Category: Logparser

logparser -i:evt “select distinct Message INTO filename.csv from yourservernameApplication where Message Like ‘%http://yoursite.domain.com/Person.aspx?guid%’ ” -o:CSV

logparser -i:evt “select * from usatl01mw280Application order by TimeWritten desc”

logparser -i:evt “select TimeGenerated,EventID,EventTypeName,EventCategoryName,SourceName,Strings,Message from usatl01mw280Application” -o:datagrid

logparser -i:evt “select EventID,EventTypeName,EventCategoryName,SourceName,Strings,Message from usatl01mw280System” -o:datagrid

logparser -i:evt “select * from usatl01mw280System order by TimeWritten desc”

logparser “select distinct EventID,EventTypeName,Message from System” -o: datagrid

logparser “select distinct EventID, EventTypeName, Message, Count(*) as Entries from System group by EventID, Message, EventTypeName order by EventTypeName,

Entries DESC” -i:EVT -o:DATAGRID

C:WINDOWSsystem32LogFilesHTTPERR>logparser “select * from ‘httperr12.log'” –
i:httperr -o:datagrid

Courtesy of “A Developer Strayings” blog:

logparser “SELECT AVG(time-taken) As AverageTimeTaken, MAX(time-taken) As MaxTimeTaken, COUNT(*) As Hits, TO_LOWERCASE(cs-uri-stem) INTO %1 FROM *.log WHERE EXTRACT_EXTENSION(TO_LOWERCASE(cs-uri-stem)) = ‘%2’ GROUP BY cs-uri-stem ORDER BY AverageTimeTaken DESC” -i:IISW3C -RTP:-1

The output will look like this:

Statistics:
———–
Elements processed: 309751
Elements output: 0
Execution time: 1.45 seconds

After enabling the time-taken logfile attribute, you can view the longest-running pages (in milliseconds) by using a SQL query and LogParser:

logparser -o:DATAGRID “select cs-uri-stem,time-taken,cs-username fro
m ex080214.log where time-taken > 10000 order by time-taken”

This will return a datagrid where you can review the pages that took the longest, and troubleshoot them.