Search results matching tag 'Log file format conversions'

Re: Can we parse Event description (Message) into only what we want? RESOLVED!!!

PatrickMc — Mon, 27 Jul 2009 21:25:08 GMT

Have you tried writing your own script for parsing logs exactly the way you want ? We often use biterscripting for that. There is a good example script posted at http://www.biterscripting.com/SS_WebLogParser.html to get you started.

Patrick

Maybe and answer: script for Firmware version/boot order

Old Time Coder — Wed, 18 Feb 2009 07:13:11 GMT

Well, WMI and WBEM are the M$ flavors (for MS OS's) of what you need the server side of the Desktop Management Interface http://en.wikipedia.org/wiki/Desktop_Management_Interface, but the godl mine of specifications is from the Distributed Management Task Force http://www.dmtf.org/home/ on their published documents page,

http://www.dmtf.org/standards/published_documents/

So, it is possible to do it. If you have a system that reports out a Configuration Management Database (CMDB) http://en.wikipedia.org/wiki/CMDB you might be able to suck in what's needed without building a whole lot of new code.

O.T.C.

Sample script to parse web logs

PatrickMc — Sun, 11 Jan 2009 18:54:17 GMT

There is a good sample of how to parse web logs at http://www.biterscripting.com/Download/SS_WebLogParser.txt . You can modify it to meet your requirements. I am a system admin and have been using a lot of variants of that script on a daily basis. Works on all Windows versions.

Patrick

inconsistent results when running query from command line and using com objects

mmendenhall — Wed, 01 Oct 2008 17:17:56 GMT

Hi,

I am trying to use logparser to monitor avg transaction times and transaction counts using a windows service but i get different results when running the queries from the command line and from my service. For example:

Running from the command line:

logparser "SELECT Count(*) FROM C:\WINDOWS\system32\LogFiles\W3SVC2\ex081001.log WHERE SUB(TO_INT(TO_TIME(SYSTEM_TIMESTAMP())),TO_INT(TO_TIME(time))) <= 300

gives me this output:

COUNT(ALL *)

------------
18

Statistics:
-----------
Elements processed: 62
Elements output: 1
Execution time: 0.00 seconds

Running from my service the following code:

string query = "SELECT Count(*) FROM " + FilePath + " WHERE SUB(TO_INT(TO_TIME(SYSTEM_TIMESTAMP())),TO_INT(TO_TIME(time))) <= 300";

                LogQueryClassClass oLogQuery = new LogQueryClassClass();

                COMIISW3CInputContextClassClass format = new COMIISW3CInputContextClassClass();

                COMNativeOutputContextClassClass outformat = new COMNativeOutputContextClassClass();

                oLogQuery.ExecuteBatch(query, format, outformat);

gives me this output:

COUNT(ALL *)
------------
62

It looks like for some reason it spits out the elements processed instead of the result of the query..

Any ideas? All help is greatly appreciated.

Need all SiteStatistics information

nirmalacygnus — Wed, 20 Feb 2008 12:29:42 GMT

Hi,

I creating site statistics tool.For that I have stored the log file information into Sql server database through ODBC logging Option in IIS.. I got date, time, ip, port,target,status,error status and also. But i need the brower,session,platform,robots,refferer information.. Can anyone help me?

Fusioncharts + logparser

jose_gisbert — Fri, 15 Feb 2008 11:29:52 GMT

Example:

0) Put Doughnut2D.swf + example.html + chart.bat + chart.tpl in a folder

1) example.html Code:

<html>
   <head>
      <title>My First FusionCharts</title>
   </head>
   <body bgcolor="#ffffff">
      <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=8,0,0,0" width="300" height="300" id="Column3D" >
         <param name="movie" value="Doughnut2D.swf" />
         <param name="FlashVars" value="&dataURL=data.xml">
         <param name="quality" value="high" />
         <embed src="Doughnut2D.swf" flashVars="&dataURL=Data.xml" quality="high" width="300" height="300" name="Column3D" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" />
      </object>

</body>
</html>

2) chart.tpl code like this, to format the XML source of FusionCharts:

3) chart.bat logparser code

logparser "select eventid, count(*) as total into data.xml from security group by eventid order by total DESC" -i:evt -o:tpl -tpl:chart.tpl

4) run chart.bat then view the results in chart.html . Fusioncharts i free to use, only insert a litle mark in your charts, but, they are greats.

Enjoy !

Re: problem with parent directory of my site

dimitrakopoulos — Wed, 03 Oct 2007 20:23:40 GMT

Can write any command to change my word documents,if yes which are these commands?

P.S: I don't want to change the attribute of the folder "files".

problem with parent directory of my site

dimitrakopoulos — Wed, 03 Oct 2007 15:07:51 GMT

Hello, i have a site and when you are writing www.example.com/files appears the files of my site which are word documents.

For example: www.example.com/files

Index of /files

Parent Directory

test1.doc

test2.doc

These word documents are uploading from other users and i trust them very much.I don't want to change the attribute of the folder "files".

I want to tell me what can make to my site someone "stranger" if understanding that my parent directory is "open".

Can write any command to change my word documents,if yes which are these commands?

Is very important for me to now what can make to me!!!

Thanks you a lot guys.

RE: Custom input format with field info on first line of log file

LogParser User : lvth — Wed, 06 Jun 2007 08:11:00 GMT

Thanks Glassdrum, but my problem was not how to skip header lines. I'm looking for a way to tell logparser how to decode the fields on the other lines based on the column info on the line 4 (last header).

Luigi

RE: Custom input format with field info on first line of log file

LogParser User : Glassdrum — Wed, 06 Jun 2007 00:02:00 GMT

I believe you should be able to use the -nSkiplines: switch to skip the header lines in your log file.