Command example:
C: \ Program Files (x86) \ log parser 2.2>Logparser.exe-I: iisw3c "Select time-taken as duration from 'd: \ IIS log Folder \ ex100817_6371.log 'order by time-taken DESC"
Result returned:
Duration
--------
190971
154861
154861
145783
124642
124642
101876
99907
80547
77563
Press a key...
Example snip
==================
# Software: Microsoft Internet Information Services 7.5
# Version: 1.0
# Date: 2011-10-04 06:28:57
# Fields: Date time s-ip cs-method CS-Uri-stem CS-Uri-query S-port CS-username C-ip cs (User-Agent) SC-status SC-substatus sc-win32-status time-taken
06:28:57 fe80: 1587: 9a8b: df87: 50a % 17 get/_ layouts/viewlsts. aspx basetype = 0 80-fe80: 1587: 9a8b: df87: 50a % 17 Mozilla/4.0 + (compatible; + MSIE + 7.0; + windows + nt + 6.1; + wow64; + Trident/4.0; + slcc2; +. net + CLR + 2.0.50727; +. net + CLR + 3.5.30729; +. net + CLR + 3.0.30729; + infopath.3; + MS-RTC + lm + 8; +. net4.0c; +. net4.0e) 401 1 2148074254 26707
06:29:09 fe80: 1587: 9a8b: df87: 50a % 17 get/_ layouts/viewlsts. aspx basetype = 0 80-fe80: 1587: 9a8b: df87: 50a % 17 Mozilla/4.0 + (compatible; + MSIE + 7.0; + windows + nt + 6.1; + wow64; + Trident/4.0; + slcc2; +. net + CLR + 2.0.50727; +. net + CLR + 3.5.30729; +. net + CLR + 3.0.30729; + infopath.3; + MS-RTC + lm + 8; +. net4.0c; +. net4.0e) 401 1 2148074254 15
Formatted version
================
Date |
Time |
Server IP Address |
Method |
Uri stem |
URI query |
Server Port |
User Name |
Client IP Address |
User Agent |
HTTP status |
Protocol substatus |
Win32 status |
Time taken |
date |
time |
S-IP |
CS-method |
CS-Uri-stem |
CS-Uri-query |
S-port |
CS-username |
C-IP |
CS (User-Agent) |
SC-status |
SC-substatus |
sc-win32-status |
time-taken |
2011-10-04 |
06:28:57 |
Fe80: 1587: 9a8b: df87: 50a % 17 |
Get |
/_ Layouts/viewlsts. aspx |
Basetype = 0 |
80 |
- |
Fe80: 1587: 9a8b: df87: 50a % 17 |
Mozilla/4.0 + (compatible; + MSIE + 7.0; + Windows + nt + 6.1; + Wow64; + Trident/4.0; + Slcc2; +. NET + CLR + 2.0.50727; +. NET + CLR + 3.5.30729; +. NET + CLR + 3.0.30729; + Infopath.3; + MS - RTC + lm + 8; +. net4.0c; +. net4.0e) |
401 |
1 |
2148074254 |
26707 |
Example update from 2011-10-07
C: \ Program Files (x86) \ log parser 2.2> logparser.exe-I: iisw3c "Select time-taken, CS-Uri-stem, date, time, s-IP from 'C: \ temp \ u_ex111005-2.log 'Where CS-Uri-stem like' %. aspx 'order by time-taken DESC"
References:
Http://www.msexchange.org/tutorials/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html
W3C extended Log File Format (IIS 6.0)
Http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/676400bc-8969-4aa7-851a-9319490a9bbb.mspx? MFR = true