-method, cs-uri-stem, cs-uri-query from ‘< your log directory path>\*.*’ where cs-username like '%%@example.com%%' order by date, time, logrow" -i:IISW3C -rtp:-1 > c:\temp\example-requests.txt

Search IIS Logs for Most Download Files
cd "C:\Program Files\Log Parser 2.2\"
logparser.exe " SELECT TOP 10 cs-uri-stem, count(*) as Downloads FROM ' from <your log directory path>\*.*' GROUP BY cs-uri-stem ORDER BY Downloads DESC" -i:IISW3C > c:\temp\most-downloaded.txt

Find 10 Largest Files in a Directory or Subdirectory
cd "C:\Program Files\Log Parser 2.2\"
logparser.exe " SELECT TOP 10 Path, Name, Size, Attributes FROM 'C:\Program Files\*.*' ORDER BY Size DESC" -i:FS –Recurse:-1 > c:\temp\10-largest-program-files.txt

Get Number of Outbound Emails from Exchange
logparser.exe "SELECT connector-id, client-hostname, COUNT(*) AS Total INTO c:\temp\outbound-email-totals.csv FROM '<log file directory>\MSG*.log,<another log file directory>\MSG*.log' WHERE connector-id LIKE '%outbound' OR connector-id LIKE '%to Internet' GROUP BY client-hostname,connector-id WITH Rollup" -i:CSV -nSkipLines:4 -o:csv

This is a very flexible tool. There are tons of parameters that control how the application functions and the number of different queries you could write is only limited by your imagination. I’ve found the best way to get started using it is to look at examples and there is a “Samples” folder included in the install directory that is helpful.

General Exchange Lob Parser IIS