« Previous Next »

Thread: Parsing IIS 6 logs results - data missing from queries that is known to be in logfiles

Last post 01-19-2009 10:36 AM by Paul Lynch. 4 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (5 items)

Sort Posts:

Shortcuts

Search | Active Posts | Unanswered Posts | View all users

  • 07-31-2008, 12:30 PM

    Parsing IIS 6 logs results - data missing from queries that is known to be in logfiles

    Reply Contact

    I have attempted to search the forums to no avail.

    I have IISW3C logfiles from IIS 6 from an Exchange 2003 OWA Server that I need to do the following with:

    a) Find all instances where user DOMAIN\Adam logged in

    b) Find all instances of authentication to the server from the IP address DOMAIN\Adam logged in from

    When I attempt to query the logs using

    "c:\Program Files\Log Parser 2.2\LogParser.exe" -i:iisw3c -o:w3c "Select * into NewFile.log from .\ex*.log where cs-username like 'DOMAIN\Adam'"

    no results are found. I have examind the log files by hand and that value is in the cs-username field.

    Any suggestions or recommendations are welcome.

     
    Tags:

  • 07-31-2008, 4:10 PM In reply to

    • yellowdog.dave
    • Top 75 Contributor
    • Joined on 07-18-2008, 7:17 AM
    • Johannesburg, South Africa
    • Posts 84

    Re: Parsing IIS 6 logs results - data missing from queries that is known to be in logfiles

    Reply Contact

     Hi Tigger,

     Send me a mail and then we can get a snippet of your log file via email and I can take a look for you.

     Cheers, Dave 

    Yes, dear

  • 08-01-2008, 4:20 AM In reply to

    • swobi
    • Not Ranked
    • Joined on 04-06-2007, 8:03 PM
    • Posts 11

    Re: Parsing IIS 6 logs results - data missing from queries that is known to be in logfiles

    Reply Contact

    Hi!

     I think you either forgot the % sign in the like statement (like '%DOMAIN\Adam%') or
    you need to use ( = 'DOMAIN\Adam' ).

    Why do I think so? Cause it's an SQL mistake I often make ;-)

     bye
       swobi

  • 01-11-2009, 1:54 PM In reply to

    Sample script to parse web logs

    Reply Contact

     

    There is a good sample of how to parse web logs at http://www.biterscripting.com/Download/SS_WebLogParser.txt . You can modify it to meet your requirements. I am a system admin and have been using a lot of variants of that script on a daily basis. Works on all Windows versions.

     

    Patrick
    Tags:

  • 01-19-2009, 10:36 AM In reply to

    Re: Sample script to parse web logs

    Reply Contact

    Hi,

    This will do it :

    logparser.exe file:D:\iisnet.sql -i:IISW3C -o:csv

    where the file 'iisnet.sql' contains the following query :

    SELECT DISTINCT cs-username AS Users,c-ip AS IP
    INTO 'D:\iislogs\iisnet.csv'
    FROM 'D:\iislogs\*.log'
    WHERE cs-username='DOMAIN\Adam'

    Regards,
     

    Paul Lynch | www.iisadmin.co.uk
Page 1 of 1 (5 items)
Microsoft Communities