Using LogParser to analyze the EVENTLOG.XML, Azure Websites

If you have an active Azure Web App and you experience problems or want to do some checks on what might the problem, there is a file called EVENTLOG.XML which contain exceptions and information that may be helpful.  The file is located in the /LogFiles directory on your Web App.  Figure 1 illustrates how that might look when using an FTP client tool like FileZilla.

Figure 1, EVENTLOG.XML file for an Azure Web Site

As this file can be large, you might consider using a tool like LOGPARSER to perform the analysis as manual analysis might cause your eyes to hurt J.  I wrote a troubleshooting article about this tool here, it focuses on IIS logs, but you can use it for checking XML files as well.

The selectable columns are:

  • Name
  • EventID
  • Level
  • Task
  • Keywords
  • ServerTime
  • EventRecordID
  • Channel
  • Computer
  • Data

An example LogParser query you can use is like the following, with the result shown in Figure 2.

LOGPARSER “SELECT Name, EventId, Count(*) FROM EVENTLOG.XML GROUP BY Name, EventId” i:xml

Figure 2, Analyzing Azure Web App EVENTLOG.XML file using LogParser

If you see an abundant number of exceptions in the file, you can then write another query to look at the data for these entries.  For example, a query to see what the Data is for all the ASP.NET entries where EventId = 1309, as shown below and in Figure 3.


Figure 3, Logparser query for Azure Web App EVENTLOG.XML file analysis

This can help isolate and ultimately find the reason for poor performance or unexpected performance on your Web App.

I use LogParser Lizard often to perform queries, which you can use in this context too.  Simply select XML Input Format as shown in Figure 4, and execute the same queries.

Figure 4, using LogParser Lizard to view Azure Web App EVENTLOG.XML logs




Comments (3)

  1. Anonymous says:

    Thanks for the Logparser tip. I'm finding i have to truncate the i=xml to avoid: Error: detected extra argument "i:xml" after query. Any thoughts?

  2. Hi Steve, do you get a similiar experience with using the command line LogParser queries?  I do not get this exception with using -i:xml for example.

  3. Olivier Albertini says:

    it's because you need to put -i:xml not i:xml