Kary Wall

Cruising the streets of Microsoft Exchange, networking, debugging and more....

Log Parser Studio V2 Updated (12/11/2013)

Log Parser Studio V2 Updated (12/11/2013)

  • Comments 15
  • Likes

The latest bits for LPS 2.0 are now available. This update contains a number of small fixes and enhancements including the promised fix of enabling the "Use Double Quotes" option for IIS Advanced Logging. The latest bits and associated links are below.

 Download the latest version of LPS:



There is also the ability to query Dynamics CRM logs. The log type is listed as "CRMLOG" in LPS. For more information see the following link.



Change List

+ Added custom support for Dynamics CRM tracing.

+Added default backslash to iCheckPoint for CSV because null
crashes PS export for CSV.

+Fixed chart type dropdown focus issue.

+Rewrote InputFormat parsing so that we derive the actual
name instead of [name, {type}] etc.

+Enabled IISW3C double quotes for IIS Advanced Logging. ***

+Added Accept/Cancel buttons for Enter/ESC .

+Fixed PowerShell "tabs" param issue.

+Removed ValueFromPipeline from PS Script Template.

+Added Accept/Cancel buttons for Enter/ESC.

+Added cancel buttons/ESC functionality to format dialogs.

+Updated FunctionReference.html

+Added queries for ActiveSync Troubleshooting Guide
Walkthrough (Ref: http://support.microsoft.com/common/survey.aspx?scid=sw;en;3616&showpage=1)

+Multiple small fixes/improvements/enhancements


  • I would love to see intellisense and the ability to export the query to the clipboard to paste into the command prompt. These are 2 of the features that I love in the Log Parser Lizard by Lizard Labs.

  • Couple of stupid questions: 1) where is the "FunctionReference.html" file located 2) How do you display your "Favorite" queries?

  • FunctionReference.HTML = SHIFT+F3 For favorites: Options > Preferences > Enable legacy category buttons - Restart LPS. Favorites is the Star shaped button on the far right. You can also find the function reference in the LP 2.2 .CHM in \program file (x86)\Log Parser 2.2

  • wish I had seen your post for 'tips and tricks' before I wrote my own for getting url parameters from the cs-uri-query SUBSTR( EXTRACT_TOKEN(cs-uri-query, 1, '&hf=') , 0 , INDEX_OF( EXTRACT_TOKEN(cs-uri-query, 1, '&hf='), '&')) as HYPERFINDID, your solution sure looks easier...EXTRACT_PREFIX(EXTRACT_SUFFIX(FieldName, 0, 'StartChar'), 0, 'EndChar') as FieldAlias One item that eludes me is how to do a vlookup type function when I have a list of ID's for example that I need to replace with a proper name, and the list is too long to put into a case statement. This can be seen with user-agent strings that it would be great to have a xml file, that could return a more 'common' description. In the example above, the hyperfind id's could be a list of hundreds that I have the description name - pair values for.

  • Love the tool it's been a life saver many times, but I can't seem to get it to work with IIS Advanced Logging (Which I need to get the client IP because we're behind a Netscaler Loadbalancer). I'm able to run the ActiveSync report if I copy the SQL to a file, modify the Log by removing the space before the date field, and running log parser from the command line. I also had to remove the sitename and s-ip fields to get it working properly, changing the double quotes doesn't seem to help, and after running the query so many times I get a RPC_Server error. Is there a support forum I can post more details on the issues I've been experiencing Thank you, James

  • I love the CRM Trace plugin, it's great. Can't find a bit of documentation anywhere though. When I try and use power-shell or the command line I get CRMTraceLPExt is an unknown format. Any pointers please?

  • Hi James, So you did enable "Use Double Quotes" in the properties for the IISW3LOG type? Last time I tested this worked with Advanced Logging. If you are still having issues there is a workaround here that you can try while I investigate: http://blogs.technet.com/b/karywa/archive/2013/06/28/log-parser-studio-and-iis-advanced-logging.aspx

  • Hi Steve, we have typically been using the case statement. See "Active Sync Report" query to see just how long these can be and still work quite well (other than the time it takes to enter them). If I find a better method I'll update.

  • For the CRM tracing, I alerted the author of that component to see if they have any further info.

  • Hi, Last december, Kary wrote that LPS will support custom fields in IIS logs in the next version, but it seems that it still not works. Or do I something wrong? Thanks for help, Clay

  • I fixed, it, let's hope I didn't break it without realizing it. Let me go back and do some testing and I'll follow up. Can I assume that you have "use double quotes" enabled now and it still doesn't work?

  • I'm also having problems given a custom field on my IIS advanced log. An update?

  • First of all - great tool! I am curious though if it is possible to define my own log types. I am trying to develop a solution which will parse many proprietary log where errors sometimes span multiple lines which I would like to group somehow. I figure that the most logical solution would be to create a custom log type for each log I will be parsing - is this possible?

  • Hi Bjorn,

    Creating a custom type is possible but it would have to be compiled into LPS before it would see it. You can however, use TextLine Log Type and do some pretty fancy stuff. If you press Shift+F12 in LPS you'll get LP 2.2s function list which you can use to dig out just about anything you want.

  • LPS complains that I need to install .NET 4.0 when I launch lps.exe on my Windows 7 / .NET 4.5 environment. I have mandatory corporate apps installed that require .NET 4.5. My research tells me that 4.0 and 4.5 cannot run side by side. Are there any tweaks required to run LPS in a .NET 4.5 environment (perhaps I've missed something obvious)? Any workaround (short of running in a dedicated VM) would be appreciated.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment