Recommend a Windows server log analyser

Posted on 2016-08-08
Last Modified: 2016-08-09
Hi Experts

Can you recommend a good (free) basic Windows Event log analyser
I am looking for something simple, to perform on demand analysis
I have a server which generated 25K event in 4 days and I would like to analyse the logs (possibly offline as the server itself is getting old and slow)

Any suggestion ?

Question by:Alexandre Michel
LVL 12

Expert Comment

by:Benjamin Voglar
ID: 41746757
Is it always the same Event ID?
LVL 37

Expert Comment

ID: 41746786
always first try something official from MS: Log Parser 2.2, a SQL-like query engine for collecting logs from varied sources.

Author Comment

by:Alexandre Michel
ID: 41746804

No, it is not always the same event, there are lots of different event IDs


Thanks for that. It looks promising. I will look into it.
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.


Author Comment

by:Alexandre Michel
ID: 41747073

Log Parser 2.2 seems to be a Command Line based tool. Is that correct? Any GUI that you know of?
LVL 37

Accepted Solution

bbao earned 500 total points
ID: 41747116
you are correct.

yeah, its GUI version is also available now: Log Parser Studio
LVL 10

Expert Comment

ID: 41747172

you may also try  Event Log Consolidator tool from SolarWinds -

It is an efficient tool (GUI) to help you organize event logs in SMBs.

Author Comment

by:Alexandre Michel
ID: 41747224
Damjan, thanks for the suggestion. I tried it ... but cannot get it to look at Windows "Application Event" logs. It seems to only look at the "File Replication Service" log for some reason...

Bing, the Log Parser studio looks great ... but ... I need to know SQL query to use it! Which I don't ... Luckily there are a number of samples I can use. This allowed me to create a first meaningful analysis

Author Comment

by:Alexandre Michel
ID: 41747318

Are you familiar with SQL & Log Parser or should I ask a new question?

I would like to modify this query to only use the last nn entries or the entries since xx (date & time)

SELECT SourceName, 
    BIT_AND(EventID, 0x3fffffff) as EventID, 
    COUNT(*) As Entries
    GROUP BY SourceName, EventID, EventTypeName

Open in new window

TimeGenerated is a date & time field from the Event Log (in my case in the form of "d/mm/yyyy hh:mm:ss PM"). Not sure how to restrict the count to TimeGeneated > now()-24 hours or something like that

Also is there a way to restrict the report to only items whose Count is > 100 ?
LVL 37

Assisted Solution

bbao earned 500 total points
ID: 41747439
> restrict the count to TimeGeneated > now()-24 hours or something like that

just use WHERE clause. e.g. use WHERE TimeGenerated > '2016-08-08 00:00:00' to restrict events for today only.

> Also is there a way to restrict the report to only items whose Count is > 100 ?

use "SELECT TOP n" plus additional clauses as required to restrict the result to specific number or less. be aware that if used with GROUP BY on more than one field, it may cause additional fields not fully counted.

BTW, to get the benefits of Log Parser engine, you have to be familiar with SQL SELECT queries.

Author Closing Comment

by:Alexandre Michel
ID: 41749623
Thanks for that Bing

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Create workstation base image 4 36
changing harddisk on computer in corporate 10 43
PerfMon Report Time Out 6 21
Windows Password recovery 7 34
When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
How to record audio from input sources to your PC – connected devices, connected preamp to record vinyl discs, streaming media, that play through your audio card: Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 – both 32 bit & 64.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now