Skip to content

Using Log Parser to analyse, view and export ISA logs in W3C format

2009/04/06
by
Here is the official description and download site:

Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows operating system such as the Event Log, the Registry, the file system, and Active Directory.

Download: http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en
Some more info about this tool in TechNet ScriptCenter:
Log Parser 2.2: http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx

This blog (http://www.codinghorror.com/blog/archives/000369.html) gives more explaination and examples, although most articles on the Internet are about analysing IIS logs, but it also applies to ISA W3C logs if this is the way you choose for your ISA logging.
I borrowed this picture from the blog:
Besides basic SQL queries, another thing you need to know is the fields of ISA logging, here is the official info:
 
If the command line is too hard for you, there are a couple visual tools – freeware that can do the better job for you:
These two visual tools are very helpful if you are looking at a relatively large query results, like thousands of access records from a 2GB log file.  However, both tools have a bug in getting the values of date and time, they add 12:00:00AM in the date field and a date in the time field (LogParser Lizard adds year 0001, and Virsual Logparser adds year 2001), which is not necessary and when exported to Excel, year 0001 will make the time field overflow.  I will report this to the author.
 
P.S. If you need a quick look at the SQL query, here are some reference sites:
 
That’s almost all I’ve got since last night.  Have fun!
No comments yet

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: