New GUI tool for MS Log Parser, Log Parser Lizard

Article
2007-12-05

Question

_{Wednesday, December 5, 2007 7:10 AM}

Becouse the command-line interface for Microsoft Log Parser is not very intuitive, I have created Log Parser Lizard, a Microsoft Log Parser GUI tool for managing queries, exporting results to Excel, charts, etc… In addition I have added input filters for log4net file format and SQL server T-SQL queries.

You can download Log Parser Lizard from here www.lizardl.com

Microsoft.Net 2.0 is required.

All replies (108)

_{Monday, December 17, 2007 3:28 AM}

Ehemmm.... excuse me.... does anyon have tried the application? Any commnets....

_{Friday, December 21, 2007 7:58 AM}

Is this tool web based? I'm looking for something that is web based ...

_{Friday, December 21, 2007 8:26 AM}

Is this tool web based? I'm looking for something that is web based ...

No it is not web based, it is WinForms application based on .Net Framework 2.0. I dont know if there is web based solution for this.

_{Saturday, December 22, 2007 9:37 AM}

Nice to see some work being done for LP.

IMO, what we really need is a way to prompt the user for input.

_{Wednesday, December 26, 2007 8:47 AM}

IMO, what we really need is a way to prompt the user for input.

Did you mean something like this. If you, enter query like (for example) ‘select * from <1> where Date = (@MyDate as date)', when you run it, the program will show dialog box for entering parameter @MyDate and pass it to the LogParser? Or you have somethin else in mind?

_{Thursday, December 27, 2007 12:35 AM}

Great tool.

_{Monday, January 7, 2008 10:52 AM}

Looks nice, how do I point it at a server on the network? I'm looking to browse the SQL Server errorlogs and the event logs on a different box.

PS.

Small typing error under Help, should be Send Application Logs

_{Tuesday, January 8, 2008 6:09 AM}

Looks nice, how do I point it at a server on the network? I'm looking to browse the SQL Server errorlogs and the event logs on a different box.

for evet logs: just add server name

ex. select * from \APPSERVER\System

I'm not sure that you can parse SQL server error logs with MS Log Parser

_{Tuesday, January 8, 2008 11:14 AM}

Yes, it works for SQL Server errorlogs, set the input format to TEXTLINE and away you go. This gets around how slow Enterprise Manager is at opening the errorlogs and gives filtering and the ability to save the queries. A sample query is as follows:

select top 500 substr(text,0,22) as Date, substr(text,23,9) as Source, substr(text,32) as Message from '\server\C$\instance\log\ERRORLOG.*' where Message not like '%Log backed up%' and Message not like '%DBCC TRACEON%'
and Message not like '%Login failed%' and Message not like '%Database backed up%' and Message not like '%Database log truncated%'
and Message not like '%DBCC CHECKDB%'

Just what I need. The ability to use variables for server and instance above so I can point at any of my production servers would be good. I've also got the above select to work natively as TSV input:

logparser.exe. "select top 500 STRCAT(STRCAT(DATE,' '), TIME) as Date, Source, Message from '\server\C$\instance\log\ERRORLOG.*' where Message not like '%Log backed up%' and Message not like '%DBCC TRACEON%'
and Message not like '%Login failed%' and Message not like '%Database backed up%' and Message not like '%Database log truncated%'
and Message not like '%DBCC CHECKDB%' " -i:TSV -iseparator::spaces -iHeaderFile:c:\formatfile.txt -nskiplines:9

but when I open Queries.. and click on Properties... I get Exception has been thrown by the target of an invocation and then the values I enter don't get saved.

_{Tuesday, January 8, 2008 11:21 AM}

That should have said of course that when I try to set it up in Log Parser Lizard I get the error. It doesn't give the error on first entering the properties but it doesn't seem to save them and gives the errors on exit.

BTW, you give values of True and False for headerRow, Log Parser uses ON and OFF.

_{Tuesday, January 8, 2008 2:52 PM}

this looks like a nice tool. Unfortunately I keep getting "Attempted to read or write protected memory. This is often an indiction that other memory is corrupt."

_{Wednesday, January 9, 2008 4:28 AM}

Just what I need. The ability to use variables for server and instance above so I can point at any of my production servers would be good

I’m using log parser lizard mainly for statistics on IIS logs, event logs and active directory and for parsing log4net logs with regular expressions for system diagnostics. I don’t have much experience in parsing textline and tab separated files. But you can try to set ‘options’ in the query. Ex:

select top 500 substr(text,0,22) as Date, substr(text,23,9) as Source, substr(text,32) as Message from '\#SQLSERVER#\c$\INSTANCE#\LOG\ERRORLOG' where Message not like '%Log backed up%' and Message not like '%DBCC TRACEON%'and Message not like '%Login failed%' and Message not like '%Database backed up%' and Message not like '%Database log truncated%'and Message not like '%DBCC CHECKDB%'

and add SQLSERVER and INSTANCE in program options (on the toolbar).

Just That should have said of course that when I try to set it up in Log Parser Lizard I get the error. It doesn't give the error on first entering the properties but it doesn't seem to save them and gives the errors on exit

I can see that there are some issues and bugs when changing the type of a saved query and his properties :(, but I believe that there is workaround (delete the old query and copy-paste to the new one) until I fix them. Thank you for pointing them out. I will fix them as soon as possible.

this looks like a nice tool. Unfortunately I keep getting "Attempted to read or write protected memory. This is often an indiction that other memory is corrupt."

I am using LPL on a Win XP SP2 and Win 2003 Server. I very rarely have this kind of messages. Mainly when I am selecting groups from Active Directory with a lot of members and try to scroll up/down :(. Can you specify a bit more about conditions under which you have these messages?

Please don’t curse the programmer for the bugs.

_{Wednesday, January 9, 2008 1:35 PM}

I'm not sure what is happening on my end here. I receive that error when I try running even one of the basic queries (all .htm files) pointing to a local .log file which I copied over to my C:\

I hope you didn't misinterpret my feedback as being upset. I was just posting the error message in hopes that someone has come across this before and could help troubleshoot.

Looking forward to getting it working!

_{Friday, January 11, 2008 4:06 AM}

I’m also using Log Parser 2.2 (standalone installation, not the one that goes with IIS Resources kit).

_{Wednesday, May 21, 2008 11:10 AM}

I have created a small web site to support my products (includeing Log Parser Lizard).

Now you can find latest versions of Log Parser Lizard (GUI for MS Log Parser) on this link www.lizardl.com

Thank you all.

_{Saturday, May 24, 2008 5:23 PM}

Can't get the Lizard working on Server2008 x64. I have installed LogParser from MS (if that matters).

When I try to run the app I get the following...

Description:
Stopped working

Problem signature:
Problem Event Name:    APPCRASH
Application Name:    Log Parser Lizard.exe
Application Version:    1.0.0.0
Application Timestamp:    4756832e
Fault Module Name:    KERNEL32.dll
Fault Module Version:    6.0.6001.18000
Fault Module Timestamp:    4791ada5
Exception Code:    e0434f4d
Exception Offset:    000000000002649d
OS Version:    6.0.6001.2.1.0.272.7
Locale ID:    1033

Any suggestions?

_{Thursday, June 5, 2008 2:30 PM}

IMO, what we really need is a way to prompt the user for input.

Has anything like this been added by any chance? I really like the tool, but I need a way for my users to be asked for parameters or I may have to pass on using this great tool. Thanks in advance.

_{Wednesday, June 18, 2008 3:56 AM}

Has anything like this been added by any chance? I really like the tool, but I need a way for my users to be asked for parameters or I may have to pass on using this great tool. Thanks in advance.

This and some other features (like better GUI, more properties for graphs, query parameters...) will be added in the next release of the application (probably by the end of summer). If someone has some ideas and special needs please be free to contact me and I will see what can be done.

_{Wednesday, July 16, 2008 1:49 PM}

Hello,

I noticed that there is a pop-up query box that appears below the log entries in the GUI. Can this be used to modify the query on the fly for the log file? Not sure what it's pupose is and/or how to use it?

On that same note, is it possible to pull in an entire log and be able to filter the results as needed?

Thanks!

_{Wednesday, July 16, 2008 3:19 PM}

Scratch that. Just figured it out. New user and just installed today. Nice tool!

_{Thursday, July 17, 2008 10:08 AM}

Thanks for this tool. Just started using it. It comes in very handy. :)

I drop by some suggestions for the new version soon.

_{Friday, July 18, 2008 5:32 AM}

Again what a nice tool. Here is some feedback.

a) When you open a query up in the main generating window and then edit the query it does not refresh the setting.

Say a query is to look for a specfic IP address I run it ok if then I want to edit the query to look for anotehr IP address. Hitting 'generate' doesn't make run teh new query it runs the old (cached) one.

You need to close down the window and re-open the query. It is a real a pain.

Could you have the changes realtime please.

b) Change the display order of the queries and groups.

I cannot find a why to change the display order. I have have created several groups one for each webserver/farm. Now I want to more the display order of these. At the moment they are in the same order as generated. When I have many groups and queries within the groups this can look a little messy.

c) Copy setting for queries/groups

I want to be able to copy groups and queries. E.g. I have designed several a group with many queries and I want the same group but with me just editing a few settings like the logfiel location, etc a copy would make this soooo much easier.

Thanks for the default queries too there are a few nice ones in there. I intend a publishing several useful ones myself as I am creating a whole load of them for the support team to use.

_{Friday, July 18, 2008 7:06 AM}

Again what a nice tool. Here is some feedback.

a) When you open a query up in the main generating window and then edit the query it does not refresh the setting.

You need to close down the window and re-open the query. It is a real a pain.

Could you have the changes realtime please.

b) Change the display order of the queries and groups.

c) Copy setting for queries/groups

Thanks for the default queries too there are a few nice ones in there. I intend a publishing several useful ones myself as I am creating a whole load of them for the support team to use.

Hi, thnx for the compliment and feedback:

a) Did you change the query in the Popup Query Window (it appears in the bottom of the main Window) or from Queries dialog box (from toolbar)? If you changed it from the dialog box the changes won’t take effect immediately but on the next load of a query, but if you change it in the popup query window they should take effect temporarily, and generate results with new query parameters (if you want, you can save changes on the query). This is not a bug, it is a feature :)

b) and c) Hmmmm.... Oooook, I get it. I’ll put more query management options in the next release of Log Parser Lizard. Also it will be possible to change groups for a query and much much more ;) As a workaround try to manually edit Queries.xml (a file in an installation dir) with Notepad.

Any other feedbacks :) ?

_{Friday, July 18, 2008 10:01 AM}

Thanks for the reply.

a) Aha I see the query button for the popup now at the bottom of the main window - I missed that before. I was changing the 'query dialog box windows for all the queries) before and as you know that doesn't refresh. Even if I save the query it the 'query dialog box' still doesn't reflect the new values. I can reopen the 'query dialog box' and see the changes that have been made but hitting 'generate' does not reflect these changes.

It would be nice if it did though.

For b) above I was trying to do all the changes in the 'queries' window (titled Log Parser queries) I realise you can do reorder the individual queries in a group in the main window 'navigation' panels. So that is ok.

But ordering the groups.

And I thought you could do the ordering versions of the groups in the main navigate panel as there is a 'Navigate Pane Option' and in there is says 'Display buttons in this order' but.....it just has tick boxes. So it is not displaying buttons in this order just 'display these buttons'. You cannot 'order' them at all from what I can see. I just don't understand what this is for as you also have "Add or remove buttons" option that does the same thing as this but with a nicer GUI. *shrug*

A new one or two

d) This is trivial but I would like a simple counter in second when it is runnig the query so I know how long it has been running for. I could go on the status bar [input records:x, Output Records:x ; Rows in table:x; Querying runnig time: x and (running) or (completed) ]

So i know it is still running and I know how long a query takes to complete. I have several millions IIS log file rows a days for some farms.

e) Change the priority of Log Parser Lizard (I am going to call it LPL for short).

I don't know how easy this is to do but by defualt the LPL process runs on Normal Priority. When running a long queries it is slow and I cannot click on other windows/etc as it obviously takes up rtesources doing lots of work.

I was wondering if you could have an option of making LPL run in low priorty. Then I can do stuff.

I am a little worried about the effect on performance of the machine. I doubt it will do much but I feel more comfortable running it on Low priorty as my machines testing and staging servers (as they are the only ones that have access to the live production boxes logs through the firewall) are still used and I want them as responsive as possibel as log are not .

Cheers for this again. Don't worry about not getting feedback from me worry about getting too much! ;)

_{Monday, July 21, 2008 8:01 AM}

Great tool...I have used it for a bit now and it is really good...author is helpful as well! Thanks for sharing this tool with all of us.

_{Wednesday, September 3, 2008 4:07 AM}

Please try to use (work on web):

http://store.bamboosolutions.com/ps-95-5-system-log-manager.aspx

_{Tuesday, September 9, 2008 3:55 AM}

Hi, great tool and initiative. I could not get it to work though.

When I click on a button I get this error:

"Retrieving the COM class factory for component with CLSID {............ID.........} failed due to the following error: 80040154

Could you please help ?

Thanx in advance.

Angelos

_{Tuesday, September 9, 2008 4:16 AM}

Mm.. haven't try this GUI tool yet.
but did you got log parser installed in the box as well?

_{Thursday, September 11, 2008 11:29 AM}

I am have an error when trying to read my IIS logs. Conversion Type "DBNull" to type String is not Valid. I am sure I do not have something setup correctly but has anyone else seen this error? Thanks

_{Tuesday, September 16, 2008 7:12 PM}

I thought I will be coding in Perl to parse my custom logs (http://forums.iis.net/t/1151663.aspx). Since I dont have a clue in coding in Perl i tried other log4net trial and opensource apps to parse my logfiles. But nothing beats Log Parser Lizard.

The author is very friendly and accommodating too.

This is probably the only tool that I will be willing to pay for if it ever gets to donateware status. ^-^

LizardLabs, you rock !

_{Wednesday, September 17, 2008 10:11 AM}

Can Log Parser Lizard be used to browse IISW3C logs on other network servers? I can't seem to get the FROM syntax right.

_{Thursday, September 18, 2008 3:56 AM}

Can Log Parser Lizard be used to browse IISW3C logs on other network servers? I can't seem to get the FROM syntax right.

Just use “FROM \MyServer\LoggingShare\ex*.log” to parse logs from another server on a shared folder. LPL uses MS Log Parser engine and his query syntax. For more information refer to Log Parser Help and other posts on this great forum.

_{Thursday, September 18, 2008 4:16 PM}

Thank you. That definitely cleared things up for me. Love the tool by the way.

_{Monday, September 22, 2008 6:01 PM}

I can't get the program to start. I'm running on Win2003 x64. Is that why?

When I start the program, I see nothing (no window, no error message). "Log Parser Lizard.exe" shows in the Task Manager for a few seconds then disappears.

In the Event Logs I get a Dot-Net Runtime error:

"Faulting application log parser lizard.exe, version 1.0.0.0, stamp 48565da6, faulting module kernel32.dll, version 5.2.3790.4062, stamp 462643a7, debug? 0, fault address 0x000000000000dd10."

I have Dot-Net 2.0, sp1 installed, and LogParser 2.2. IIS is running in 64-bit mode.

Thanks!

_{Tuesday, September 23, 2008 5:12 AM}

I can't get the program to start. I'm running on Win2003 x64. Is that why?

When I start the program, I see nothing (no window, no error message). "Log Parser Lizard.exe" shows in the Task Manager for a few seconds then disappears.

In the Event Logs I get a Dot-Net Runtime error:

"Faulting application log parser lizard.exe, version 1.0.0.0, stamp 48565da6, faulting module kernel32.dll, version 5.2.3790.4062, stamp 462643a7, debug? 0, fault address 0x000000000000dd10."

I have Dot-Net 2.0, sp1 installed, and LogParser 2.2. IIS is running in 64-bit mode.

Thanks!

Log Parser Lizard should write all unhandled exceptions in log files located in \Program Files\LizardLabs\Log Parser Lizard\Logs. Please look there for more info or send the logs (if they exists) to me so I’ll take a look for a solution. I don’t have much of experience with Win 2k3 x64 but please try to reinstall Microsoft .Net framework 2.0 (and 1.1 if you can). Since LPL uses a lot of managed and unmanaged code maybe some of dependencies are broken and simple reinstall will fix them. I would also like to know if someone successfully uses LPL on 64 bit OS. Thnx.

_{Thursday, September 25, 2008 6:23 AM}

This is a nice tool.It should also include the help for using the LogParser Lizard application along with the help for LogParser2.2.

I have a question :If i have to pull deatils from a IIS log which in a different location(other than in the default location c:\windows\system\32\LogFiles\..) how can provide this in my query .

Eg:

SELECT Date
, QUANTIZE(time,300) AS [timeUTC] -- Group in 5 minute intervals
, SUM(CASE sc-status WHEN 200 THEN 1 ELSE 0 END) AS [S200] -- Count Successful hits
, SUM(CASE sc-status WHEN 500 THEN 1 ELSE 0 END) AS [S500] -- Count Server Errors hits
, AVG(time-taken) AS [AvgTime] -- Calculate the average response/processing time

FROM %LogFiles%

WHERE cs-uri-stem = '/sdccommon/lachat/poll/check.asp' -- The Chat Polling Page

GROUP BY Date
, QUANTIZE(time, 300)

ORDER BY QUANTIZE(time, 300)

_{Thursday, September 25, 2008 12:11 PM}

You just use the path c:\myfiles\logs*.* etc or the unc path \myserver\mydirectory\ etc

It uses the LogParser syntax for everything.

_{Monday, October 6, 2008 5:00 AM}

Hi to all. @akentanaka gave me this idea :) So... if what I created has benefited you in some way, please consider making a monetary donation to support my products. My guiding principle is that all of my free software should be freely available in their full form to everyone, so I won't hold it against you and cut some features if you don't donate, but I would appreciate it if you do. For more information on how-to-help please visit www.lizardl.com. Thnx.

_{Wednesday, October 15, 2008 7:19 PM}

Hello lizardlabs! Very good job with the Log Parser Lizard. Thank you! I have a question for you though. Running the program on XP SP3, I get the following message when trying to open a query from the left-hand pane:

2008-10-15 12:02:01,078 13390 [2424] ERROR LLABS - Exception: System.IO.FileNotFoundException
Message: Retrieving the COM class factory for component with CLSID {8CFEBA94-3FC2-45CA-B9A5-9EDACF704F66} failed due to the following error: 8007007e.
Source: Log Parser Lizard
   at LogParserLizard.LogParser..ctor()
   at LogParserLizard.frmLogReportBase..ctor()
   at LogParserLizard.frmLogReportCommand..ctor()
   at LogParserLizard.frmMain.OpenQueryForm(Int32 QueryId)
   at LogParserLizard.frmMain.UltraExplorerBar1_ItemClick(Object sender, ItemEventArgs e)

All versions of .NET are installed on the machine. Appreciate your time!

_{Thursday, October 16, 2008 5:01 AM}

Hi Edgar-the-Parser, maybe you have broken installation of MS Log Parser 2.2? Try to reinstall MS Log Parser 2.2 and see if it helps. Log Parser Lizard is using Log Parser COM API as a parsing engine, so if anyone get error messages like this "...bla-bla-bla COM class ... bla-bla ... CLSID {8CFEBA94-3FC2-45CA-B9A5-9EDACF704F66} ... bla-bla-bla..." on any kind of operation system (XP, Vista, Server 2008, etc...) or after an update or something, just try to reinstall MS Log Parser 2.2 and see if LPL works fine. If it still don’t work, maybe you should try something else (reinstall .Net 2.0, Log Parser itself, etc... :). Bye.

_{Thursday, October 16, 2008 11:55 AM}

Yes, that was it. I reinstalled the Log Parser 2.2 after which Lizard resumed working again. Thank you very much!

_{Monday, October 27, 2008 11:45 AM}

Hi, great tool and initiative. I could not get it to work though.

When I click on a button I get this error:

"Retrieving the COM class factory for component with CLSID {............ID.........} failed due to the following error: 80040154

Could you please help ?

Thanx in advance.

Angelos

I am getting the same error.. here is the log entry.

2008-10-27 11:38:38,572 47257 [3360] ERROR LLABS - Exception: System.Runtime.InteropServices.COMException
Message: Retrieving the COM class factory for component with CLSID {8CFEBA94-3FC2-45CA-B9A5-9EDACF704F66} failed due to the following error: 80040154.
Source: Log Parser Lizard
   at LogParserLizard.LogParser..ctor()
   at LogParserLizard.frmLogReportBase..ctor()
   at LogParserLizard.frmLogReportCommand..ctor()
   at LogParserLizard.frmMain.OpenQueryForm(Int32 QueryId)
   at LogParserLizard.frmMain.UltraExplorerBar1_ItemClick(Object sender, ItemEventArgs e)

anyone know what the issue may be?

thanks

EDIT: Nevermind guys, i figured out what was wrong

_{Thursday, November 6, 2008 4:05 AM}

I am using the GUI Log Parser tool from Lizardlabs.I would like to know how can i pass parameters to my query (IIS logs)?

in the command line log parser i give the file name as :

c:\program Files\Log Parser 2.2>LogParser -o:DATAGRID file:IAS-Chat_Transcript_from_IIS.sql?logfiles=G:\CustomerDocs\Symmantec\Latest_logs(Mar2008)\EX01_0302200
8to03032008\ex*+rooms='80cfa2f1-d863-44d2-a6b4-9ab32ae9b2ac'

Point to note from the above path:

1. IAS-Chat_Transcript_from_IIS.sql is the file that contains my query.

2.logfiles is my key constant or the parameter that gets replaced in the query written in the .sql file.

3.+rooms='80cfa2f1-d863-44d2-a6b4-9ab32ae9b2ac' is again another parameter that i pass to the query in IAS-Chat_Transcript_from_IIS.sql .So based in this parameter the query retrieves data related to room guid having the above mentioned values from [cs-uri-query] column of the IIS log.

I required to know how i can pass this +rooms='80cfa2f1-d863-44d2-a6b4-9ab32ae9b2ac' in the Log parser Lizard GUI tool?

Thanks for your help,

Regards,

Sunitha

_{Thursday, November 6, 2008 5:03 AM}

Hi sunutha. This qwee thing I don’t understand but for previous question, you can see if LPL “Options” will work for you. Create your query in LPL and create ‘option’ in the options dialog box (ex. ROOMS with value '80cfa2f1-d863-44d2-a6b4-9ab32ae9b2ac'), so you can modify your query something like this, “select * from ... where rooms = #ROOMS#”, or something. You can change the value for your option when you’ll need a new value. You can’t pass a file with sql query to a log parser lizard. Bye.

_{Monday, November 17, 2008 9:57 PM}

I could use some help with a query.

I can list all the log records that have cs-method = post and order they by cs-uri-stem then by cs-status with this query.

SELECT date, time, c-ip, cs-uri-stem, cs-method, sc-status FROM c:\logs\08-08\0808.log
WHERE (cs-method = 'POST') ORDER BY cs-uri-stem, sc-status

But now I want to get just a count of all the records that have cs-method = post and that have a cs-status = 200 and order by cs-uri-stem

Thanks

Joe

_{Monday, November 17, 2008 10:03 PM}

Simply add (sc-status = 200) to the WHERE clause:

**WHERE (cs-method = 'POST') AND **(sc-status = 200)

You can then exclude sc-status from ORDER BY.

_{Tuesday, November 18, 2008 9:23 AM}

Simply add (sc-status = 200) to the WHERE clause:

**WHERE (cs-method = 'POST') AND **(sc-status = 200)

You can then exclude sc-status from ORDER BY.

But that does not give me a count. It would just give list of all the records that matched.

PhotoJoe

_{Tuesday, November 18, 2008 9:32 AM}

I can't remember for sure but the normal SQL command 'count' can be used.

http://msdn.microsoft.com/en-us/library/ms175997.aspx

_{Tuesday, November 18, 2008 11:33 AM}

Sorry, I missed that part. But as Rovastar mentioned, use the COUNT function:

**SELECT date, time, c-ip, cs-uri-stem, cs-method, sc-status, COUNT(*) FROM c:\logs\08-08\0808.log WHERE (cs-method = 'POST') AND **(sc-status = 200) ORDER BY cs-uri-stem

_{Tuesday, November 18, 2008 12:09 PM}

Sorry, I missed that part. But as Rovastar mentioned, use the COUNT function:

**SELECT date, time, c-ip, cs-uri-stem, cs-method, sc-status, COUNT(*) FROM c:\logs\08-08\0808.log WHERE (cs-method = 'POST') AND **(sc-status = 200) ORDER BY cs-uri-stem

I have tried this:

SELECT COUNT(cs-uri-stem) FROM c:\logs\08-08\0808.log WHERE (cs-method = 'POST') AND (sc-status = 200) GROUP BY cs-uri-stem

I get this as the output:

Count(ALL cs-uri-stem)

1 26
2 21

Instead of the label of 1 and 2 I would like to get the label of the cs-uri-stem values like:

/ReservationForm.aspx and /ContactForm.aspx.

_{Tuesday, November 18, 2008 1:25 PM}

Then the query would look like this:

SELECT cs-uri-stem, cs-method, sc-status, COUNT(*)
FROM c:\logs\08-08\0808.log
WHERE (cs-method = 'POST') AND (sc-status = 200) AND (cs-uri-stem = '/ReservationForm.aspx and /ContactForm.aspx')
GROUP BY cs-uri-stem
ORDER BY COUNT(*) Desc

_{Tuesday, November 18, 2008 1:30 PM}

Oops! Didn't notice you had two stems in your question. You will have to provide full stem, not just the page:

WHERE (cs-method = 'POST') AND (sc-status = 200) AND (cs-uri-stem LIKE /...'/ReservationForm.aspx' AND /.../ContactForm.aspx')

_{Tuesday, November 18, 2008 8:01 PM}

Here is the query that I have come up with that gives me the results that I was looking for.

SELECT cs-uri-stem, COUNT(*)
FROM c:\logs\all-08-10.log
WHERE (cs-method = 'POST') AND (sc-status = 200)
GROUP BY cs-uri-stem

COUNT(ALL *) cs-uri-stem

30 /ReservationForm.aspx

25 /ContactForm.aspx

Thanks for the help.

Joe

_{Wednesday, November 26, 2008 10:47 AM}

Is there a query specifically for FTP jobs from IIS?

_{Wednesday, November 26, 2008 11:28 AM}

What exactly are you interested about FTP statistics?

_{Thursday, December 4, 2008 10:21 AM}

Basically Id like what username logged in from what ip, what commands they issued etc

_{Wednesday, March 25, 2009 5:57 PM}

I have noticed minor changes in lizard GUI from the previous download (ex. syntax highlight). Is this release official or beta? Can you please add option for importing queries because I need my old queries from the previous installation? Can I parse Cisco ASA Logs too? Btw helpful tool.

_{Wednesday, March 25, 2009 6:38 PM}

I didn't try it, but I think newer version should keep your queries. Or, you can just save and then copy your old query file from C:\Program Files\LizardLabs\Log Parser Lizard\Queries.xml over. Log Parser can parse basically anything. You can always use TEXTLINE or TEXTWORD input formats.

_{Monday, October 26, 2009 10:08 PM}

You can try to install LogParser engine first (from www.logparser.com) . For me, it helps to fix this problem.

Hi, great tool and initiative. I could not get it to work though.

When I click on a button I get this error:

"Retrieving the COM class factory for component with CLSID {............ID.........} failed due to the following error: 80040154

Could you please help ?

Thanx in advance.

Angelos

_{Monday, October 26, 2009 11:44 PM}

This must be a good tool based on the postings, but it crashes when I launched it on x64 Windows.

This is a common programming defect. If your application binds on 32-bit specific things, you must compile the .NET project with x86 switch so it runs in 32 bit mode on Windows x64. Otherwise, it will crash without a hint to ordinary people.

Right now I am using this hack

http://stackoverflow.com/questions/256287/how-do-i-run-partcover-in-x64-windows

but hope the author of this tool can pay attention to this and release a new version.

Regards,

_{Tuesday, October 27, 2009 12:36 PM}

sadly, I get a similar error... haven't tried this app yet to force it to 32-bit..

Problem signature:

Problem Event Name: APPCRASH
Application Name: Log Parser Lizard.exe
Application Version: 1.0.0.0
Application Timestamp: 4978449c
Fault Module Name: KERNEL32.dll
Fault Module Version: 6.0.6002.18005
Fault Module Timestamp: 49e041d1
Exception Code: e0434f4d
Exception Offset: 00000000000176fd
OS Version: 6.0.6002.2.2.0.274.10
Locale ID: 1033

_{Friday, November 13, 2009 9:40 PM}

Hi,

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p>I am seeing more and more comments on Windows x64 bug, so I had to fix it J I have released a new version of Log Parser Lizard v1.9 that should fix this bug. Please test it for me. There are also some new UI features like advanced grid, OLE DB input format… that anybody can find them useful. You can download new version from www.lizardl.com. Backup your old Queries.xml and Constants.xml (they are located in installation folder) before installation of new version.<o:p></o:p>Best regards from the author of Log Parser Lizard.<o:p></o:p>

_{Tuesday, December 8, 2009 1:31 PM}

I have been testing out log parser lizard and it works great.

Just one question. Is there a way to have the results of more than one remote machine logs

for example

select * from \pcname\security ;

select * from \pcname2\security;

I have to collect and analyze the logs of a number of machines

Thanks.

_{Tuesday, December 8, 2009 1:45 PM}

Just separate the logs paths with comas:

select * from \pcname\security, \pcname2\security

_{Saturday, February 20, 2010 10:26 AM}

I would like to announce that Log Parser Lizard (free GUI for Log Parser) is updated with some new features in v1.9.1:

Now you can load and save queries from/to files on disk
You can open/save different query set files (not only default Queries.xml)
Some bug fixes

You can download this version from here: www.lizard-labs.net.

Many thanks to all you lot out there for using Log Parser Lizard. Thanks also to everybody who somehow contributed and every donator and registered user (you know who you are, don’t you? :) I want to express my appreciation for your generosity in support of Log Parser Lizard. Your assistance means so much to me but even more to all users of Log Parser Lizard. There’s still a lot of work to be done, but we’re hopefully getting through all the requested features, bug fixes and grammar errors (ok, that last one isn’t entirely true).

Thank you from all of us at Lizard Labs.

_{Sunday, April 11, 2010 10:04 AM}

A few more upgrades are made to Log Parser Lizard in latest release 1.9.4 (download is available from www.lizard-labs.net):

Edit Mode. Now you can edit results from a query: make changes to values, remove rows, etc. Some users needed this for removing unwanted values for their graphs and reports.
Swap rows and columns in charts and grid. Sometimes this is useful for better visualization of results.
Print results
Option to compress NULL values. Sometimes we need to lineup results in one row for producing better graphs and data presentation. For instance:

If we have record set like this

1 Null Null
Null 2 3
Null 4 5
6 Null Null
7 8 Null

After “compressing” Nulls we should get results like this:

1 2 3
6 4 5
7 8

A hope I was clear :)

Greeting to all are users of MS Logparser and Log Parser Lizard.

_{Thursday, July 8, 2010 4:32 AM}

Hello,

I did what you stated and it worked for Applications and System, BUT did not work to retrieve the Security Log I am using the stand alone log parser, so I was wondering if you or anybody could help me, here is what I typed in my test enviroment:

select * from\skibohp-vf4b5cn.Tekworld.Tekworldusa\Security where EventType=1

if i replace the Security with Application or System it works like a charm, but once I type Security to get the Logs nothing happens, so i checked the server and there are entries,

thanks in advance...

_{Monday, July 12, 2010 5:22 PM}

I have tried that and it won't pull the security logs, It will pull the other but security it will fail, and i do have the permission to access the logs. that the only glitch i have come accross ... has anybody had this problem?

_{Monday, July 12, 2010 10:36 PM}

security event logs require you to be a local admin on the remote system. Is the account you are using is administrator?

_{Tuesday, July 13, 2010 12:12 PM}

Yes, I have Verified that I am a local Admin on the Remote system.

Thank you for the repsonds.

Any more ideas that I might be doing wrong?

_{Wednesday, July 14, 2010 6:10 AM}

Is this issue direct related to log parser lizard? It implies it is not if so and is a general log parser query then please start a new thread and don't hijack this one.

_{Wednesday, July 14, 2010 9:45 PM}

Yes, Look at the History !! Also, Take a look at the Code. But just incase you still don't get it, it does belong to Lizard Log Parser.

_{Wednesday, July 14, 2010 9:47 PM}

OK, For Everybody who Helped me here is the Code I was able to figure it out:

IN "Log Parser Lizard"

select * from\skibohp-vf4b5cn.Tekworld.Tekworldusa\Security WHERE
EventID NOT IN (541;542;543) AND EventType = 8 AND EventCategory = 2

The Key is the EventType=8 NOT 1

Thanks to everybody who tried to help.

_{Wednesday, July 14, 2010 9:49 PM}

Lizard Log Parser is an awesome Application, I highly recommend it.

_{Thursday, July 15, 2010 3:25 PM}

On log Lizard APP.

How do u pull the history of files from another computer on the network?

Here is the query that Lizard states I put the \networkComputer in the code but it won't work. Can somebody help me with this please.

Thanks in advance.

SELECT TOP 20 EXTRACT_FILENAME(Path), EXTRACT_PATH(Path), DIV(Size, 1048576), LastWriteTime FROM\NetworkComputer c:\.* WHERE LastWriteTime < SUB(TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP('0001', 'yyyy')) ORDER BY DIV(Size, 1048576) DESC

_{Monday, June 6, 2011 10:34 AM}

Hi to all! Just to say that a new version 2.0.0 of Log Parser Lizard released. Among the list of new features and improvements are:

Improved source code editor with enhanced source navigation and analysis capability, syntax-highlighting, automatic source code completion, method insight, undo/redo, bookmarks and more.
Support for Facebook Query Language (FQL).
Code snippets (code templates).
Log Parser Lizard “constants” binding to static/shared properties from Microsoft .Net.
Now you can save MS Logparser output format properties for future use.
Numerous other user-interface and performance improvements and minor bug fixes.

You can download this version from here: http://www.lizard-labs.net/log_parser_lizard.aspx

Greetings to all users of MS Logparser and Log Parser Lizard :) Thnx.

_{Monday, June 6, 2011 9:35 PM}

Awesome!! thanks.

_{Tuesday, June 7, 2011 1:36 PM}

Hello lizardlabs,

Thank you for the new version of the app! I have a question: Will our licenses acquired for version 1.9.1 work on this new 2.0.0 version?

_{Wednesday, June 8, 2011 1:31 PM}

where is support for NCSA logs in the new gui? I have a requirement to parse IHS/Apache web logs, and would love to use this new GUI to do so.

thanks

_{Thursday, June 9, 2011 11:20 AM}

Hi “Edgar the Parser”. Since the donations and buying the license to unlock exporting features of LPL (and registrations of our other products) are our only income that helps us keep running the site and developing the product(s), we decided to change the license code in the new version, so the answer is that your old license code will not work with the latest version and you will have to buy a new one :( We wanted to give discount to previous licensers but there were technical issues so we dropped the idea.

Anyway, till now we gave a numerous licenses for free for a lot of interested users especially for those who used LPL for personal, noncommercial or nonprofit purposes (in fact for everyone who asked one, even those that used the product for commercial purposes). So if anyone feels like he already paid enough for LPL features or can’t afford the new license but still want to use licensed version 2.x, feel free to drop me an e-mail on [email protected] and we will send back the new license code for him/her. I believe this is fair enough :) In this moment I would like to thank all of you who registered the Log Parser Lizard and helped me to build the product and the Lizard Labs site and keep running it till today.

Thanks a lot guys and ladies :)

_{Thursday, June 9, 2011 11:24 AM}

Hi jake20. If you click on the "Input Log Formats" tool in the toolbar, you will see that there is an option for "NCSA Log format". If you have some troubles parsing the log, send me an e-mail on [email protected] and we will see what we can do about it. Best regards.

_{Friday, June 17, 2011 1:10 PM}

I have just downloaded LogParser Lizard.

My interest in LogParser Lizard is the tokenizing of log4net log files so they can be queried more simply, rather than parsing the various log messages using SQL queries.

I have created a regex expression in an XML configuration to tokenize the log4net records.

<regex><![CDATA[(?ix)
^
(?<DateTime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3})
\s+\(?<ThreadID>\d*)\
\s+(?<LogType>info|warn|error|fatal)
\s+(?<Logger>.*)
\s+\.*\
\s+\\s+(?<Message>.*)
$
]]>
</regex>

With this I can submit simple queries which appear in the LogParser Lizard GUI.

select top 10 Logger,LogType,DateTime,ThreadId,Message from 'D:\Mylogs\'

I wish to use LogParser to output data to various file formats/databases; not just the built-in charts, Excel and Document. I am dealing with very large log files and need to allow many users to query the log data.

Is there a way to use the features in the underlying LogParser for formating output while using LogParser Lizard to handle the log file parsing with regex?

From LogParser usage:

LogParser file:myQuery.sql?myInput=C:\temp\ex*.log+myOutput=results.csv
LogParser -c -i:BIN -o:W3C file1.log file2.log "ComputerName IS NOT NULL"

Regards,

_{Saturday, June 18, 2011 1:05 AM}

I registered my copy of Log Parser Lizard and I am now able to use the LogParser Export tool with some output formats such as .CSV. Earlier attempts to generate CSV reported the file had been written but there was no output file. I am unable to generate TSV files. Attempts to do this fail with "Missing Templete". When XML or SQL output is selected, the result appears to be in NAT format. Perhaps there are some tricks to this I am unaware of.

Regards,

_{Saturday, June 18, 2011 3:33 PM}

I am having difficulties using Log Parser Lizard which I explain below.

**Problem Statement
**I am trying to use large web application log files created by log4net to make the data available for interpretation by many users.

The feature of Log Parser Lizard that has most value to me is the support for tokenizing log4net log files using regular expressions.

This keeps queries simpler than trying to break long strings into tokens using the SQL dialect in LogParser.

My goal is to enroll data from new log files created using log4net into a database.

I wish to export results of queries into either SQL or Database tables directly from querying Log files.

I reason that the SQL dialect of LogParser is limited and I want to use all of MS SQL query language to analyze the log files tokenized by LogParser.

Also, sharing access to the data is important such as through stored procedures.

The challenge for log4net log files is the variable format of the input records

I have not achieved my goal of generating any of my desired output formats of XML, TSV, SQL or direct update of a database.

I experimented with queries but lost them after I used the save query function.
I have exported to LogParser using “SELECT * INTO” where it reports success but the output file does not exist.
I have saved queries and lost previous queries as a result. Because of defects in Log Parser Lizard I have lost previous work

Some of these defects may be because of limitations of the design.

Tokenizing log4net source files using configuration files is attractive. It keeps the query simpler than parsing the input in SQL.

LogParser accepts custom input file formats using COM plug-ins.
It is desirable to me for automation to use LogParser from the command line or a wrapper application using the C# (.NET) callable interface to process our application log files using external configuration files. I added my own log4Net XML file for specifying the regex parsing for Log Parser Lizard. I use CDATA to encode the regular expression so I can paste the query into tools like Expresso without any fixup.

Here are some of the difficulties I have experienced using Log Parser Lizard.

· Lost previous queries when saving query
When saving a new query it prompts with the name of an existing query.
When this is changed, the original query may be lost. (Almost always lost)

· **LogParser Exports file paths
**Selecting a file path appears to trample on the query.
I see the “INTO filepath” appearing multiple times in the query.

While adding the “INTO filespec”, the FROM appears to get fragmented.

In my case the source path (FROM) also had the string “from” in it.

It appears as if the matching of string FROM when inserting the output file path is independent of context.

· LogParser Export formats
In the initial download prior to registration I attempted to save the results of various queries in different file formats.
When I saved as Comma-Separated (CSV), the application reports success but no output file is created.
I registered the product in case this was an unsupported feature of the FREE version.
Since registering I am seeing similar behaviors using LogParser Exports.
I would expect a GUI application to check that the result file exists and matches the expected result before reporting success.

Here are some of the results from my attempts to export data from log4net log files.

CSV reported as successfully saved but does not exist in path
TSV export fails with “Missing Template”
XML and SQL export creates a NAT text file

· Help tab
In the absence of help for Log Parser Lizard, the Help tab should include About Log Parser Lizard.
It took me a while to find Help About to register my version. I was looking under Help.

· Spelling errors
I see the word “qury” instead of “query” in prompts.
I also saw similar spelling mistakes for element names in the various configuration files.
Spelling errors don’t generally affect the application but are often a reflection of how much the product has been tested by others.

· Saving the results from error messages
It is common practice to make the text element in a Windows message so it can be shared with others as text.
When there is an error message in Log Parser Lizard the message whole window must be copied using Alt-Print so it can be shared. Design considerations

· **Saving queries
**It appears that all queries are saved within a single file QUERIES.XML
I have saved queries and they have overridden previous queries with different names.
The interface for saving queries is limited for adding attributes such as name, description and type.
I recommend not using a single file to keep all queries. It is too easy to overwrite when there are contesting save activities.
I suspect that Log Parser Lizard has no locking or fragile locking when saving updates to QUERIES.XML.
Using a file name based saving mechanism in a folder such as Queries\Type with each query saved in a spate XML file avoids the risk of accidentally deleting a previous query.

This approach can also be useful to a user to clone an existing query and edit it.

· Reporting errors
All error text in a Windows Message box should support Copy so the text can be reported as text in email.

· User configuration of default configuration files for input formats and supplemental configuration
I added my own XML file for parsing log4net log files from our various web applications.
It is a pain to configure this for each new log4net query.
I haven’t found a way to specify user defaults for configuration files.

· **Automation
**I tried unsuccessfully to register the library LogParserRegexInputFormat.dll using RegSvr32 in the hope of making the
regex parsing available directly from the LogParser command line as input format COM.

Log Parser Lizard could provide a command line interface to leverage the configurations and added input formats as plugins for LogParser for use from the command line.

While the input file processing appears to work fine, the output processing appears to be much more limited and fragile than the underlying MS free software LogParser.

I am optimistic that Log Parser Lizard will continue to improve.

I am sorry that Log Parser Lizard currently does not meet my needs.

Regards,

_{Monday, June 20, 2011 7:54 AM}

Hi. There was one weird bug in v.2.0.0 regarding exporting Logparser data (selected output format in export dialog box was not processed correctly). It is now fixed in v2.0.1. Please download the latest version from www.lizard-labs.net web site. I'm sorry for any inconveniences caused by this.

Also thanks for the long list of suggestions. Some of them are good and we will consider their implementation in the future versions of the product.

Since you do not need LPL for analyzing data just to import the logs into SQL Server, I think that your best and most flexible solution is to code your own small .Net application to parse and export log4net logs to SQL server tables. I don't know about your programming experience but it will not take to long to do this.

Best regards.

OFF TOPIC:

P.S. previous version of the post said something that I'm from Macedonia and therefore we are not reliable?!?!? The text is now edited and the sentence is removed from the text, but I found it very offensive. Republic of Macedonia is a small and beautiful democratic country in Eastern Europe that many western companies found reliable partners in it. I invite everyone to come and visit us :)

P.P.S. Recently I wrote on Facebook Developers Forum something like "Hey guys, now you can use Log Parser Lizard to test your Facebook Query Language (FQL) queries" and I was banned from the forum as a spammer(?!?). Maybe this is related too that I'm from Macedonia and people don't trust us? (This is rhetorical question so I don't want to start discussion over it. If moderators found it inappropriate I will edit the post and remove off-topics)

_{Tuesday, June 21, 2011 2:24 AM}

I apologize for any negative inference you felt by my reference to Macedonia.
None was intended. I wish I had removed it sooner because it was not relevant.

I have learned more about the Lizard labs implementation and have been experimenting with LogParser using the COM interface for Input Formats Regex and Log4Net.

I have had difficulties with the Log4net parsing because of assumptions in the implementation I was unaware of.

For instance, it appears to assume that Message is the last field defined in the configuration file when assembling the "Full Message".

Also when translating matched groups to field values, it appears to use numbered group indexes to match the fields rather than using the field name as an index, such as
g = match.Groups[name];

I realize now that ease of use is not my primary goal.
I have implemented a similar LogParser InputFormat COM module in .NET which is handling the matching of the named groups to field names without the same dependence on the numeric group index.

Originally, with the Log Parser Lizard log4net parser I had matched group values placed in the wrong fields.
This is probably because of the complexity of the regex expression I am using which breaks some of the assumptions in the code.
My regular expression has some groups that are not named, some which are not in the same order as the field definitions and also OR logic that defines the same named groups in multiple named groups.
See below.

I am still experimenting; I am new to using named groups in regex expressions.

Is it possible to use other LogParser InputFormat plugins using the Log Parser Lizard application?
I don't see any hints in the config files to do this.

Thank you and regards,

P.S. Here is my latest regex expression. I am possibly expecting more than is appropriate in the initial parse.
It is extracting fields for web requests for WCF and WSE 3 which have been logged in slightly different formats.
If it isn't a web request it just matches the Message.

    <regex><![CDATA[(?ix)
    ^
    (?<DateTime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3})
    \s+\(?<ThreadID>\d*)\
    \s+(?<LogType>info|warn|error|fatal)
    \s+(?<Logger>.*)
    \s+\.*\
    \s+-\s+(?<Message>
      (
        \(?<Request>.*)\
        ,\s+called\s+by
        \s+\(?<Client>.*)\
        ,\s+from\s+\
        (?<ClientIP>.*)
        \,\s+took\s+\
        (?<Elapsed>\d+.*)
        \\s+milliseconds.*$
      )
      |
      (
        (?<Request>.*)
        ,\s+called\s+by
        \s+\(?<Client>.*)\
        ,\s+from\s+\
        (?<ClientIP>.*)
        \,\s+took\s+
        (?<Elapsed>\d+.*)
        \s+milliseconds.*$
      )
      |
      .*$
    )
    ]]></regex>

<fields>
<field name="DateTime" type="Timestamp" format="yyyy-MM-dd HH:mm:ss,fff" />
<field name="ThreadID" type=="Integer" />
<field name="LogType" type="String" />
<field name="Logger" type="String" />
<field name="Request" type="String" />
<field name="Client" type="String" />
<field name="ClientIP" type="String" />
<field name="Elapsed" type="Real" />
<field name="Message" type="String" />
</fields>

_{Tuesday, June 21, 2011 8:23 AM}

You are right. Implementation of log4net input format is not perfect, and definitely not for novices, but it is good enough for most cases. I'm glad that you've made your own input format plugin. Unfortunately you can't use it with Log Parser Lizard. Currently in LPL 2.0.1 you can use only builtin Logparser input formats plus some additional like log4net and regex. I beleeive that we will contonue to improve the product and add this feature in the folowing releases. I wish you good luck with your work. Best regards.

_{Thursday, October 13, 2011 2:59 AM}

New version 2.1.0 of Log Parser Lizard released. You can download it from here. Among the list of new features and improvements are:

Support for inline VB.Net code to create LogParser SQL queries. Write the code between <% and %> marks, it will be executed and result string will be replaced in the query. We believe this feature will be very useful for the users of Log Parser Lizard. For instance, before parsing logs you can move-copy-rename files, download from FTP, shutdown IIS, etc. You can also use .Net data types like DateTime for arithmetic operations and/or System.Envirenment settings in query parameters. This is a sample query with inline VB.Net code:
<%
'Do something here, for instance System.IO.File.Copy("c:\DailyLogs\.log", "c:\AllLogs")
Return ""
%>
SELECT TOP 100 * FROM <1>
WHERE
time >= #<% RETURN DateTime.Today.AddDays(-7).ToString("yyyy-MM-dd")%># -- last week

The resulting query from this sample would be:

SELEC TOP 100 * FROM <1> WHERE time >= #2011-10-01# -- last week
New "Save Query As" command to easily copy existing queries
New option to display exact Logparser SQL query to help debugging queries who are using in-line VB.Net, constants and snippets
Charts use color palette (till now random colors were used do paint charts)
User-interface and performance improvements and minor bug fixes.

_{Monday, December 12, 2011 2:26 PM}

I get the same error. Using XP Pro. A few others using this in our IT dept have no issues. We all have similar machines. Any resolution for this?

_{Thursday, December 29, 2011 2:18 PM}

Hello @ rtomes,

You get same error ?

Martin

_{Tuesday, January 10, 2012 3:09 PM}

Is inline vb.net supported in the free version?

_{Wednesday, January 11, 2012 3:31 AM}

Hi @BitShift. Yes it is supported in the current version. Write to [email protected] if you have any troubles.

_{Friday, January 20, 2012 1:59 PM}

Hi lizardlabs,

Thank you for the support at the Log parser forums and the product.

Bitshift has a post http://forums.iis.net/t/1186033.aspx not sure how to help :D.

Regards,

IMO: The gui has helped me use log parser better :)

Martin

_{Tuesday, January 24, 2012 4:16 PM}

What was the resolution for this? I'm also getting the same error

_{Wednesday, January 25, 2012 4:19 AM}

What was the resolution for this? I'm also getting the same error

Hi channa_m. This thread is very long so please specify the error you are thinking of. Thnx.

_{Wednesday, January 25, 2012 9:39 AM}

I'm getting Retrieving the COM class factory for component with CLSID {............ID.........} failed due to the following error: 80040154 anytime I click on any of the options

_{Wednesday, January 25, 2012 10:35 AM}

I'm getting Retrieving the COM class factory for component with CLSID {............ID.........} failed due to the following error: 80040154 anytime I click on any of the options

This error indicates that you probably have broken installation of MS Logparser. Log Parser Lizard is a GUI for Microsoft Logparser. In order to use Log Parser Lizard, you will have to install MS Logparser first. Please download it from here:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

To resolve your problem, please try to reinstall MS Logparser and/or Log Parser Lizard too.

_{Tuesday, March 20, 2012 11:40 PM}

Hello, Great program.

What is the current status of this program? I read this topic and it says prompt for user input to put in sql query was a feature for future release? This was back in 2008. The lizard website links are mostly broken to get any FAQ or help file.

Also I am trying to use this program for exchange 2010 message tracking logs. I am forced to manually edit the log and delete log headers then leaving just the columns and data as a CSV. Using the default W3 format doesn't work, it doesn't separate the columns.

_{Wednesday, March 21, 2012 12:36 PM}

Hi thongsai

Recently we have released Log Parser Lizard v2.5. This is the list of new features:

Log Parser Lizard 2.5.0

Conditional column format (color, font, size, image, etc). For instance, you can set the condition to change color of the errors in red, warnings in yellow or to highlight the field if it contains some string.
Store queries in SQL Server database for easily share among users and computers in organization (also for backups, auditing and everything that db storage allows). While using local file storage, when a user saves a query, another user has to recreate the same query if he/she wants to use it. With Log Parser Lizard you may save queries in SQL Server database to easily share queries between users. You can setup the database from Settings dialog box (This feature is only available for company license holders )
New and improved Excel style row filtering
Ability to add columns with Excel style formulas (with most Excel functions)
Support for exporting in Excel 2007 format (more than 65365 rows).
Small user interface improvements and minor bug fixes.

You can download the latest version from Lizard Labs web site http://www.lizard-labs.net/log_parser_lizard.aspx

You can use direct download link (currently on the right side of the page) if you don’t like to tweet. We are giving the product for free, but we will appreciate all support from the users including mentioning Log Parser Lizard on social networks so even more user will hear about it and hopefully find it useful (therefor make it worthy for future development).

We are already planning features for version 3.0. Our goal here is to keep building this MS Logparser GUI and make it even better. I hope it is and will be the best Log Parser GUI available for download, with most features and least bugs :) So I invite everyone to send us feedbacks on the site (above URL) or over e-mail with ideas and feature requests for future development of Log Parser Lizard.

*****

You asked how to get user input for queries. To prompt for user input you can use inline Visual Basic .Net code (available in v 2.1 or above). For instance, this query will prompt for input of EventID:

select top 100 * from Application where
EventID=<% return Microsoft.VisualBasic.Interaction.InputBox("Please enter Event ID","Event ID","1053") %>

*****

Unfortunately I can’t help you with your troubles with Exchange logs since we have no experience with them. You can send us a small sample log on e-mail and we will see what we can do about it.

*****

P.S. The support portal and FAQ pages again will be available very soon. Currently we are in process of changing VPS provider since we were not satisfied with services of previous one (we lost a lot of data during hardware failure).

Best regards.

_{Wednesday, March 21, 2012 12:36 PM}

Hi thongsai

Recently we have released Log Parser Lizard v2.5. This is the list of new features:

Log Parser Lizard 2.5.0

Conditional column format (color, font, size, image, etc). For instance, you can set the condition to change color of the errors in red, warnings in yellow or to highlight the field if it contains some string.
Store queries in SQL Server database for easily share among users and computers in organization (also for backups, auditing and everything that db storage allows). While using local file storage, when a user saves a query, another user has to recreate the same query if he/she wants to use it. With Log Parser Lizard you may save queries in SQL Server database to easily share queries between users. You can setup the database from Settings dialog box (This feature is only available for company license holders )
New and improved Excel style row filtering
Ability to add columns with Excel style formulas (with most Excel functions)
Support for exporting in Excel 2007 format (more than 65365 rows).
Small user interface improvements and minor bug fixes.

You can download the latest version from Lizard Labs web site http://www.lizard-labs.net/log_parser_lizard.aspx

*****

select top 100 * from Application where
EventID=<% return Microsoft.VisualBasic.Interaction.InputBox("Please enter Event ID","Event ID","1053") %>

*****

Unfortunately I can’t help you with your troubles with Exchange logs since we have no experience with them. You can send us a small sample log on e-mail and we will see what we can do about it.

*****

Best regards.

_{Wednesday, March 21, 2012 4:39 PM}

Hello,

thanks for responding. The inputbox command works great. I have uploaded 2 sample logs to mediafire. It's a zip file with two log files.

First file is sample log. Second file with "edited" name is after I deleted header info and left column names and data then I would import to lizard as a csv.

http://www.mediafire.com/?6z1shneq14qan76

_{Thursday, March 22, 2012 8:18 AM}

Hi t,

The Exchange logs you have sent are written in W3C format. But the problem is that the field separator is comma (,) and not usual ‘tab’ character. Luckily you can set the separator character in W3C input format options. Unfortunately MS Logparser hangs when you set something different then ‘tab’, ‘space’ or ‘auto’ (that’s happen on my PC). It is probably a Logparser bug or something.

The easiest way to parse these logs is to use CSV input format and set the query properties to skip first four lines (w3c comment lines) in order to avoid deleting them for each log file.

I’m not familiar with Exchange 2010 settings but maybe there is a way to configure the field separator for w3c Exchange log files. Search on Internet, ask on relevant forums or ask Exchange technical support (and if you find an answer post it here as useful tip for someone else with similar troubles). If there is no way to set the field separator someone should tell this (somehow) to Microsoft Exchange server development team to include this feature.

I hope this was helpful.

Regards.

_{Thursday, January 17, 2013 10:39 AM}

It’s been a while since last update of Log Parser Lizard. Lately we've worked hard to make your Logparser experience even better by using Log Parser Lizard as a front-end GUI.

Log Parser Lizard has just recently been updated to version 3.0. Our latest update makes everything faster and more responsive. Among the list of most important new features and improvements in version 3.0 are:

New and improved Grid View with a number of new features, including Find Panel, column chooser and advanced filtering dialog.
New and improved Chart View with advanced Chart Wizard for customizing data series and chart behavior and appearance.
Command line support.
Can show MS logparser command line with properties.
Batch files. Batch files can run from command line and save results to a number of different file formats.
Read Androild logcat logs using regular expressions and standard console output. This can also be used by any other console application.
Support for Log Parser Custom Input Format plugins.
New TEXT FILE input format. Read all text file as a single record, then extract fields using regular expression.
All Queries form with multithreading support. Run multiple queries and save results to a file. You can also run custom command for each query (to send notifications for instance).
Import queries from Log Parser Studio.
Pivot Grid to analyze for advanced data mining and multi-dimensional analysis.
Advanced print preview for creating documents and send them by email from Log Parser Lizard.
Numerous other user-interface and performance improvements and minor bug fixes.

Jus to avoid confusion I want to mention here that this software is available for FREE for personal, educational and commercial use, with an enhanced version with deeper functionality once it is registered and paid for (15 days trial period).

You can read more and download LPL 3.0 from here:

http://www.lizard-labs.com/log_parser_lizard.aspx

Thank you all who are using and supporting Log Parser Lizard.

Lizard Labs

_{Thursday, June 5, 2014 10:47 AM}

Hi everybody. It’s been some time since the last time I posted here. I was busy working on different stuff and had little time for interneting about this log parser GUI.

Anyway, now I want to announce here that Log Parser Lizard version 3.5 (upgrade from v3.0) was released recently. A few bugs are fixed and the only major new feature is that you can use Google BigQuery service from Log Parser Lizard. You can write and execute queries, browse results, draw charts, export to Excel and PDF… the usual query management and data visualization features that LPL 3.0 already have.

So if you are using (or is planning to use) Google’s Big Data (particularly Big Query) services to process their large log files (IIS or not – doesn’t meter), with Google's servers doing all the big data heavy lifting, then you may upgrade to LPL 3.5 to be able to fly through vast data sets with all the visualization options they're accustomed to in the software.

You can read more (if you are still not familiar with the software) and download LPL 3.5 from here:

http://www.lizard-labs.com/log_parser_lizard.aspx

If you are not using Google BigQuery, you do not have to rush for an upgrade but wait for LPL 4.0 instead. Lately we've worked hard to make your log parsing experience even better by using Log Parser Lizard as a front-end GUI (rewriting a lot of code from scratch in the process). Unfortunately the release date is still unknown. The following release will have much more new features and completely new and improved user interface. I also want to mention here that I’m always happy to hear new ideas and suggestions from the community, so feel free to send us an email or post your idea on Lizard Labs support portal on how to improve LPL further (or at least just say hi and tell us why you love log parser and LPL :)

Again, thank you all who are using and supporting Log Parser Lizard.

Lizard Labs

_{Monday, June 8, 2015 12:00 PM}

Hello everybody :)

I’ve just realized that I haven’t updated the thread with information about Log Parser Lizard updates for a very long time (actually from version 3.5). Last month we released a new major version of LPL 5.0. There is a large list of most important new features and improvements in versions 4.x and 5.0:

Completely redesigned user interface
New cod editor with much better support for syntax highlighting and auto complete (for MS Logparser and Google BigQuery code).
New Input Formats:
- Excel file reader,
- HTML Table reader,
- Microsoft Visual Basic .Net,
- C# .Net,
- Powershell,
Ultimate Dates Table and
Regular Expression Enhanced
Pivot Chart is added in a Pivot Greed window for quick data visualization
Numerous other user-interface and performance improvements and minor bug fixes.
Automatically send emails with attachments to default email address.
Auto run queries.
New keyword “--LL PROPS: ” for setting query options in the query. Now you can use different input types in single command (in combination with data set operations GO, MERGE, etc…). You can also put the parameters from a button on a toolbar
New help documentation
New Excel inspired styles in Data Grid (right click on a column for the options)
Customizable Data Grid, Pivot Grid and column properties
Improved Excel exporter (grouped rows will be grouped in the Excel too, not just list of all rows)
New keywords to merge, join, group queries (these can be very useful since the merged datasets can be used in Dashboards and Reports):
- GO - create tables in single dataset without relation (useful in dashboard and reports)
- MERGE - merge tables in one
- LPL_UNION - same as MERGE
- LPL_INTERSECT - intersection of two tables
- LPL_PRODUCT - product of two tables
- RELATION_ON_FIRST_COLUMN - create tables in single dataset and try to create a relation on first column (must be of same data type)
- RELATION_ON_SAME_COLUMNS - create tables in single dataset and try to create a relation on all columns with same name
- JOIN_ON_FIRST_COLUMN - joins results of two tables in another one on the first column
- JOIN_ON_SAME_COLUMNS - joins tables on the columns with the same name

Sample:

SELECT DISTINCT EvenetType FROM System

RELATION_ON_SAME_COLUMNS

SELECT TOP 1000 * FROM System

There are also changes in paid version. Now LPL 5.0 is available in two editions: Standard Edition and Professional Edition (we offer 15 days trial for free for both editions - find more info on the site). Standard edition can export or print data in various formats (Excel, PDF, Rtf, Html, etc...) and Pivot Table. Professional edition has a new Dashboard Designer with a number of new features and visualizations (Maps, Charts, Tables, Gauges, Pivot Tables, Cards, etc…) and a new WYSISWG Report Designer.

Please go to http://www.lizard-labs.com/log_parser_lizard.aspx and download some of the products. Your feedback is important. We are always looking for ways to improve our software and services. Please send any suggestions, complaints or compliments - the former two are critical to improving our software and the latter gives us the energy to implement your ideas.

Thanks again to all who use and support Log Parser Lizard all these years by buying, blogging or spreading the word on social networks (please continue to do so :). I’m very happy to see that LPL is used by thousands of users and that this thread has around 6.5 million views so far :)

Cheers,
Lizard Labs

Web:
http://www.lizard-labs.com

Twitter:
@lizardlabs (https://twitter.com/lizardlabs)

Facebook:
https://www.facebook.com/LogParser

_{Monday, June 8, 2015 1:03 PM}

Thanks for the updates. Log Parser Lizard is tool that should be in every web admins toolkit.

_{Monday, November 16, 2015 9:20 AM}

Hi,

New to this (and SQL novice).

I'm trying to create a report over number of hits on certain file exstentions within a date-range. Simply to see how many times the files are downladed when I upload new versions.

Anyone know a way to do this with LPL? I took a look at the default IIS query "Hit counts for each extension", but could really get it to work with dates.

Any tips is greatly welcomed.

_{Thursday, August 8, 2019 9:15 AM}

Hi everybody,

I just realized that I haven’t updated this thread for long time. Even for the past 4 years, I was working hard trying to keep Log Parser Lizard fresh and useful by adding new features (among other things).

Recently we released new major version of Log Parser Lizard 7.0 - there were also several versions 6.x before that.

There is a new user interface, new input formats end other features, the list is long, that some of you can find useful while working on log forensics analysis and reports. Even in today’s world of modern web development and cloud services, a good desktop/offline tool can save the day (I use logparser and LPL on a daily basis – true story). Therefore, if you are curious you can read more and find download links on our website:

http://lizard-labs.com/log_parser_lizard.aspx

Finally, many thanks to all who are using and supporting Log Parser Lizard for more than 10 years by blogging and sharing links on social networks (times are hard for indie devs and it really helps, so please continue to do so occasionally if you like MSLP & LPL :)

Best regards,
Lizard Labs

COUNT(ALL *)	cs-uri-stem
30	/ReservationForm.aspx
25	/ContactForm.aspx

Share via

New GUI tool for MS Log Parser, Log Parser Lizard

Question

All replies (108)

Additional resources