A simple example of Log Parser analyzing IIS log

Command example:

C: \ Program Files (x86) \ Log Parser 2.2>Logparser.exe-I: IISW3C "select time-taken as Duration from 'd: \ IIS Log Folder \ ex100817_6371.log 'order by time-taken desc"

 

Result returned:

Duration

--------

190971

154861

154861

145783

124642

124642

101876

99907

80547

77563

Press a key...

 

IIS log has the following columns:

# Fields:

Date

Time

S-sitename

S-ip

Cs-method

Cs-uri-stem

Cs-uri-query

S-port

Cs-username

C-ip

Cs (User-Agent)

Cs (Referer)

SC-status

SC-substatus

SC-bytes

Cs-bytes

Time-taken

 

Example Snip

==================

# Software: Microsoft Internet Information Services 7.5

# Version: 1.0

# Date: 2011-10-04 06:28:57

# Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs (User-Agent) SC-status SC-substatus sc-win32-status time-taken

06:28:57 fe80: 1587: 9a8b: df87: 50a % 17 GET/_ layouts/viewlsts. aspx BaseType = 0 80-fe80: 1587: 9a8b: df87: 50a % 17 Mozilla/4.0 + (compatible; + MSIE + 7.0; + Windows + NT + 6.1; + WOW64; + Trident/4.0; + SLCC2; +. NET + CLR + 2.0.50727; +. NET + CLR + 3.5.30729; +. NET + CLR + 3.0.30729; + InfoPath.3; + MS-RTC + LM + 8; +. NET4.0C; +. NET4.0E) 401 1 2148074254 26707

06:29:09 fe80: 1587: 9a8b: df87: 50a % 17 GET/_ layouts/viewlsts. aspx BaseType = 0 80-fe80: 1587: 9a8b: df87: 50a % 17 Mozilla/4.0 + (compatible; + MSIE + 7.0; + Windows + NT + 6.1; + WOW64; + Trident/4.0; + SLCC2; +. NET + CLR + 2.0.50727; +. NET + CLR + 3.5.30729; +. NET + CLR + 3.0.30729; + InfoPath.3; + MS-RTC + LM + 8; +. NET4.0C; +. NET4.0E) 401 1 2148074254 15

 

Formatted Version

================

Date

Time

Server IP Address

Method

URI Stem

URI Query

Server Port

User Name

Client IP Address

User Agent

HTTP Status

Protocol Substatus

Win32 Status

Time Taken

Date

Time

S-ip

Cs-method

Cs-uri-stem

Cs-uri-query

S-port

Cs-username

C-ip

Cs (User-Agent)

SC-status

SC-substatus

Sc-win32-status

Time-taken

2011-10-04

06:28:57

Fe80: 1587: 9a8b: df87: 50a % 17

GET

/_ Layouts/viewlsts. aspx

BaseType = 0

80

-

Fe80: 1587: 9a8b: df87: 50a % 17

Mozilla/4.0 + (compatible; + MSIE + 7.0; + Windows + NT + 6.1; + WOW64; + Trident/4.0; + SLCC2; +. NET + CLR + 2.0.50727; +. NET + CLR + 3.5.30729; +. NET + CLR + 3.0.30729; + InfoPath.3; + MS - RTC + LM + 8; +. NET4.0C; +. NET4.0E)

401

1

2148074254

26707

 

References:

Http://www.msexchange.org/tutorials/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html

W3C Extended Log File Format (IIS 6.0)

Http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/676400bc-8969-4aa7-851a-9319490a9bbb.mspx? Mfr = true