Log Parser Queries
Search for total number of static files that were requested:
LOGPARSER "SELECT count(*) as hits, sc-status, cs-uri-stem from
LOGPARSER "SELECT count(*) as hits from
</font>
</p>
LOGPARSER "SELECT count(*) as hits, sc-status from
</font>
Adding the requested resource (cs-uri-stem) to the above query:
LOGPARSER "SELECT count(*) as hits, sc-status, cs-uri-stem from
LOGPARSER "SELECT count(*) as hits, c-ip, cs-host, sc-status from
</font>
Client IP that requested most no. of times:
</p>
LOGPARSER "SELECT count(*) as hits, c-ip, cs-host, sc-status from
</font>
Searching for specific HTTP Response Code:
</p>
LOGPARSER "SELECT count(*) as hits, sc-status, cs-uri-stem from
</font>
Counting the No. of file extensions requested:
</p>
LOGPARSER "SELECT count(*) as hits from
</font>
Dumping out details for a specific file type:
</p>
LOGPARSER "SELECT count(*) as hits, cs-uri-stem from
</font>
NOTE: Replace
LOGPARSER "SELECT count(*) as hits from C:\Logs\ex101003" -i:IISW3C -o:DataGrid -q:off
Alternatively, you can run this query on all the files within the folder using a wild-card:
LOGPARSER "SELECT count(*) as hits from C:\Logs\ex*" -i:IISW3C -o:DataGrid -q:off
As you can see we can write more flexible queries to extract further information.
I will be publishing more in future when I get time.
More Information:
Log Parser Forum: http://forums.iis.net/default.aspx?GroupID=51
KB Article on Log Parser: http://support.microsoft.com/kb/910447.
More on Log Parser by Rahul Soni: http://blogs.msdn.com/b/rahulso/archive/category/14624.aspx
Log Parser Examples: http://technet.microsoft.com/en-us/library/ee692659.aspx
Forensic Log Parsing with Microsoft’s Log Parser: http://www.symantec.com/connect/articles/forensic-log-parsing-microsofts-logparser
|