• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 72
  • Last Modified:

Recommend a Windows server log analyser

Hi Experts

Can you recommend a good (free) basic Windows Event log analyser
I am looking for something simple, to perform on demand analysis
I have a server which generated 25K event in 4 days and I would like to analyse the logs (possibly offline as the server itself is getting old and slow)

Any suggestion ?

Alexandre
0
Alexandre Michel
Asked:
Alexandre Michel
2 Solutions
 
Benjamin VoglarIT ProCommented:
Is it always the same Event ID?
0
 
bbaoIT ConsultantCommented:
always first try something official from MS: Log Parser 2.2, a SQL-like query engine for collecting logs from varied sources.

https://technet.microsoft.com/en-au/scriptcenter/dd919274.aspx
0
 
Alexandre MichelManager; IT ConsultantAuthor Commented:
Benjamin

No, it is not always the same event, there are lots of different event IDs

Bing,

Thanks for that. It looks promising. I will look into it.
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Alexandre MichelManager; IT ConsultantAuthor Commented:
Bing,

Log Parser 2.2 seems to be a Command Line based tool. Is that correct? Any GUI that you know of?
0
 
bbaoIT ConsultantCommented:
you are correct.

yeah, its GUI version is also available now: Log Parser Studio

https://gallery.technet.microsoft.com/Log-Parser-Studio-cd458765
0
 
DamjanCommented:
Hi,

you may also try  Event Log Consolidator tool from SolarWinds - http://www.solarwinds.com/free-tools/event-log-consolidator

It is an efficient tool (GUI) to help you organize event logs in SMBs.
0
 
Alexandre MichelManager; IT ConsultantAuthor Commented:
Damjan, thanks for the suggestion. I tried it ... but cannot get it to look at Windows "Application Event" logs. It seems to only look at the "File Replication Service" log for some reason...

Bing, the Log Parser studio looks great ... but ... I need to know SQL query to use it! Which I don't ... Luckily there are a number of samples I can use. This allowed me to create a first meaningful analysis
0
 
Alexandre MichelManager; IT ConsultantAuthor Commented:
Bing

Are you familiar with SQL & Log Parser or should I ask a new question?

I would like to modify this query to only use the last nn entries or the entries since xx (date & time)

SELECT SourceName, 
    BIT_AND(EventID, 0x3fffffff) as EventID, 
    EventTypeName, 
    COUNT(*) As Entries
    FROM APPLICATION
    GROUP BY SourceName, EventID, EventTypeName
ORDER BY Entries DESC

Open in new window

TimeGenerated is a date & time field from the Event Log (in my case in the form of "d/mm/yyyy hh:mm:ss PM"). Not sure how to restrict the count to TimeGeneated > now()-24 hours or something like that

Also is there a way to restrict the report to only items whose Count is > 100 ?
0
 
bbaoIT ConsultantCommented:
> restrict the count to TimeGeneated > now()-24 hours or something like that

just use WHERE clause. e.g. use WHERE TimeGenerated > '2016-08-08 00:00:00' to restrict events for today only.

> Also is there a way to restrict the report to only items whose Count is > 100 ?

use "SELECT TOP n" plus additional clauses as required to restrict the result to specific number or less. be aware that if used with GROUP BY on more than one field, it may cause additional fields not fully counted.

BTW, to get the benefits of Log Parser engine, you have to be familiar with SQL SELECT queries.
0
 
Alexandre MichelManager; IT ConsultantAuthor Commented:
Thanks for that Bing
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

Tackle projects and never again get stuck behind a technical roadblock.
Join Now