Search results matching tag 'COM programming'

Security event log flooded with 540/438 eventids when querying with LogParser

Dauhee — Thu, 20 Nov 2008 16:43:25 GMT

Hi all,

When querying event logs with COMEventLogInputContextClassClass, the security eventlog gets flooded with logon/off eventid's. For example If querying the Application log on Machine X, it appears there is a logon/off put into the Security log for every record pulled out of the Application lo:

Successful Network Logon:
    User Name:    xxx
    Domain:        xxx
    Logon ID:       (0x0,0x82461027)
    Logon Type:   3
    Logon Process:   NtLmSsp
    Authentication Package:   NTLM
    Workstation Name:    yyy

User Logoff:
     User Name:    xxx
     Domain:        xxx
     Logon ID:        (0x0,0x82461027)
     Logon Type:    3

I've tried a number of things but its driving me crazy! Any help would be much appreciated!

Dauhee.

COM+ Application Recycling Problems

maxblog — Wed, 22 Oct 2008 04:24:30 GMT

Hi All

I have configured a COM+ component (VB ActiveX DLL) on windows XP embeded to recyle itself after 2 days.

The problem is that COM+ destroys the old dllhost.exe which is fine but it does not spins up a second dllhost.exe to service the calls.

could you please help me why that would be and how to fix it.

Thanks in advance

inconsistent results when running query from command line and using com objects

mmendenhall — Wed, 01 Oct 2008 17:17:56 GMT

Hi,

I am trying to use logparser to monitor avg transaction times and transaction counts using a windows service but i get different results when running the queries from the command line and from my service. For example:

Running from the command line:

logparser "SELECT Count(*) FROM C:\WINDOWS\system32\LogFiles\W3SVC2\ex081001.log WHERE SUB(TO_INT(TO_TIME(SYSTEM_TIMESTAMP())),TO_INT(TO_TIME(time))) <= 300

gives me this output:

COUNT(ALL *)

------------
18

Statistics:
-----------
Elements processed: 62
Elements output: 1
Execution time: 0.00 seconds

Running from my service the following code:

string query = "SELECT Count(*) FROM " + FilePath + " WHERE SUB(TO_INT(TO_TIME(SYSTEM_TIMESTAMP())),TO_INT(TO_TIME(time))) <= 300";

                LogQueryClassClass oLogQuery = new LogQueryClassClass();

                COMIISW3CInputContextClassClass format = new COMIISW3CInputContextClassClass();

                COMNativeOutputContextClassClass outformat = new COMNativeOutputContextClassClass();

                oLogQuery.ExecuteBatch(query, format, outformat);

gives me this output:

COUNT(ALL *)
------------
62

It looks like for some reason it spits out the elements processed instead of the result of the query..

Any ideas? All help is greatly appreciated.

Re: how check Query syntax through code?

Anwarhusen — Thu, 15 May 2008 09:52:04 GMT

Thanks Bernard.

I am using LP COM with c# for Large CSV files. I have tested it for Around 8GB files with around 1,00,00,00,000 Rows(1 Billion).

Its Amazing......

Thanks

Anwarhusen

Input / Output problems

Narfix — Wed, 14 May 2008 14:13:01 GMT

Hello !

I've been trying to use the COM LogParser from VB6 but I encountered some difficulties...

I managed to query IIS log files without any problems but everytime I want to use an Input Format I get the following error :

"-2147024809 (80070057) : The specified input object is not a built-in Log Parser input format, nor a custom ILogParserInputContextCOM plugin [Incorrect parameter]."

I didn't register the dll from its original install directory. I tried with numerous examples from all over the internet with nearly all Input dlls but it just won't work...

What I am doing wrong ?

Thanks a lot !

how check Query syntax through code?

Anwarhusen — Tue, 13 May 2008 10:39:25 GMT

I am using LogParser Com Object through c#. Is there any way to check the syntax of query?

64 Bit Windows with 64 Bit .net 2.0 app and using 32 bit Logparser DLL

SrChasJC — Thu, 08 May 2008 14:21:26 GMT

Anyone have any way to do this? They say it can't be done:

Why 64-bit apps cannot load 32-bit Dll's & 32-bit apps load 64-bit Dll's

http://www.codeproject.com/KB/system/64BitOSAndPortingIssues.aspx

Freeware Custom LogParser Input - OLEDB (e.g. query Excel, Access, MSSQL etc)

gluegood — Wed, 23 Apr 2008 11:54:02 GMT

I've published a LogParser Custom COM plugin input format which allows you to query any OLEDB datasource and use the LogParser engine to run queries against it. Additionally allows you to query multiple datasources and I have implemented the native CheckPoint facility.

EXE and VB.NET 2005 source from Gluegood blog

Enjoy.

e.g. Sample queries

REM *** Excel ***
LogParser.exe -i:COM "select * From 'Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\Program Files\Microsoft Office\OFFICE11\SAMPLES\SOLVSAMP.XLS;Extended Properties=\"Excel 8.0;HDR=Yes;IMEX=1;\"'" -iProgId:Gluegood.LogParser.OLEDB -iCOMParams:iQuery="SELECT * FROM [Quick Tour$]" -o:DataGrid

REM *** MS-SQL Multiple Connections ***
LogParser.exe -i:COM "select * From 'Provider=SQLOLEDB;Server=SQLSERVER1;Database=DB1;Trusted_Connection=yes;', 'Provider=SQLOLEDB;Server=SQLSERVER2;Database=DB2;Trusted_Connection=yes;'" -iProgId:Gluegood.LogParser.OLEDB -iCOMParams:iQuery="Select * From Table",iCheckPoint="C:\CheckPointTest2.chk" -o:DataGrid

Having issues coming up with a way to store date and time separately in c# from an eventlog

Trike — Sun, 20 Apr 2008 05:35:18 GMT

I'll apologize first hand that i'm new to C# and programming in general.

What I am trying to build, is a benchmark console app that reads from an eventlog. Every time an event with a specific eventid is logged, is when the process has been finished.

What I'm doing currently is converting the TIMEGENERATED into a real type. I'm taking each event record and taking the difference from the next event record to get a processed time. My query looks like this.

@"SELECT ALL TO_REAL(TO_TIME(TimeGenerated)) FROM barcode.evt Where SourceName='Service' AND eventid=7";

I cycle through the record set and store each object into an array. Then I do the calculations in the array.

Currently I have a bug. This will only work for a single day. The query converts the time of each event to secs. Once I get to 12:00am of the next day. The conversion becomes 0secs. My results end up becoming a negative number.

Now, I have just about everything re-written in an attempt to store the time and date separately and do my calculations that way.

Where I'm running into a problem is how to split up the date and time in one pass. My original thought process was to take the TimeGenerated data from logparser and split it up after I pulled it out of the record set. But I don't know how to convert the TimeGenerated into date and time separately.

I'm not sure how to convert the timestamp data and split up the date and time after I have it in a separate array. And or I'm not structuring my query correctly. Currently this is what I have:

@"SELECT ALL TimeGenerated FROM barcode.evt Where SourceName='Service' AND eventid=7"

I'm not sure what the correct approach would be. I could loop through the record set again, with a different query, but that will create too much overhead. As I'll be dealing with around 100,000 records.

Another option would be to store the timestamp data into an array as a string then attempt to parse the time or date in the array, but I haven't thought this one through all the way and not sure how to implement this approach yet.

As I said earlier, I'm a beginner learning how to program in C#. Just looking for some direction on an approach to take. I've spent countless hours over the past few weeks putting this together, I feel I am very close

Any help is greatly appreciated.

Sorry for the very long post, I'm trying to be as detailed as I can.

Thank you!

Custom COM Input plugins - VB.NET 2005

gluegood — Sun, 16 Mar 2008 08:46:34 GMT

I've decided to write a few custom COM Input plugins for Log Parser. I haven't seen any samples available on the Internet so I firstly decided to convert the VBScript Log Parser sample SampleQFE to VB.NET. It is available here.

Additionally I had a go at a multiline Input plugin based on the Visual Source Safe (VSS) 6.0 Journal file. Bit more tricky and implements a iCheckPoint feature using serialization. It is available here.

All code is in VB.NET format and licensed under GNU v2.0 license.

Given there isn't a lot out there if anyone has any comments I'd appreciate some feedback. I'll continue building some more as time permits.

P.S. I've also noted some advanced Log Parser querying techniques.