Examples of IIS log analysis by log parser

Command example:

C: \ Program Files (x86) \ log parser 2.2>Logparser.exe-I: iisw3c "Select time-taken as duration from 'd: \ IIS log Folder \ ex100817_6371.log 'order by time-taken DESC"

 

Result returned:

Duration
--------
190971
154861
154861
145783
124642
124642
101876
99907
80547
77563
Press a key...

 

 

Example snip

==================

# Software: Microsoft Internet Information Services 7.5
# Version: 1.0
# Date: 2011-10-04 06:28:57
# Fields: Date time s-ip cs-method CS-Uri-stem CS-Uri-query S-port CS-username C-ip cs (User-Agent) SC-status SC-substatus sc-win32-status time-taken
06:28:57 fe80: 1587: 9a8b: df87: 50a % 17 get/_ layouts/viewlsts. aspx basetype = 0 80-fe80: 1587: 9a8b: df87: 50a % 17 Mozilla/4.0 + (compatible; + MSIE + 7.0; + windows + nt + 6.1; + wow64; + Trident/4.0; + slcc2; +. net + CLR + 2.0.50727; +. net + CLR + 3.5.30729; +. net + CLR + 3.0.30729; + infopath.3; + MS-RTC + lm + 8; +. net4.0c; +. net4.0e) 401 1 2148074254 26707
06:29:09 fe80: 1587: 9a8b: df87: 50a % 17 get/_ layouts/viewlsts. aspx basetype = 0 80-fe80: 1587: 9a8b: df87: 50a % 17 Mozilla/4.0 + (compatible; + MSIE + 7.0; + windows + nt + 6.1; + wow64; + Trident/4.0; + slcc2; +. net + CLR + 2.0.50727; +. net + CLR + 3.5.30729; +. net + CLR + 3.0.30729; + infopath.3; + MS-RTC + lm + 8; +. net4.0c; +. net4.0e) 401 1 2148074254 15

 

Formatted version

================

Date

Time

Server IP Address

Method

Uri stem

URI query

Server Port

User Name

Client IP Address

User Agent

HTTP status

Protocol substatus

Win32 status

Time taken

date

time

S-IP

CS-method

CS-Uri-stem

CS-Uri-query

S-port

CS-username

C-IP

CS (User-Agent)

SC-status

SC-substatus

sc-win32-status

time-taken

2011-10-04

06:28:57

Fe80: 1587: 9a8b: df87: 50a % 17

Get

/_ Layouts/viewlsts. aspx

Basetype = 0

80

-

Fe80: 1587: 9a8b: df87: 50a % 17

Mozilla/4.0 + (compatible; + MSIE + 7.0; + Windows + nt + 6.1; + Wow64; + Trident/4.0; + Slcc2; +. NET + CLR + 2.0.50727; +. NET + CLR + 3.5.30729; +. NET + CLR + 3.0.30729; + Infopath.3; + MS - RTC + lm + 8; +. net4.0c; +. net4.0e)

401

1

2148074254

26707

 

Example update from 2011-10-07

C: \ Program Files (x86) \ log parser 2.2> logparser.exe-I: iisw3c "Select time-taken, CS-Uri-stem, date, time, s-IP from 'C: \ temp \ u_ex111005-2.log 'Where CS-Uri-stem like' %. aspx 'order by time-taken DESC"

 

References:

Http://www.msexchange.org/tutorials/Using-Logparser-Utility-Analyze-ExchangeIIS-Logs.html

W3C extended Log File Format (IIS 6.0)

Http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/676400bc-8969-4aa7-851a-9319490a9bbb.mspx? MFR = true