LogParser 2.2 - Query Builder - Part 1

Microsoft has a wonderful tool for parsing csv or tab separated files and other log file formats. The tool, LogParser 2.2, uses SQL query statements to pull information from log files and can present the results in a variety of ways.

Below are a few examples of what a Log Parser query may look like. I work a lot with SharePoint, so the following examples will be to pull log details from SharePoint ULS logs and Event Viewer Application logs.

As you can see it looks very much like a regular SQL query and LogParser does implement many of the same features such as where clause, like conditions, group by clause and aggregate functions like count(*). You should check the LogParser help for more information on what is supported.

If you do find a limitation with the SQL syntax supported, LogParser allows you to dump the resulting data into a csv file or directly into a SQL table. It can auto generate the table and columns or push data into an existing table. This is a nice feature if you intend to look at the data in a variety of ways. Rather than run the LogParser query multiple times, which can be time consuming, you can run a full dump of the logs into a SQL table. Once the log data is in the SQL table you can use SQL to retrieve log reports in multiple ways.

As you can see from the example queries above the SQL syntax is fairly straight forward. What is less obvious and a bit more complicated to write is the from clause. Notice how the from clause contains references to computer names and share locations. This means in order use LogParser you must have access to the log locations. It also means you must specify the log file names you want to parse. This can be a pain to write every time you want to run a query as the file name changes often since they are regularly written with a time-stamp in the name. LogParser does allow for the wildcard character * to be used in referring to log files which helps, but the process of writing a query can be cumbersome and time consuming.

So, after researching some of the tools available that utilize LogParser I decided to bight the bullet and write my own small application that helps write these queries quickly with out remembering machine names and hand writing filenames based on time stamps.

Please read LogParser 2.2 - Query Builder - Part 2 for details regarding the application.