Search results matching tag 'ETW input format'

Selecting Server Event Log from Local machine

cci — Sat, 11 Apr 2009 14:14:03 GMT

This question has been asked before but not answered. I am an admin and would like to query the security log on our server from my workstation. Assuming the simplest

"SELECT * FROM SERVER,Security"

"SELECT * FROM \\Server\c$\windows\system32\config\SecEvents.evt"

I will get an error that the file is being used by another process. I saw the last person who asked this question just gave up, assuming it couldn't be done. So, is that true?

TIA, stan

Problems with time conversion in .etl log file

LogParser User : prunku — Wed, 10 Jan 2007 09:27:00 GMT

I had some trouble, but i fixed it. Please delete this post. sorry

vbs script works, but exact same query in c# doesn't

LogParser User : dalev — Thu, 09 Nov 2006 18:09:00 GMT

I have a custom ETW provider that I use to trace into log files along with selected IIS traces. When I perform the following query using COM interop via a vbs script, it works perfectly:

SELECT Timestamp, TO_STRING(Timestamp, 'HH:mm:ss.llnn') AS TimestampStr, ProcessID, ThreadID, ProviderGUID, EventNumber, EventType, EventTypeName, ContextId, AppPoolId, RequestURL, RequestVerb, HttpStatus, BytesSent, BytesReceived, TraceType, ClientRequestId, ServerRequestId, ServerAddress, UserContext, ServerOperation, ServerOperationData, ClientOperation, AuthType, AuthUserName
FROM 'C:\MyCasLog.etl'
WHERE ProviderGUID='{67c6e8e5-b62b-4f47-a04d-ecb487d00046}' OR
(ProviderGUID='{3a2a4e84-4c21-4981-ae10-3fda0d9b0f83}' AND (EventName='IISGeneral' AND (EventTypeName='GENERAL_REQUEST_START' OR EventTypeName='GENERAL_REQUEST_END')) OR (EventName='IISAuthentication' AND EventTypeName='AUTH_SUCCEEDED'))
ORDER BY TimestampStr, EventType, TraceType

Run the exact same query inside C# and it fails to pick up the events from my custom provider. However if I change the first line of the WHERE clause to refer to the provider name instead:

WHERE ProviderDescription='Microsoft Exchange Server 2007 Client Access Performance' OR

It works perfectly. This is a complete mystery to me.