Log Parser Studio

Log Parser Studio is a utility that allows you to search through and create reports from your IIS, Event, EXADB and others types of logs. It builds on top of Log Parser 2.2 and has a full user interface for easy creation and management of related SQL queries.

LPSV2.D2.zip
 
 
 
 
 
4.6 Star
(138)
303,786 times
Add to favorites
Exchange
12/12/2014
E-mail Twitter del.icio.us Digg Facebook
Sign in to ask a question


  • Exported logs to third server
    2 Posts | Last post December 11, 2013
    • I have been using LPS, but  when I ran a query the EventCategoryName and Message, return:
      	EventCategoryName
      	The name for category 4 in Source "MSSQLSERVER" cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer"
      	Message
      	The description for Event ID 18454 in Source "MSSQLSERVER" cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer
      I used the command wevtutil al application.evtx and put both file and the LocaleMetadata folder under LPS  log folder . But If I check with eventvwr the query return all the information. Are there another procedure to export log? Thanks for your help
    • Hi JuansH,
      
      This sounds like the event information needed is on the remote machine but not the machine you are running LPS from. You can confirm by opening the exported EVTX file in Windows Event Viewer on the local machine that you are running LPS on and see if you see the same message.
  • Hi Kary,
    2 Posts | Last post December 11, 2013
    • Log Parser Studio does not seem to support IIS Advanced Logging.
      
      Here an example query with Log Parser that does work:
      
      LogParser.exe "SELECT SUBSTR(s-sitename, 0, INDEX_OF(s-sitename, ',')) as [SITENAME], date, time, s-ip, sc-status FROM 'C:\LogFiles\DEFAULT WEB SITE\*.log' WHERE (sc-status >= '400' AND sc-status < '500') ORDER BY sc-status" -i:W3C -dQuotes ON -o:datagrid
      
      The Log Parser Studio has several issues with this.
      1. Does not allow W3C (wan't to use IIS methods)
      2. Does not allow dQuotes ON for the W3C filter
      
      Maybe an good idea to install IIS together with the Advanced Logging module to reproduce the issue and get it to work with the studio, unless you already got a quick fix that you can share here. :)
    • HI Joerg,
      
      The latest version supports IIS Advanced Logging:
      
      http://blogs.technet.com/b/karywa/archive/2013/12/11/log-parser-studio-v2-updated-12-11-2013.aspx
      
      http://gallery.technet.microsoft.com/Log-Parser-Studio-cd458765
  • EVTLOG: No results with a filter on certain SourceNames
    4 Posts | Last post December 11, 2013
    • LPS 2.0.0.100 does not return results when filtering an EVTLOG on a SourceName which contains 2 consecutive spaces/whitespace characters.
      
      select * from \\remoteserver\CustomAppLog where SourceName='Info: 228  somestring'
      
      The above returns values when using LogParser on the CLI (or Log Parser Lizard), however no results are found via LPS.
      The sourcename itself is copied from the source eventlog, and does show 2 consecutive spaces (unclear if a space or other whitespace character).
    • FYI,modifying the query to:
      
      select * from \\remoteserver\CustomAppLog where SourceName LIKE 'Info: 228%somestring'
      
      does return results in LPS. However, I'd like to avoid rewriting existing working queries... and using SQL pattern matches in the SourceName.
    • Hi Victor,
      
      This has been fixed in the latest version: http://gallery.technet.microsoft.com/Log-Parser-Studio-cd458765
    • Hi Oliver,
      
      I will check into this.
  • Working with TSVLOG
    8 Posts | Last post September 06, 2013
    • Hi guys,
      
      I have a problem:
      My log is a TSVLOG and separator is space. How I do in this case? In log parser command line I solved using -headerRow:OFF -iSeparator:space, but I don't saw this option in LPS.
      
      Thanks
    • Hi Navlig,
      
      Let me review the code and I will reply back to this question with my findings.
      
      Thanks,
      
      Kary
    • Hi Navlig,
      
      Following up as promised; these options should be available in an upcoming update.
      
      Thanks
    • I am looking forward to this update as I also have TraceLogs that are delimited by a "|" with no header.  This will be a very welcome update!
    • Great GUI for a great product! Any idea on when the next update will be made available and if these powerful features (switches) that are available in raw LP queries become part of the LPS GUI? Switches that allow custom spaces, separators, skipping lines etc. would allow exploiting full capabilities of LP in the LPS product.
    • Looks like I clicked "Answer this question" for the wrong question. :) Here it is again just to get it in the right location:
      
      I just handed off the final bits a couple of days ago so I expect the updated EHLO article and the download file (on this page) to be updated with the latest version between today and Monday. I don't know the exact day so it could technically be later but that's my current guestimate at the moment. I will update this post if anything changes.
      
      There were a lot of bugs fixed and features expanded but all of you who really know how to push the limits will be key in helping me iron out anything I may have missed or regressed. :)
    • @exwhyz
      
      Preliminary support has been added to allow modifying all input and output formats (custom spaces, separators, skipping lines etc.). A word of caution that they are global to the format used instead of per query just as an FYI.
    • Log Parser Studio is great stuff!
  • syntax error
    3 Posts | Last post August 26, 2013
    • ---------------------------
      Log Parser Studio
      ---------------------------
      Error parsing query: SELECT clause: Syntax Error: unknown field '-number'.
      
      The closest match for input format 'CSV' is 'RowNumber'. [Record field does not exist.]
      
      New Query
      
      EXCHANGE_EXTENSIBLE
      ---------------------------
      OK   
      ---------------------------
      
      I am running:
      SELECT sequence-number FROM '[LOGFILEPATH]'
      
      
    • Hi Dave,
      
      What log are you querying, and I assume there is a column named sequence-number? That error is typically generated when LP can't find that header name in the log. So, either it is there and we need to tweak the log format or it isn't and we need to find out why. You can determine more by opening a new query and running it as-is which should return the field names for you so you can confirm. Or a query that returns zero records will show the fieldnames:
      
      SELECT TOP 0 * FROM '[LOGFILEPATH]'
    • Additionally, based on the error you might try wrapping the field name in brackets which I don't suspect should be required but they do have a purpose:
      
      SELECT [sequence-number] FROM '[LOGFILEPATH]'
      
      Concerning brackets in general, they can also be used to create user friendly field aliases with spaces etc. In other words this would fail...
      
      SELECT FirstName FROM '[LOGFILEPATH]' AS First Name
      
      This would work:
      
      SELECT FirstName FROM '[LOGFILEPATH]' AS [First Name]
  • Application Error
    2 Posts | Last post August 26, 2013
    • Hi, every time i try and run any query I get the following error:
      
      Backgroud thread error:one or more errors occurred.
      System.NullReferenceException: <InputFileFormatType>format returned null. The xml settings for this format may be corrupt or contain invalid entries.
      
      It looks like I am missing some xml files from my appdata folder, can you please advise?
    • I have only seen this happen on one other occasion and there was some issue with the OS blocking access to the user's appdata folder for the application (which should never happen incidentally). 
      
      The best way to determine if you just need the files rebuilt or the issue I just described you can click "Reset All Log Formats" in Options > Preferences. If this does not correct the issue then navigate to the following folder and see if there are any files contained within:
      
      C:\Users\YourUserName\AppData\Roaming\ExLPT\Log Parser Studio\Config
      
      
      If there are no files after resetting the formats, there is some permissions issue. If that is the case I'll investigate the other occurrence of this I'm already aware of and report back.
  • W3C logs cannot be read
    2 Posts | Last post August 26, 2013
    • I'm trying to use Log Parser Studio to read W3C logs obtained from a Windows Azure Web Site. When I try to run the query I get an error "unable to cast object of type 'IISW3CINProperties' to type 'W3CINProperties'.
      This also happens when trying to click the powershell export button.
      
      I have no problem opening and parsing WAWS log files in Log Parser Lizard.
      
      Please advice,
      Ido.
    • The error thinks you are trying to read W3C logs with an IISW3C log type or vice versa. You can choose the proper log type in the query window, so based on the above, change it to the other log type. Its possible Azure is using IIS extended logging but I don't remember the above error being the case when that happens.
  • Save list folder from Log File Manager
    3 Posts | Last post July 26, 2013
    • Hi!
      
      I have a lot of folder with log files in Log File Manager. How I can save this list?
      
      Thx
    • Hi Sergey,
      
      When Log File Manager is open, just choose File > Save and browse to the location you wish to save the file. It will save as *.FLD and you can use File > Load to load it at a later time. This is actually just an XML file as an FYI but we use FLD as to not be confusing with its real purpose.
    • Thanks for asking this question & providing solution for saving log files.
  • what is IIS_4xx?
    2 Posts | Last post July 11, 2013
    • Hi,
      
      I am running the top 20 users report (against exchange 2003 sp2 IIS logs) and it shows at the very top an entry that has no name, but if I scroll all the way over to the right it has all the hits listed under IIS_4xx, can anyone tell me what this means?
    • I'm not sure I know exactly which Top 20 Users query that is. Could it be ActiveSync Report [Top 20]?
      
      IIS_4xx means some form of an IIS 400 error was returned such as 400, 401 etc. The number in that column is the total number of times a 4xx error was returned to that user.
  • Any Chance as making project source code availalable?
    2 Posts | Last post June 25, 2013
    • Hey there log file detectives,
      
      I think so much of Log Parser Studio V1 and V2, I thought I would at least ask if the source code was available, so I could see how you got the .NET v4  working with COM. I also hope this project does not go the way of LogParser itself. I can't believe there is no 64-bit version :(.  Sometimes a unique niche utility or application comes along and does 20 or 50 things you have been doing on the command line for 10 years+. Even though I have written over 10M+ lines of T-SQL since 4.21 on OS/2, this was still not easy to learn, mostly, becuase the error messages rarely pinpointed the exact problems. However, I got over it and got up to speed creating some web-based Classic ASP/COM Apps that could tell the Google AdWords/PPC manager what clicks were coming to the website in almost real-time, what keywords came in what the Google cookie values were for Medium, Campaign, Keywords etc....all the good stuff if you are into Web  Analytics, PPC, SEO, SEM...the REAL kind, not the so called SEO pro's.
      
      I also think MS comment calling it a skunk-works code, or project, although meant to be a bit negative (for what-ever silly reason). IMHO this is a very high honor - like getting the US Medal of Freedom. I'm an avid military fan, so "skunk-works" is geek code for top-secret, super bad-ass technology getting created by some of the brightest minds and most clever engineers.  A very complementary term, as in Lockheed Skunk-works which brought us the SR-71 Blackbird, and Titanium thanks to the Russians during the height of the cold-war....sorry for the history factoid...I just can't help myself :)
      
      Regards
      --SteveMc
      
    • Hi Steve,
      
      The documentation in the LP 2.2 install folder has samples etc. which is what I used for LPS. If you need more info, let me know and I'll blog a short tutorial on how to access LP via .NET.
      
      Kary
41 - 50 of 68 Items