Solved

Recommend a Windows server log analyser

Posted on 2016-08-08
10
43 Views
Last Modified: 2016-08-09
Hi Experts

Can you recommend a good (free) basic Windows Event log analyser
I am looking for something simple, to perform on demand analysis
I have a server which generated 25K event in 4 days and I would like to analyse the logs (possibly offline as the server itself is getting old and slow)

Any suggestion ?

Alexandre
0
Comment
Question by:Alexandre Michel
10 Comments
 
LVL 12

Expert Comment

by:Benjamin Voglar
ID: 41746757
Is it always the same Event ID?
0
 
LVL 37

Expert Comment

by:Bing CISM / CISSP
ID: 41746786
always first try something official from MS: Log Parser 2.2, a SQL-like query engine for collecting logs from varied sources.

https://technet.microsoft.com/en-au/scriptcenter/dd919274.aspx
0
 
LVL 4

Author Comment

by:Alexandre Michel
ID: 41746804
Benjamin

No, it is not always the same event, there are lots of different event IDs

Bing,

Thanks for that. It looks promising. I will look into it.
0
 
LVL 4

Author Comment

by:Alexandre Michel
ID: 41747073
Bing,

Log Parser 2.2 seems to be a Command Line based tool. Is that correct? Any GUI that you know of?
0
 
LVL 37

Accepted Solution

by:
Bing CISM / CISSP earned 500 total points
ID: 41747116
you are correct.

yeah, its GUI version is also available now: Log Parser Studio

https://gallery.technet.microsoft.com/Log-Parser-Studio-cd458765
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 
LVL 10

Expert Comment

by:Damjan
ID: 41747172
Hi,

you may also try  Event Log Consolidator tool from SolarWinds - http://www.solarwinds.com/free-tools/event-log-consolidator

It is an efficient tool (GUI) to help you organize event logs in SMBs.
0
 
LVL 4

Author Comment

by:Alexandre Michel
ID: 41747224
Damjan, thanks for the suggestion. I tried it ... but cannot get it to look at Windows "Application Event" logs. It seems to only look at the "File Replication Service" log for some reason...

Bing, the Log Parser studio looks great ... but ... I need to know SQL query to use it! Which I don't ... Luckily there are a number of samples I can use. This allowed me to create a first meaningful analysis
0
 
LVL 4

Author Comment

by:Alexandre Michel
ID: 41747318
Bing

Are you familiar with SQL & Log Parser or should I ask a new question?

I would like to modify this query to only use the last nn entries or the entries since xx (date & time)

SELECT SourceName, 
    BIT_AND(EventID, 0x3fffffff) as EventID, 
    EventTypeName, 
    COUNT(*) As Entries
    FROM APPLICATION
    GROUP BY SourceName, EventID, EventTypeName
ORDER BY Entries DESC

Open in new window

TimeGenerated is a date & time field from the Event Log (in my case in the form of "d/mm/yyyy hh:mm:ss PM"). Not sure how to restrict the count to TimeGeneated > now()-24 hours or something like that

Also is there a way to restrict the report to only items whose Count is > 100 ?
0
 
LVL 37

Assisted Solution

by:Bing CISM / CISSP
Bing CISM / CISSP earned 500 total points
ID: 41747439
> restrict the count to TimeGeneated > now()-24 hours or something like that

just use WHERE clause. e.g. use WHERE TimeGenerated > '2016-08-08 00:00:00' to restrict events for today only.

> Also is there a way to restrict the report to only items whose Count is > 100 ?

use "SELECT TOP n" plus additional clauses as required to restrict the result to specific number or less. be aware that if used with GROUP BY on more than one field, it may cause additional fields not fully counted.

BTW, to get the benefits of Log Parser engine, you have to be familiar with SQL SELECT queries.
0
 
LVL 4

Author Closing Comment

by:Alexandre Michel
ID: 41749623
Thanks for that Bing
0

Featured Post

Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I will show you HOW TO: Perform a Physical to Virtual (P2V) Conversion the easy way from a computer backup (image).
How to record audio from input sources to your PC – connected devices, connected preamp to record vinyl discs, streaming media, that play through your audio card: Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 – both 32 bit & 64.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now