asked on

LogParser and examples on the web

Hello,

I'm looking at different pages on the web which discussing Log Parser where they share useful examples on how to query an IIS log file using LogParser.

Currently, I am using logparser 2.2 in Windows powershell yet logparser complains about some of its own example or syntax.

In this case I'm facing an issue which doesn't return an error or any warnning at:

http://blogs.msdn.com/b/carlosag/archive/2010/03/25/analyze-your-iis-log-files-favorite-log-parser-queries.aspx

Number of Hits per Client IP, including a Reverse DNS lookup (SLOW). I thought SLOW means it would take few minutes but nothing comes out of this command.

LogParser.exe -i:W3C "Query-From-The-Table-Below" -o:CSV

SELECT c-ip As Machine,  
        REVERSEDNS(c-ip) As Name,  
        COUNT(*) As Hits  
 FROM c:\inetpub\logs\LogFiles\W3SVC1\*  
 GROUP BY Machine ORDER BY Hits DESC

Open in new window

so I run following command:

.\Logparser.exe  "SELECT c-ip As Machine,  
        REVERSEDNS(c-ip) As Name,  
        COUNT(*) As Hits  
 FROM c:\inetpub\logs\LogFiles\W3SVC1\*  
 GROUP BY Machine ORDER BY Hits DESC"  -i:W3C -o:CSV

Open in new window

It doesn't throw a message it just it stays on screen forever.

Am I missing something here?

Please advise.

Thanks.

ASKER CERTIFIED SOLUTION

Dan McFadden

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

akohan

ASKER

Thank you Dan!
So from what I understand it is OK to query the IIS log files directly rather than copying them in a specific folder/path and run a query on it. Right?

akohan

ASKER

Good tips.

Dan McFadden

I tend to move the logs before I process them. This does 2 things:

1. prevents the logs from using too much space on the volumes where they are saved
2. when querying them, the web server does not have to support the added pressure of serving up the files to the process that is accessing the logs

So, to save space and to not consume too much server resources, I move my logs.

If the web server does not have a lot of activity, then it is less of an issue. If the web server (and sites) are very active, then I would never directly query the logs.

Dan