Log Parser Studio 2.0 is now available

[The_Exchange_Team]

Since the initial release of Log Parser Studio (LPS) there have been over 30,000 downloads and thousands of customers use the tool on a daily basis. In Exchange support many of our engineers use the tool to solve real world issues every day and in turn share with our customers, empowering them to solve the same issues themselves moving forward. LPS is still an active work in progress; based on both engineer and customer feedback many improvements have been made with multiple features added during the last year. Below is a short list of new features:

Improved import/export functionality

For those who create their own queries this is a real time-saver. We can now import from multiple XML files simultaneously only choosing the queries we wish to import from multiple query libraries or XML files.

Search Query Results

The existing feature allowing searching of queries in the library is now context aware meaning if you have a completed query in the query window, the search option searches that query. If you are in the library it searches the library and so on. This allows drilling down into existing query results without having to run a new query if all you want to do is narrow down existing result sets.

Input/Output Format Support

All LP 2.2 Input and Output formats contain preliminary support in LPS. Each format has its own property window containing all known LP 2.2 settings which can be modified to your liking.

Exchange Extensible Logging Support

Custom parser support was added for most all Exchange logs. These are covered by the EEL and EELX log formats included in LPS which cover Exchange logs from Exchange 2003 through Exchange 2013.

Query Logging

I can't tell you how many times myself or another engineer spent lots of time creating the perfect query for a particular issue we were troubleshooting, forgetting to save the query in the heat of the moment and losing all that work. No longer! We now have the capability to log every query that is executed to a text file (Query.log). What makes this so valuable is if you ran it, you can retrieve it.

Queries

There are now over 170 queries in the library including new sample queries for Exchange 2013.

PowerShell Export

You can now export any query as a standalone PowerShell script. The only requirement of course is that Log Parser 2.2 is installed on the machine you run it on but LPS is not required. There are some limitations but you can essentially use LPS as a query editor/test bed for PowerShell scripts that run Log Parser queries for you!

Query Cancellation

The ability to submit a request to cancel a running query has been added which will allow you to cancel a running query in many cases.

Keyboard Shortcuts

There are now 23 Keyboard shortcuts. Be sure to check these out as they will save you lots of time. To display the short cuts use CTRL+K or Help > Keyboard Shortcuts.

There are literally hundreds of improvements and features; far too many to list here so be sure and check out our blog series with existing and upcoming tutorials, deep dives and more. If you are installing LPS for the first time you'll surely want to review the getting started series:

• Getting started with Log Parser Studio
• Getting started with Log Parser Studio, part 2
• Getting started with Log Parser Studio, part 3

If you are already familiar with LPS and are installing this latest version, you'll want to check out the upgrade blog post here:

• Log Parser Studio: upgrading from v1 to v2

Additional LPS articles can be found here:

http://blogs.technet.com/b/karywa/

LPS doesn't require an install so just extract to the folder of your choice and run LPS.EXE. If you have the previous version of LPS and you have added your own custom queries to the library, be sure to export those queries as a backup before running the newest version. See the "Upgrading to LPS V2" blog post above when upgrading.

Kary Wall

[#2]

Thanks Kary!

I've been waiting for this goodie. The PowerShell export feature looks very interesting.

[#3]

Thanks guys.

[#4]

Congrats to MS Exchange Team on releasing LPS v2

I really hope that someone at Microsoft will work on Logparser version 3.0 too. To include new input and output formats, new features, extend LP SQL language, bug fixes, etc… Or at least MS may publish it as an open source project on CodePlex so we could all contribute to its future development. Such tools are rare gems for IT professionals so it would be shame to let them be forgotten.

Best wishes from the developers of Log Parser Lizard :)

www.lizard-labs.net/log_parser_lizard.aspx

[#5]

Has anyone mentioned that your PowerShell scripts are flawed? You can't mark every parameter as ValueFromPipeline=$true -- it's max one per parameter set.  Maybe you meant ValueFromPipelineByPropertyName=$true ... but even that won't do much good if you don't put the logic of your script into a process{ ... } block.

[#6]

Hi Joel,

You are correct. Additionally, the scripts weren't designed to process pipeline objects at all so ValueFromPipeline needs to be removed altogether. In the interim, the scripts should still work as-is with the caveat that it is a new and evolving feature. Thanks for the good catch.

[#7]

Is there any way to tell LPS to only query logs from within a certain date range even if there are more Logs in the folder then the window you would like to query?

[#8]

Hi Richard,

There is provided the log has dates/time fields but the query itself is what determines the range. I'll post an example once I get freed up to do so.

[#9]

@Richard

I add the following to my WHERE statement whenever I want just the last hour of logs to be queried.  You could modify this to include a range as well.

WHERE TO_LOCALTIME(TO_TIMESTAMP(date, time)) >= SUB( TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP('0000-01-01 01:00', 'yyyy-MM-dd HH:mm') )

the 01:00 portion is what I change to 06:00 if I want the last 6 hours instead of 1.

[#10]

Congratulations!

We are using IIS advanced logging because of X-forwaded-For value passed by our HW LB.

Even LPS2 doesn't support the advanced logs which have some of the values double quoted.

Do yo plan to fix this? I can imagine there is plenty of enterprise admins whoo will benefit from this.

thanks in advance

Lubomir

[#11]

Hi Lubomir,

LPS can query advanced IIS logs but they are in TSV format and may require a custom header file. I'll blog instructions on how to do this soon.

Kary

[#12]

The powershell script seems to add an extra character to every field when exporting to csv file. Is there a work around?

[#13]

@John B

It's a tab being appended after the comma. This appears to be a discrepancy between LP 2.2's interpretation of the CSV Output Format parameters data types and how PowerShell passes those parameters to LP 2.2. The LP 2.2 documentation suggests the following for the "tabs" parameter:

============

Tabs Parameter

============

Values: ON | OFF

Default: OFF

Description: Write a tab character after each comma separator.

Details: Setting this parameter to "ON" causes the CSV output format to write a tab character after each comma field separator, in order to improve readability of the CSV output.

However, from within PowerShell (via testing based on your question), a zero must be passed instead of "OFF". I will update LPS to account for this when generating scripts in the near future.

In the interim the workaround would be to change the tabs parameter to 0 instead of "OFF" in the script where the OutputParams are evaluated; the tabs parameter is approximately on line #66 in the script:

Change $OutputFormat.tabs="OFF" to $OutputFormat.tabs=0 and save the script.

After making the change the additional tab character should no longer appear in the output. As mentioned, I'll update the script template in LPS and update the download soon but try this as a workaround for now. Thanks for finding this.

[#14]

@Lubomir

Here is a temporary workaround for IIS Advanced Logging in LPS. Try this out and I'll get the double-quotes option enabled as soon as I finish testing:

blogs.technet.com/.../log-parser-studio-and-iis-advanced-logging.aspx

[#15]

Dear All,

thanks for creating a tool that actually looks friendly as well as being usable.

This is the first time I've blundered around the features and I'd dearly appreciate some guidance / advice on handling ETL (Exchange Trace Log ?) files. I'm trying to understand why some calendar invitations are not working as expected.

I've looked through the previous comments and the helpful hints, but haven't identified the setup that I think should be the one for me.

Many thanks :)

[tomascorey]

Hi, thanks for the awesome tool, I have a question

When I try to combine time with ip I can't. Can you help m?

PS C:\Program Files (x86)\Log Parser 2.2> .\LogParser.exe "SELECT [#Fields: date-time] as date-time, REVERSEDNS(EXTRACT_PREFIX(remote-endpoint,0,':')) as RemoteSenderDNS, EXTRACT_PREFIX(remote-endpoint,0,':') as RemoteSenderIP, Count(*) as Hits FROM c:\tools\*.log GROUP BY RemoteSenderIP ORDER BY HITS DESC" -i:CSV -nSkipLines:4
Error: Semantic Error: SELECT clause field-expression "date-time" is not an aggregate function and does not contain GROUP BY field-expressions

Thanks

[BR0KK]

So where the heck is the download button for this tool ? I Must be blind because i can't find it.

I need the GUI Version :D This user is a script kiddie :D

[suzman]

I found the download button (it's small) for a .ZIP file near the bottom of a document:

Introducing: Log Parser Studio - Microsoft Tech Community

[mike519535]

Where can I find the download link ?