
Using logparser with Windows event logs
by
rastix
on Tue 04 Apr 2006 11:38 AM CEST
Logparser is a great tool to parse logs in many formats. One of the things you can do with Logparser is extracting log entries from the Windows event logs based on certain parameters. The other day, I needed to extract some text from the description of system events with ID 5778. The description looks like:
'PCNAME' tried to determine its site by looking up its IP address ('10.10.10.10') in the Configuration\Sites\Subnets container in the DS. No subnet matched the IP address. Consider adding a subnet object for this IP address.
I want to extract the computername and IP address from each 5778 event and put that in a csv file. With Logparser, this is relatively easy:
logparser "SELECT DISTINCT extract_token(Message
,1,'\'') as name, extract_token(Message,3,'\'') as ip into logfile.csv FROM \\
server\System WHERE EventID=5778 ORDER BY ip ASC" -o:csv
In the above, extract_token is used to extract the computer name and ip address from each event description (between the single quotes).
Give Logparser a try, you will see that it can help in most (if not all) situations when you need to extract data from logs.