how can I query against exchange 2003 message tracking log? I tried with log type W3CLOG with no luck (I get an error, see this screenshot: dl.dropboxusercontent.com/.../logParser.png)
thank you
Kary Wall
19 Jun 2013 10:29 PM
Did you try IISW3CLOG instead of W3CLOG? If that doesn't work I will get you a method for 2k3 message tracking logs. I remember there could be special steps for 2003 Message Tracking logs and will test for you and reply as soon as I can.
20 Jun 2013 4:25 AM
I just posted the solution. Please try this method and see if it works for you:
blogs.technet.com/.../log-parser-studio-exchange-2003-message-tracking-logs.aspx
Sunshine Lewis
17 Sep 2013 6:36 PM
Hi Kary,
Thanks for a great tool! Is there a way to access parsing errors through the GUI? Since all rows appear in the output whether they parsed or not, maybe you could add an error column with information about what the error is. Even just dumping it to a text file would be helpful.
Kary Wall
20 Sep 2013 5:28 PM
Hello Sunshine,
My apologies... Can you elaborate as I'm afraid I don't quite understand the question. :)
19 Feb 2014 3:57 AM
Hi. I think Sunshine is asking where can we review the errors if LPS fails to read the log file.
19 Feb 2014 5:35 PM
Errors can come from two locations. LPS itself and any true parsing errors are returned via LP 2.2. Both of these are typically shown in a message box with any available exception information. Otherwise there aren't any errors, just queries that are misconfigured. That being said, any errors that LPS knows about regardless of where they come from are logged to a text file already (CTRL+ALT+E). However, keep in mind that 99% of the errors in that text file are the same ones presented to the user when they occurred and only serves as a record of what went wrong. I am still unclear as to " Since all rows appear in the output whether they parsed or not" and what that means. :) Additionally but slightly unrelated, if you enable "Log all queries to file" in preferences you'll have a record of every query that you run whether it is in the library or not. This is helpful if a query isn't returning what you need and you keep making modifications. This log tracks those modifications so that you never lose a query.
Wyatt
26 Feb 2014 7:11 PM
Do I need to do a find and replace for exchange perflogs headers? I'm getting a blank result.
Kary Wall
26 Feb 2014 7:15 PM
Hi Wyatt, which perflogs?
Wyatt
26 Feb 2014 7:23 PM
exchange CAS and Mailbox server performance logs. it's a binary log that convert to csv. headers are still intact.
Kary Wall
26 Feb 2014 7:28 PM
Due to the way performance monitor logs are laid out, I don't know of a great way to query them usefully. I'll check something in a few when I get free and reply back. There are certainly ways to query them with CSV and/or TEXTWORD log types but need to see how useful it is.
Kary Wall
26 Feb 2014 7:31 PM
CSV works. It just requires knowing what you want and how you want it. Choose CSVLOG as the log type then just run the default "new query" to see the basic results:
/* New Query */
SELECT TOP 10 * FROM '[LOGFILEPATH]'
Wyatt
26 Feb 2014 9:12 PM
The query ran but came back blank. I've feeling the default headers need to be change.
Kary Wall
26 Feb 2014 9:26 PM
Possibly in the perfmon. I ran the query as-is with the out of the box CSV settings and the results came back but I just grabbed a random performance log I had lying around. Have you tried resetting the default CVSLOG settings in LPS just to be sure?
Wyatt
26 Feb 2014 9:35 PM
Kary, I wanted to thank you for taking the time to help me.
I'm getting Log row too long error when choosing CSVLOG type. The registry edit of CSVInMaxRowSize has already been done.