Logparser Scenario 5:Analyzing the IISlogs to see if there is any pattern for errors

  • Article

This blog entry is a continuation of the KB Article https://support.microsoft.com/?id=910447.

Scenario 5: Analyzing the IISlogs to see if there is any pattern for errors

A small background of the problem
You are using Microsoft Internet Information Services (IIS) 6, have a few Web sites, and you are using COM components in a lot of your webpages. Now, somehow you find that there are quite a few errors being reported by the users, say error #500 "Internal Server Error" . You might like to know if there is any pattern for that, like any specific pages, etc.

Answer: Open the Log Parser command window, and use the following command:

LOGPARSER -i:IISW3C file:C:\LPQ\FindErrorInIISLogFiles.sql -rtp:-1 -q:on

FindErrorInIISLogFiles.sql contains the following code...

SELECT
 COUNT(*) as [Count],
 cs-uri-stem,
 sc-status from
C:\ex060813.log
WHERE sc-status = 500
GROUP BY cs-uri-stem, sc-status
ORDER BY [Count] DESC

Sample output

Count cs-uri-stem              sc-status
----- ------------------------ ---------
28    /ru/Reporting.asp        500
20    /ru/CreateMail.asp       500

As can be seen, now we know the culprit and it is the pages listed above which we need to look at and fix! Here, -i:IISW3C signifies that we are querying the IIS W3C logs. You can view the complete list of IISW3C input format fields in the documentation and frame your query accordingly.

Cheers,
Rahul