The Microsoft Log Parser is a trusted and venerable tool to have when you are analysing log files. 

One issue that does come up when analysing larger Performance Monitor files is that of the default buffer setting in Log Parser.  Typically you will see an error message saying  “log row too Long”. 

When running the ExRAP toolset this will be shown in the console:

Error parsing query: Log row too long
LogFile "C:\ExRAP\Public\Output\PerfCollector\perfcollector.servername_01_2012.04.02_09.28.42.csv", Row number 1 [Unknown Error]

Log Parser has a default buffer allocated to it and analysing Exchange PerfMon Logs during an large ExRAP we typically run into this issue.  To fix this, all we have to do is to increase the allocated buffer size.  The exact key that you will use will depend upon if you are running log Parser on an x86 or x64 OS.

After doing this a few times I’m bored of typing it hence the reg.exe to add the necessary values.  Note that the command may wrap, and it is used at your own risk.  It will also need to be run from an elevated command prompt.

x86

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Log Parser

REG_DWORD  CSVInMaxRowSize  393216 decimal

To automate adding on x86 machines:

REG.exe ADD "HKLM\Software\Microsoft\Log Parser" /v CSVInMaxRowSize  /t REG_DWORD /d 393216
 

x64

HKLM\Software\Wow6432Node\Microsoft\Log Parser

REG_DWORD  CSVInMaxRowSize  393216 decimal

To automate adding on x64 machines:

REG.exe ADD "HKLM\Software\Wow6432Node\Microsoft\Log Parser" /v CSVInMaxRowSize  /t REG_DWORD /d 393216

Log Parser 2.2 now has a new companion – Log Parser Studio.  I’ll cover it in a later blog.  Check it out it really is an amazing tool!  Documentation can be found on the Exchange Team Blog. 

Cheers,

Rhoderick