Search results matching tag 'input format'

Logparser 2.2

rlawson — Mon, 27 Apr 2009 15:12:52 GMT

If logparser 2.2 compatible with windows 2008/64bit? to see security .evt logs

I I am using logparser 2.2 and it was working perfect until the domain controllers were upgraded to windows 2008 64bit, now I get a file is corrupt.

Need help

Thanks

Parsing a Text file with no limters

advsecanalyst — Thu, 22 Jan 2009 23:24:58 GMT

What I would like to do is take the file below and parse it into a CVS file or excel. Is it possible with log parser?

I have a text file like this

***XX1234 X1234567 XX XXXXXXXX 1

Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text Text.

Query issues with Null field value in TSV format...

yesubabu — Thu, 25 Sep 2008 07:48:39 GMT

Hello:

I have an issue in querying TSV format data files with some fields having nulls (no-data). The issue here is that logparser is considering the subsequent field value for the current field and messing up the data format.

Please verify the query, sampledata and output pasted below to see the problem. Can anyone help with the workaround or fix to this issue?

Appreciate your help!

Regards,
Yesu

Query: logparser -i:tsv -o:tsv -q:on "select a,b,c,d from c:\sampledata.txt"

SampleData:

A	B	C	D
1	2	3	4
11		13	14
21	22	23	24
31			34
41	42	43	44

Output:

A	B	C	D
1	2	3	4
11	13	14
21	22	23	24
31	34
41	42	43	44

Custom Log File unknown format

akentanaka — Thu, 11 Sep 2008 08:48:48 GMT

Hi,

I have no luck with the log that I'm trying to parse. I'm new to this world of log parsing and my initial thought to parse our custom log (below) is to use TSV but I can't seem to understand how EXTRACT_TOKEN works.

Below is a sample of our log file.

10 Sep 2008 03:09:46,571 [Current Time=Wed Sep 10 03:09:46 BST 2008] [Process Name=:Module1:Module-Utilities:Utilities1:MyAlerts] [Root Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509] [Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509]
An error occurred that triggered compensation:
Summary: Execution failed.

Caused by:
   Summary: no peer with a running instance of WorkFlowAnalyzer found
10 Sep 2008 03:09:46,571 [Current Time=Wed Sep 10 03:09:46 BST 2008] [Process Name=:Module1:Module-Utilities:Utilities1:MyAlerts:Module[3]:SubModule[2]:Utilities:MyModule[7]] [Root Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509] [Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509]
The process started.
10 Sep 2008 03:09:46,571 [Current Time=Wed Sep 10 03:09:46 BST 2008] [Process Name=:Module1:Module-Utilities:Utilities1:MyAlerts] [Root Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509] [Job Id=2ad6505aff2ebcfa:182fe42d:11c4132e476:-80002-1221012586509]
Adapter request
[adapter request=
<request-data>
<my-action>
    <fields>
      <field>Description</field>
      <field>Detailed_Description</field>
      <field>Reported Source</field>
      <field>Requester Full Name</field>
    </fields>
</my-action>
</request-data>]

It appears that it has 6 parts

1) The date part

2) [Current Time=

3) [Process Name=

4) [Root Job Id=

5) [Job Id=

6) Log message

How can I break the log into 6 columns? I might use Log Parser Lizard to analyze the log file.

Thanks for your help!

EVT Log Corrupted or Being Used By Another Process

hullflyer — Thu, 26 Jun 2008 18:35:59 GMT

Relatively new to log parser (v 2.2). Have ASP pages running fine to query IIS web logs. Now trying to get one to report on Event logs, but can't figure out how to get around access errors. When I set the path to the actual event log file, I get:

CLogQueryClass error '80070020' [The process cannot access the file because it is being used by another process.]

The script that results in that error (vbscript in asp page):

pathVar = "c:\WINDOWS\system32\config\SysEvent.evt"
fileQry = "SELECT * FROM "&pathVar
set logQuery = server.createobject("MSUtil.LogQuery")
set EVT = Server.CreateObject("MSUtil.LogQuery.EventLogInputFormat")
set recordSet = logQuery.Execute(fileQry,EVT)

I made sure the pathVar is right and I set permissions on that folder to allow everyone full control, and it still gives the same error. So, thinking that it's a file sharing violation, I set up a script to copy that file to a new one in the same folder. Now that gives a new error:

CLogQueryClass error '800705dc' [The event log file is corrupted.]

The script that results in this new error is:

pathVar = "c:\WINDOWS\system32\config\SysEvent.evt"
dim fso
set fso = server.createobject("Scripting.FileSystemObject")
dim txtPath
txtPath = "C:\WINDOWS\system32\config\MyEvent2.evt"
fso.CopyFile pathVar,txtPath
fileQry = "SELECT * FROM '"&txtPath&"' '"
set logQuery = server.createobject("MSUtil.LogQuery")
set EVT = Server.CreateObject("MSUtil.LogQuery.EventLogInputFormat")
set recordSet = logQuery.Execute(fileQry,EVT)

I double checked and I can open that original event log in the WMI Event Viewer just fine, so the original file being copied appears to be good. The new file MyEvent2.evt is there and the same size as the original.

Both errors are the same regardless of which event log file I specify.

There is surprisingly little in the book or on the web about webifying log parser, especially in vbscript. Any ideas what I'm doing wrong? Is there a different input format I s/b using for asp?