How to analyse IIS logs using LogParser / LogParser Studio

In a previous blog article I've detailed how to analyse IIS Logs using Excel. However, when you get very huge logs or when you want to automate this operation, Excel is not the best way to do. It's where LogParser 2.2 takes over. It allows you to parse any kind of logs (IIS, HTTPErr, Event Logs…) using a programming language similar to SQL. LogParser 2.2 is great but you just get the command-line tool and then… You've got to find the queries yourself.

Of course, many web sites on Internet are sharing LogParser requests like:
- …

Once you get all the queries you need, you can automate them by using a batch file or a PowerShell script.

However, when you start to use LogParser, it's not really easy to know how to look at what you want in the IIS Logs and sometimes, it's even difficult to know what to look at.
LogParser Studio is implementing several pre-built queries which is great to start or to give ideas to go further and develop your own queries.
Then you'll be able to copy those requests to use it directly with LogParser 2.2 using command-lines if you're not interested in the UI.

First of all, install LogParser Sutdio which is available here:
Then, launch it. You'll be able to see the Library tab with the pre-built queries:

Every entry that starts with IIS is, of course, to analyze IIS Logs. I'll show you an example using "IIS: Top 25 Slow URLs", however, don't hesitate to play with the other queries.

  • Add a log file to analyze:
    • Click on the fifth icons "Choose log files/folder to query"
    • Click on "Add Files" or "Add Folder" and select the IIS log file to analyze or the folder containing IIS logs
    • Click on OK


  • Select the rule to execute by double clicking on "IIS: Top 25 Slow URLs"
    • You should be able to see the detail of the LogParser query at the bottom of the window
  • Then, click on the red circle with the exclamation mark to execute the query. In few seconds you should see the results:


It's as simple as this.
Then, some nice features are included in LogParser Studio:

  • Automatically generate graphs from the results:

Just click on the Chart icons to generate a graph:


  • Export the query as a PowerShell script:


And more. Just have a look at this tool it's really great.

Once you'll be at ease with the tool and the queries, you'll surely want to develop your own queries.
Just press the New Query button and you'll be able to execute what you want:


To give you some ideas:

Sort out the entries between two specific times. Really useful when the log size is huge and you know when the issue occurred.
This will allow you to reduce the size of the data to analyze by only viewing data during a specific time:

Select TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS Timestamp, sc-status as Status, sc-substatus as Sub-Status, cs-method as Method, cs-uri-stem as URL, time-taken as Time-Taken FROM '[LOGFILEPATH]' where to_time(time) between timestamp('07:43:55','hh:mm:ss') and timestamp('07:44:21','hh:mm:ss') group by Timestamp, sc-status, sc-substatus, cs-method, cs-uri-stem, time-taken order by Timestamp, sc-status, sc-substatus, cs-uri-stem, time-taken asc

Sort out every error messages from the HTTPErr log file except the Timer_ConnectionIdle which is generally not an issue:
Select TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS Timestamp, c-ip, c-port, s-ip, s-port, cs-version, cs-method, cs-uri, sc-status, s-siteid, s-reason, s-queuename FROM '[LOGFILEPATH]' where s-reason <> 'Timer_ConnectionIdle'


In addition, LogParser can be used to detect or check if you're facing an attack.
The two following articles are very good articles to look at:
- DoS Attacks:
- Checking for intrusions:


I hope this article will be useful.
Sylvain Lecerf and the French Microsoft Support Team

Comments (16)
  1. BlueSky2010 says:

    Thank you – good summary!

  2. Michael says:

    Nice work thanks!

  3. Umar says:

    This is really good. Where and how i can run query manually like the one mentioned in your post? any other help full queries ?

    1. You can just go to the File > New > Query from the main window and this will open a new query window where you can write and execute the sample queries listed in the article.

  4. RK says:

    When i launch the Parser studio, i see loading library… and it stays like that for a while.

  5. Gordon says:


    Anything new about getteing fixed parsing logs from the Advanced Log module? Still not working.

    1. You should try using the Enhanced Logging feature from IIS 8.5 and above. This replaces the Advanced Logging module and provides a much more reliable way to log requests that the Advanced Logging module could have given you:

  6. vikas says:

    any clue how to know who stopped and started a particular service on windows 2008 server using LOG PARSER tool

    1. @Vikas: sorry, we don’t do a lot of event log parsing in the team, it is mostly IIS and stuff.

  7. bobba says:

    does not work for me

    1. What exactly does not work? The sample log parser queries or the Log Parser Studio UI itself? Can you provide an error message?

  8. lazer says:

    I would like to know how to parse the message from the below enterprise library text formatter log.If I use textline then it is not possible to view the timestamp of the message.

    Timestamp: 05/08/2014 20:17:19
    Message: “No Interface defined in the configuration! “::: at HUB.InterfaceManager.Core.InterfaceConfiguration.GetInterfaceDetailList(InterfaceConfiguration objInterfaceConfiguration) in D:\Workspace\Projects\Streetworks_BTP\Code\HUB.InterfaceManager.Core\InterfaceConfiguration.cs:line 334
    at HUB.StreetWorks.BusinessLogic.InterfaceLogic.GetInterfaceDetails() in D:\Workspace\Projects\Streetworks_BTP\Code\HUB.StreetWorks.BusinessLogic\InterfaceLogic.cs:line 392
    at HUB.StreetWorks.BusinessLogic.InterfaceLogic.ProcessInterface(String interfaceDetails) in D:\Workspace\Projects\Streetworks_BTP\Code\HUB.StreetWorks.BusinessLogic\InterfaceLogic.cs:line 71
    Machine: EGRWEB01T

    1. Not sure how you could go about doing this. As mentioned before, the log parsing we are doing with Log Parser Studio is for IIS logs

  9. karimSP says:

    useful tool

  10. pituach says:

    Nice tool but much simpler to execute do it directly with simple T-SQL queries. We can import the data with simple BULK INSERT queries or even use it directly and parse it using OPENROWSET.

    With that being said, again…
    This is sound like a very nice tool and very useful for home users (for more deep analyse I would recommend to import the data to a database).

    Thanks for sharing the tool 🙂

Comments are closed.

Skip to main content