CINXE.COM

<!DOCTYPE HTML>   <html lang="en"> <head><script type="text/javascript" src="/_static/js/bundle-playback.js?v=HxkREWBo" charset="utf-8"></script> <script type="text/javascript" src="/_static/js/wombat.js?v=txqj7nKC" charset="utf-8"></script> <script>window.RufflePlayer=window.RufflePlayer||{};window.RufflePlayer.config={"autoplay":"on","unmuteOverlay":"hidden"};</script> <script type="text/javascript" src="/_static/js/ruffle/ruffle.js"></script> <script type="text/javascript"> __wm.init("https://web.archive.org/web"); __wm.wombat("http://www.iis.net:80/learn/troubleshoot/performance-issues/troubleshooting-iis-performance-issues-or-application-errors-using-logparser","20130604073815","https://web.archive.org/","web","/_static/", "1370331495"); </script> <link rel="stylesheet" type="text/css" href="/_static/css/banner-styles.css?v=S1zqJCYt" /> <link rel="stylesheet" type="text/css" href="/_static/css/iconochive.css?v=3PDvdIFv" />  <meta charset="UTF-8"> <title>Troubleshooting IIS Performance Issues or Application Errors using LogParser : The Official Microsoft IIS Site</title>  <meta name="description" content="This article describes the troubleshooting steps to identify performance issues by using Microsoft's LogParser to analyze IIS logs."/> <link rel="shortcut icon" type="image/ico" href="/web/20130604073815im_/http://www.iis.net/favicon.ico"> <link rel="apple-touch-icon-precomposed" href="/web/20130604073815im_/http://www.iis.net/touch-icon-iphone-precomposed.png"/> <link rel="apple-touch-icon-precomposed" sizes="72x72" href="/web/20130604073815im_/http://www.iis.net/touch-icon-ipad-precomposed.png"/> <link rel="apple-touch-icon-precomposed" sizes="114x114" href="/web/20130604073815im_/http://www.iis.net/touch-icon-iphone4-precomposed.png"/> <link rel="apple-touch-icon-precomposed" sizes="144x144" href="/web/20130604073815im_/http://www.iis.net/touch-icon-ipad3-precomposed.png"/> <meta name="application-name" content="The Official Microsoft IIS Site"/> <meta name="msapplication-TileColor" content="#474747"/> <meta name="msapplication-TileImage" content="http://i2.iis.net/images/iis_tile.png?cdn_id=2013-05-01-001"/> <link href="https://web.archive.org/web/20130604073815cs_/http://i1.iis.net/umbraco-beta-css/learn.min.css?cdn_id=2013-05-01-001" rel="stylesheet" type="text/css" media="all"/> </head> <body class=""> <header id="header-site" class="full-width "> <script type="text/javascript">var currentUsername = '';</script><ul id="nav-user"><li><a href="https://web.archive.org/web/20130604073815/http://login.iis.net/login/signin.aspx?ReturnUrl=http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-iis-performance-issues-or-application-errors-using-logparser">Sign In</a></li><li><a href="https://web.archive.org/web/20130604073815/http://login.iis.net/login/createuser.aspx?ReturnUrl=http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-iis-performance-issues-or-application-errors-using-logparser">Join</a></li></ul> <p id="search-site"><input type="text" name="search" id="txt-search" placeholder="Search all of IIS.NET"/><button type="submit" id="btn-search-submit"><span class="icon icon-search">Search</span></button></p><nav id="nav-primary"><a id="logo" href="https://web.archive.org/web/20130604073815/http://www.iis.net/home">IIS</a><ul><li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/home">Home</a></li><li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/downloads"> Downloads </a></li><li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/learn" class="current"> Learn </a><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/get-started">Get Started</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/install">Install</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/manage">Manage</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/develop">Develop</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/publish">Publish</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot" class="current">Troubleshoot</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/extensions">Extensions</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/media">Media</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/application-frameworks">Application Frameworks</a></li> <li><a href="/web/20130604073815/http://www.iis.net/learn/web-hosting">Web Hosting</a></li> </ul></li><li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/configreference"> Reference </a></li> <li id="solutions-menu"><a href="javascript:;">Solutions</a> <div> <ul> <li>Technologies</li> <li><a href="https://web.archive.org/web/20130604073815/http://msdn.microsoft.com/en-us/netframework/default.aspx">.NET Framework</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.asp.net/">ASP.NET</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://php.iis.net/">PHP</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/media">Media</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/windowsserver2008/en/us/default.aspx">Windows Server</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/SQL/default.mspx">SQL Server</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/web/gallery">Web App Gallery</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.windowsazure.com/">Windows Azure</a></li> </ul> <ul> <li>Tools</li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/visualstudio">Visual Studio</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/expression/">Expression Studio</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/ie/">Windows Internet Explorer</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/web/webmatrix/">WebMatrix</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/web/downloads/platform.aspx">Web Platform Installer</a></li> </ul> <ul> <li>Get Help:</li> <li><a href="https://web.archive.org/web/20130604073815/http://forums.iis.net/">Ask a Question in our Forums</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/feedback">More Help Resources</a></li> </ul> </div> </li> <li><a href="https://web.archive.org/web/20130604073815/http://blogs.iis.net/">Blogs</a></li><li class="last-child"><a href="https://web.archive.org/web/20130604073815/http://forums.iis.net/">Forums</a></li></ul></nav> </header> <div class="full-width"> <nav id="breadcrumb"><p><a href="/web/20130604073815/http://www.iis.net/home">Home</a><a href="/web/20130604073815/http://www.iis.net/learn">Learn</a><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot">Troubleshoot</a><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/performance-issues">Chapter 6. Performance Issues</a><span>Troubleshooting IIS Performance Issues or Application Errors using LogParser</span></p></nav> <div class="page two-right"> <input type="hidden" id="loggedIn" value="False"/> <section class="col-article"> <article><header><h1>Troubleshooting IIS Performance Issues or Application Errors using LogParser <span></span></h1><p>By <a href="#author-info">Benjamin Perkins</a></p><p>December 18, 2012</p></header><h3>Tools and knowledge used in this Troubleshooter:</h3> <ul> <li>Microsoft LogParser (<a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/en-us/download/details.aspx?id=24659">http://www.microsoft.com/en-us/download/details.aspx?id=24659</a>)</li> <li>Command Prompt</li> <li>A basic knowledge of IIS HTTP Status Codes is helpful (<a href="https://web.archive.org/web/20130604073815/http://support.microsoft.com/kb/943891">http://support.microsoft.com/kb/943891</a>)</li> <li>A basic knowledge of SQL queries is helpful</li> </ul> <h2>Overview</h2> <p>This troubleshooter will help you analyze IIS log files in an effort to determine the cause when an application that is hosted on IIS is failing or experiencing performance issues. Before you begin, it is important to note that all fields IIS can log are not enabled by default. For example, <i>Bytes Sent</i> and <i>Bytes Received</i> are not selected, but they are very useful when troubleshooting a performance problem. Therefore, the best time to include these additional fields is before you are experiencing system problems. So if you haven't already done so, select these additional fields, they will help you find solutions when problems happen.</p> <p>The following blog which discusses how to perform this on IIS 7+:</p> <p style="margin-left:20px"><strong>Modifying IIS 7 log data in Windows 2008</strong><br> <a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/benjaminperkins/archive/2012/08/01/modifying-iis-7-log-data-in-windows-2008.aspx">http://blogs.msdn.com/b/benjaminperkins/archive/2012/08/01/modifying-iis-7-log-data-in-windows-2008.aspx</a></p> <h2>Scenario</h2> <p>As a Systems Administrator you begin to hear reports from users of your system hosted on IIS that the response is slow. There is some mention that web browsers simply time out or stop responding completely when they are accessing your website.</p> <p>You jump into action and recycle the worker process; all appears to be working again, as normal.</p> <p>However, you cannot accept that as a solution and need to know why this happened, but don't know where to start. You have no details from the users, such as error codes, screen shots and worse, you have no performance data to compare what just happened to normal performance. In many cases, other new issues take you away from any serious root cause analysis.</p> <p>Microsoft's LogParser is a good tool that is quick and easy to use. In many situations, the tool will help you quickly get to a deeper understanding of what happened on the server and may help you identify problems. You can take the information you gather with LogParser and pass it along to your database team, your network team or to your developers for more analysis.</p> <h2>Data Collection</h2> <p>By default, IIS log files are located in the following directories:</p> <ul> <li>IIS 7 and later: %SystemDrive%\inetpub\logs\LogFiles</li> <li>IIS 6 and earlier: %WinDir%\System32\LogFiles</li> </ul> <p>In this troubleshooter, I will be using IIS 8. Open the <strong>IIS Manager</strong> and select <strong>Sites</strong>, as shown in <i>Figure 1</i>. This will show you the ID of each website hosted on your server. You will need this ID to determine which W3SVC* directory to analyze.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i3.iis.net/media/7279219/image1.png?cdn_id=2013-05-01-001"><img border="2" width="500" height="410" src="https://web.archive.org/web/20130604073815im_/http://i3.iis.net/media/7279219/image1.png?cdn_id=2013-05-01-001"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 1: Getting the ID of your web site</strong></td> </tr> </table> <p>Open Windows Explorer and navigate to the directory that contains the IIS log files of the website that experienced the performance problem. <i>Figure 2</i> shows how that might look like.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i2.iis.net/media/7279225/image2.png?cdn_id=2013-05-01-001"><img border="2" src="https://web.archive.org/web/20130604073815im_/http://i2.iis.net/media/7279225/image2.png?cdn_id=2013-05-01-001" width="500" height="379"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 2: IIS Log file location</strong></td> </tr> </table> <p>IIS log files can be quite large; for example, in <i>Figure 2</i>, the log file <i>u_ex12101858.log</i> is nearly 100MB in size. Because these log files may be huge and contain hundreds of thousands of individual log file entries, manually looking through each of these files for an error is not a good approach, and returns few results for the time that you invest.</p> <p>This is when LogParser becomes an indispensable tool in your troubleshooting arsenal.</p> <h2>Data Analysis</h2> <p>Your first step is to determine which log files may contain errors. For example, if customers were complaining about performance on the 3rd of June, 2012, the log file might be <i>u_ex120603.log</i>, where:</p> <ul> <li>"12" is the abbreviated year for 2012</li> <li>"06" refers to the sixth month (June)</li> <li>"03" is the 3rd day of the month</li> </ul> <p>Note: The above example assumes that IIS logging is configured to rotate log files on a daily basis, which is the default. If you have changed the settings for IIS to rotate log files on a different time interval, such as weekly or hourly, then the log files names would be different. For more information about the syntax for IIS log file names, please see the following article:</p> <p style="margin-left:20px"><strong>IIS Log File Naming Syntax</strong><br> <a href="https://web.archive.org/web/20130604073815/http://support.microsoft.com/kb/242898">http://support.microsoft.com/kb/242898</a></p> <p class="note">By default, the date and time in IIS logs are stored using GMT; you will need to take this into account when you are determining which logs contain errors. That being said, you can adjust the dates/times by using LogParser's <code>TO_LOCALTIME()</code> function, as illustrated in the following example:</p> <p style="margin-left:20px" class="note"><pre>logparser.exe "SELECT <mark>TO_STRING(TO_LOCALTIME(TO_TIMESTAMP(date,time)),'yyyy-MM-dd hh:mm:ss') AS LocalTime</mark>, COUNT(*) AS Hits FROM *.log WHERE date='2012-10-18' GROUP BY LocalTime ORDER BY LocalTime" -i:w3c</pre></p> <p>Once you have identified the IIS log files that contain errors, you should copy them to a location where they can be analyzed. This step is optional, but it is not recommended that you analyze your logs on your IIS server since your LogParser queries may take a long time to run, and if your log files are large then Log Parser may compete for system resources.</p> <p>For example, you might copy your IIS logs to a folder on your personal computer where you have already copied the LogParser files, which is how I typically analyze my log files. <i>Figure 3</i> shows an example of where I stored them to create this article.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i1.iis.net/media/7279231/image3.png?cdn_id=2013-05-01-001"><img border="2" src="https://web.archive.org/web/20130604073815im_/http://i1.iis.net/media/7279231/image3.png?cdn_id=2013-05-01-001" width="500" height="226"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 3: IIS Logs files locally hosted for analysis using LogParser</strong></td> </tr> </table> <p>After you have downloaded LogParser, you are ready to begin the analysis. The first query I run is shown in <i>Figure 4</i>. The results give you an overview of how IIS has been responding to the requests.</p> <pre>logparser.exe "SELECT sc-status, sc-substatus, COUNT(*) FROM *.log GROUP BY sc-status, sc-substatus ORDER BY sc-status" -i:w3c sc-status sc-substatus COUNT(ALL *) --------- ------------ ------------ 200       0            3920658 206       0            2096 301       0            1031 302       0            65386 304       0            178705 400       0            35 401       2            692096 404       0            2935 404       11           7 405       0            1 406       0            36 500       0            11418 Statistics: ----------- Elements processed: 4189228 Elements output:    12 Execution time:     7.70 seconds</pre> <p><strong>Figure 4: LogParser Query (<i>sc-status and sc-substatus</i>)</strong></p> <p>The points of interest within the results are:</p> <ul> <li>The ratio between 200 and 304 HTTP status codes (successful requests)</li> <li>The number of 500 HTTP status codes (failed requests)</li> </ul> <p>The significance for each of these status codes is explained below.</p> <h3>The Ratio Between HTTP 200 and 304 Status Codes (Analyzing Successful Requests)</h3> <p>The ratio between the 200 and 304 HTTP status codes is important because it shows how many requests are being retrieved from the clients' cache instead of directly from the server. The results in <i>Figure 4</i> show that there are 3,920,658 requests which resulted in an HTTP Status code of 200. This means that the requested file was served from the server each time. In contrast, there were 178,705 requests which resulted in a 304 HTTP status code. This means that the requested file was retrieved from the local cache. In other words, 95.5% of the requests are being handled from the server.</p> <p>Caching can have some very positive impact on your system's performance; please see the details for both static and dynamic compression in the following article:</p> <p style="margin-left:20px"><strong>Configuring HTTP Compression in IIS 7</strong><br> <a href="https://web.archive.org/web/20130604073815/http://technet.microsoft.com/en-us/library/cc771003.aspx">http://technet.microsoft.com/en-us/library/cc771003.aspx</a></p> <h3>HTTP 500 Status Codes (Analyzing Failed Requests)</h3> <p>HTTP 500 Status codes may indicate serious issues on your system. The level of impact that the root cause of an HTTP 500 error may have on your system can range from nothing to the crash of a worker process. Therefore, when you see these, you should execute the query shown in <i>Figure 5</i> in order to find which requests resulted in a 500 HTTP Status code.</p> <pre>logparser.exe "SELECT cs-uri-stem, COUNT(*) FROM *.log WHERE sc-status=500 GROUP BY cs-uri-stem ORDER BY COUNT(*) DESC" -i:w3c cs-uri-stem                 COUNT(ALL *) --------------------------- ------------ /ShoppingCart/ViewCart.aspx 1378 /DataService.asmx           1377  /Start/default.aspx         949 /GetDetailsView.aspx        753 /Details/ImageUrls.asmx     722 Statistics: ----------- Elements processed: 4189228 Elements output:    5 Execution time:     24.89 seconds</pre> <p><strong>Figure 5: LogParser Query (<i>cs-uri-stem with a 500 sc-status</i>)</strong></p> <p>These results show the path and the name of the file which, when requested, responded with an HTTP 500 Status code. This kind of information would be valuable to the development team. For example, the development team could look further into that specific code and search for code that executes without being contained in a <code>try {...} catch {...}</code> code block, or they are executing large data queries which need to be optimized.</p> <p>Let's take this example a step further and focus on the top contributor for HTTP 500 Status codes. It would be interesting to know when these errors occurred, because this information can be used to check if dependencies were having any problems at the same time.</p> <pre>logparser.exe "SELECT TO_STRING(TO_TIMESTAMP(date,time),'yyyy-MM-dd hh') AS Hour, COUNT(*) FROM *.log WHERE sc-status=500 AND cs-uri-stem='/Start/default.aspx' AND date='2012-10-18' GROUP BY Hour ORDER BY Hour" -i:w3c Hour          COUNT(ALL *) ------------- ------------ 2012-10-18 08 191 2012-10-18 09 163 2012-10-18 14 150 Statistics: ----------- Elements processed: 4189228 Elements output:    3 Execution time:     6.36 seconds</pre> <p><strong>Figure 6: LogParser Query (<i>cs-uri-stem with a 500 sc-status</i>)</strong></p> <p>The subset of results in <i>Figure 6</i> restricts the date range of the issue. This information can be passed along to network, database, operating system administrators and the development teams to check if anything else was happening at that same time. For example: <i>Were there any additional problems between 08:00 and 09:59:59 GMT and between 14:00:00 and 14:59:59 GMT</i>?</p> <p>The next set of LogParser queries utilize the following fields, which may give better insight into performance problems:</p> <table style="margin-left:20px" border="1" cellspacing="0" cellpadding="0"> <tr> <th> Field </th> <th> Description </th> <th> Enabled by default </th> </tr> <tr> <th> time-taken </th> <td> The length of time the action took, in milliseconds </td> <td> Yes </td> </tr> <tr> <th>sc-bytes </th> <td> The number of bytes sent by the server </td> <td> No </td> </tr> <tr> <th>cs-bytes</th> <td> The number of bytes the server received </td> <td> No </td> </tr> </table> <p>As mentioned before, take the time now to request the sc-bytes and cs-bytes fields be enabled or, if possible, enable them yourself. They provide some valuable insight into your system and its' behavior. Take <i>Figure 7</i>, for example. You see that the average time is pretty good at a few hundred milliseconds. However, look at the maximum time-taken, that is way too much time. </p> <pre>logparser.exe "SELECT  cs-method, COUNT(*) AS TotalCount, MAX(time-taken) AS MaximumTime, AVG(time-taken) AS AverageTime FROM *.log GROUP BY cs-method ORDER BY TotalCount DESC" -i:w3c cs-method TotalCount MaximumTime AverageTime --------- ---------- ----------- ----------- GET       3172034    1366976     153 POST      1011765    256539      359  HEAD      5363       26750       209  Statistics: ----------- Elements processed: 4189228 Elements output:    3 Execution time:     6.36 seconds</pre> <p><strong>Figure 7: LogParser Query (MAX and AVG <i>time-taken</i>)</strong></p> <p>I know you are asking yourself already the next question that needs to be answered. Which request is taking so much time? <i>Figure 8</i> shows the answer to that question. As you will notice, I have gone ahead and included the sc-bytes field in the LogParser query. Remember, sc-bytes represents the size of the file sent from the server back to the client.</p> <pre>logparser.exe "SELECT cs-uri-stem, time-taken, sc-bytes FROM *.log WHERE time-taken > 250000 ORDER BY time-taken DESC" -i:w3c cs-uri-stem                 time-taken sc-bytes --------------------------- ---------- -------- /ShoppingCart/ViewCart.aspx 1366976    256328 /DataService.asmx           1265383    53860 /Start/default.aspx         262796     8077 /GetDetailsView.aspx        261305     5038 /Details/ImageUrls.asmx     256539     2351 Statistics: ----------- Elements processed: 4189228 Elements output:    5 Execution time:     8.98 seconds</pre> <p><strong>Figure 8: LogParser Query (<i>MAX and AVG time-taken</i>)</strong></p> <p>We would likely all agree that the time-taken for the requests exceeds a 'normal' response time. However, the size of the files is something which the administrator or developer would need to analyze to determine if the sizes are within an acceptable range.</p> <p>The conclusion is that the GetDetailsView.aspx file has been throwing a number of 500 HTTP Status codes and has at some point taken a long time to complete, even though it was a relatively small file. You may want to look at the date and time when problems where occurring for this file, and examine the code in the file with any issues that occurred. (For example, the IIS logs contain a list of variables that were passed in the query string; you could check those values for bad data.)</p> <p>The examples provided in figures 4 - 8 help gain an understanding around where the root cause of an issue may exist. It is likely, however, that this analysis has only rendered a better view of the situation which will lead to more questions and deeper analysis. If that's the case you may want to create a representation of this data in a more presentable manner. The following section covers this in detail.</p> <h2>Reporting</h2> <p>Screenshots of a command window containing LogParser queries and their results may be fine during the analysis phase of a performance problem; however, if you need to go in front of managers or directors to explain what happened, it may not meet the mark.</p> <div class="note"> <p>Note: In order to get charting to work via LogParser, you will need to install the Office Web Components. The following articles explain how to do this:</p> <ul> <li><a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/robert_mcmurray/archive/2012/05/25/advanced-log-parser-charts-part-3-missing-office-web-components-for-charting.aspx">Advanced Log Parser Charts Part 3 - Missing Office Web Components for Charting</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/carloc/archive/2008/08/07/charting-with-logparser.aspx">Charting with LogParser</a></li> </ul> </div> <p><i>Figure 9</i> shows the LogParser query to create a 3D pie chart containing the number of requests and their associated HTTP Status code. I removed status 200, as those are successful. What I am after here are the requests which are something other than OK.</p> <pre>logparser.exe "SELECT sc-status AS Status, COUNT(*) AS Count INTO status.gif FROM *.log WHERE sc-status > 200 GROUP BY Status ORDER BY Status" -i:w3c -o:CHART -chartType:PieExploded3D -ChartTitle:"Request Status" Statistics: ----------- Elements processed: 4189228 Elements output:    10 Execution time:     6.20 seconds</pre> <p><strong>Figure 9: LogParser Query (Create a 3D pie chart)</strong></p> <p>The result of the query is illustrated in <i>Figure 10</i>. There are a number of additional parameters which you can pass to LogParser that affect the image. For example, legend, groupSize, config, etc... To get a complete list enter: <strong><i>LogParser -h -o:CHART</i></strong> for a list of all parameters. This command will also provide a list of the different chart types.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i2.iis.net/media/7279237/image10.png?cdn_id=2013-05-01-001"><img border="2" width="500" height="372" src="https://web.archive.org/web/20130604073815im_/http://i2.iis.net/media/7279237/image10.png?cdn_id=2013-05-01-001"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 10: LogParser 3D pie chart</strong></td> </tr> </table> <p>Another useful chart is the ratio between cached and actual requests. Recall from the Data Analysis section where I discussed that an HTTP Status code of 200 means that the requested files are retrieved from the server however, a 304 is retrieved from the client. <i>Figure 11</i> shows the LogParser query for the creation of this chart. Notice that I used the <strong>-values</strong> parameter.</p> <pre>logparser.exe "SELECT sc-status AS Status, COUNT(*) AS Count INTO cache.gif FROM *.log WHERE sc-status=200 OR sc-status=304 GROUP BY Status ORDER BY Status" -i:w3c -o:CHART -chartType:PieExploded3D -ChartTitle:"Cache" -values:ON Statistics: ----------- Elements processed: 4189228 Elements output:    2 Execution time:     6.35 seconds</pre> <p><strong>Figure 11: LogParser Query (Create a 3D pie chart)</strong></p> <p>Although the difference between HTTP Status code 200 and 304 are clearly visible, I thought it may add some value to include the number of hits for each. <i>Figure 12</i> illustrates the output of the previous LogParser query.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i1.iis.net/media/7279243/image12.png?cdn_id=2013-05-01-001"><img border="2" width="500" height="375" src="https://web.archive.org/web/20130604073815im_/http://i1.iis.net/media/7279243/image12.png?cdn_id=2013-05-01-001"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 12: LogParser 3D pie chart</strong></td> </tr> </table> <p>I think you are getting the picture now about how charting the IIS Logs using LogParser can help convey what is happening much better than a table of data. But before I stop, I want to show you one more example using the Column chart type. The LogParser query shown in <i>Figure 13</i> produces a 3D Column chart showing the count of 500 HTTPS Status codes per hour.</p> <pre>logparser.exe "SELECT to_string(to_timestamp(date, time), 'yyyy-MM-dd hh') AS Hour, COUNT(*) AS Count INTO 500.gif FROM *.log WHERE sc-status=500 GROUP BY Hour ORDER BY Hour" -i:w3c -o:CHART -chartType:Column3D -ChartTitle:"500 Errors by Hour" Statistics: ----------- Elements processed: 4189228 Elements output:    13 Execution time:     6.32 seconds</pre> <p><strong>Figure 13: LogParser Query (Create a 3D column chart)</strong></p> <p>The resulting chart is illustrated in <i>Figure 14</i>.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i1.iis.net/media/7279249/image14.png?cdn_id=2013-05-01-001"><img border="2" width="500" height="375" src="https://web.archive.org/web/20130604073815im_/http://i1.iis.net/media/7279249/image14.png?cdn_id=2013-05-01-001"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 14: LogParser 3D column chart</strong></td> </tr> </table> <h3>Creating charts using Excel and CSV</h3> <p>At the beginning of this section I mentioned that the installation of the Office Web Component (OWC) is a requirement if you want to use the LogParser charting capabilities. In your organization, there may be restrictions that prohibit this or you simply might not want to install it. If either is the case, then consider exporting the LogParser query result to a CSV file and import it into Excel.</p> <p><i>Figure 15</i> shows the LogParser query that extracts the HTTP Status codes for all request which are not 200 to a CSV file.</p> <pre>logparser.exe "SELECT sc-status AS Status, COUNT(*) AS Count INTO status.csv FROM *.log WHERE sc-status > 200 GROUP BY Status ORDER BY Status" -i:w3c -o:csv Statistics: ----------- Elements processed: 4189228 Elements output:    10 Execution time:     6.20 seconds</pre> <p><strong>Figure 15: LogParser Query (Create a CSV file for import into Excel)</strong></p> <p>Notice in <i>Figure 15</i> that I used the -o parameter so that LogParser creates the output in CSV format.</p> <p>To import the CSV file into Excel so that a chart can be created from it, open Excel, navigate to the DATA tab and select From Text. <i>Figure 16</i> shows what this looks like.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i2.iis.net/media/7279255/image16.png?cdn_id=2013-05-01-001"><img border="2" width="500" height="181" src="https://web.archive.org/web/20130604073815im_/http://i2.iis.net/media/7279255/image16.png?cdn_id=2013-05-01-001"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 16: Import CSV file created by LogParser into Excel</strong></td> </tr> </table> <p>Select the status.csv file created by the LogParser query and navigate through the import wizard. Import the 'comma' delimited CSV file and you will end up with the Status in column A and the number of occurrences for each status in column B. This assumes you executed the LogParser query shown in <i>Figure 15</i>. Lastly, select all the data from column A and B, including the headers and choose the type of Pie chart to create. <i>Figure 17</i>, illustrates how this may look.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i2.iis.net/media/7279261/image17.png?cdn_id=2013-05-01-001"><img border="2" width="500" height="238" src="https://web.archive.org/web/20130604073815im_/http://i2.iis.net/media/7279261/image17.png?cdn_id=2013-05-01-001"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 17: Create a Pie chart using a CSV file</strong></td> </tr> </table> <p>The end result is a Pie chart, <i>Figure 18</i> that is similar to that shown previously in <i>Figure 10</i>. There are many options in regards to color, chart type, labels, etc... With a click of a button you can change the chart type from Pie to Bar or to Line. There are a lot of options for creating professional looking charts within Excel.</p> <table style="margin-left:20px" border="1"> <tr> <td align="center" valign="top"><a href="https://web.archive.org/web/20130604073815/http://i3.iis.net/media/7279267/image18.png?cdn_id=2013-05-01-001"><img border="2" width="498" height="343" src="https://web.archive.org/web/20130604073815im_/http://i3.iis.net/media/7279267/image18.png?cdn_id=2013-05-01-001"></a></td> </tr> <tr> <td align="center" valign="top"><strong>Figure 18: A Pie chart using a CSV file similar to <i>Figure 10</i></strong></td> </tr> </table> <p>There are so many options and possibilities for analyzing and presenting the results of that analysis using LogParser. For some additional tips and examples, check out these <a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/robert_mcmurray/archive/tags/logparser/">articles</a> written by Robert McMurray. There is also a very useful help file and many prewritten scripts provided within the installation package of LogParser. The next section will discuss this and other topics in more detail.</p> <h2>Help</h2> <p>When you install LogParser 2.2 onto your machine, it installs by default into the C:\Program Files (x86)\Log Parser 2.2 directory. Navigate to that location and review the Samples\Queries and Samples\Scripts directories for an abundant supply of prewritten code that will get you moving fast.</p> <p>You will also realize a great benefit by reading through the contents within the LogParser.chm file.</p> <h3>Reducing the size of or splitting IIS log files</h3> <p>You may encounter a situation where the IIS log file is too big for LogParser to query. This is most likely on a 32-bit machine, but can happen on a 64-bit machine too. Nonetheless, if you experience 'out of memory' errors when running a LogParser query, consider executing the command shown in <i>Figure 19</i>. The query extracts some essential fields from a large IIS log file and places them into another, which results in a smaller log file.</p> <pre>logparser.exe "SELECT date, time, c-ip, cs-uri-stem, cs-uri-query, sc-status, sc-substatus, sc-win32-status, sc-bytes, cs-bytes, time-taken INTO u_exJUSTRIGHT.log FROM u_exTOOBIG.log" -i:w3c -o:w3c Statistics: ----------- Elements processed: 19712301 Elements output:    19712301 Execution time:     3.07 seconds</pre> <p><strong>Figure 19: Reducing the size of an IIS log file (by removing fields)</strong></p> <p>In this example, I realized a file size reduction of about 45%. In many cases this may be enough, in others maybe not. It depends on the size of the original log file. If you find that you still need to reduce the size of the IIS log file, consider adding a date time constraint to the LogParser query as shown in <i>Figure 20</i>.</p> <pre>logparser.exe "SELECT date, time, c-ip, cs-uri-stem, cs-uri-query, sc-status, sc-substatus, sc-win32-status, sc-bytes, cs-bytes, time-taken INTO u_exJUSTRIGHT.log FROM u_exTOOBIG.log WHERE to_timestamp(date, time) >= timestamp('2012-11-09 00:00:00', 'yyyy-MM-dd hh:mm:ss')" -i:w3c -o:w3c Statistics: ----------- Elements processed: 240123 Elements output:    240123 Execution time:     0.45 seconds</pre> <p><strong>Figure 20: Further reducing the size of an IIS log file by adding a WHERE clause</strong></p> <p>This is a valuable technique for reducing the file size, but it is also useful to remove unwanted entries from the IIS Log. For example, when beginning to troubleshoot an issue you realize that time-take, sc-bytes and cs-bytes were not being logged. You enabled them in IIS and want the query to only analyze those entries with the recently enabled fields. Use the where statement to extract the data from the IIS log file from the time in which those fields have been enabled. This is important when you use the AVG, MIN and MAX aggregates.</p> <h2>Conclusion</h2> <p>LogParser is a small but powerful tool to analyze a number of different system log types. This article focused on queries applicable to IIS Logs.  When performance problems or errors are experienced in your IIS environment, it is sometimes difficult to know where to start.</p> <p>LogParser can be used as a starting point, because a system administrator who has some SQL skills can quickly build some very sophisticated LogParser queries. These queries can be used to further the root cause analysis of the problem.</p> <h2>Useful Links</h2> <p>Here are the links which are referred to in this article, plus a few links with additional information.</p> <ul> <li><strong>Microsoft LogParser</strong><br> <a href="https://web.archive.org/web/20130604073815/http://www.bing.com/search?q=logparser">http://www.bing.com/search?q=logparser</a> or <a href="https://web.archive.org/web/20130604073815/http://www.microsoft.com/en-us/download/details.aspx?id=24659">http://www.microsoft.com/en-us/download/details.aspx?id=24659</a></li> <li><strong>The HTTP status codes in IIS 7.0, IIS 7.5, and IIS 8.0</strong><br> <a href="https://web.archive.org/web/20130604073815/http://support.microsoft.com/kb/943891">http://support.microsoft.com/kb/943891</a></li> <li><strong>Modifying IIS 7 log data in Windows 2008</strong><br> <a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/benjaminperkins/archive/2012/08/01/modifying-iis-7-log-data-in-windows-2008.aspx">http://blogs.msdn.com/b/benjaminperkins/archive/2012/08/01/modifying-iis-7-log-data-in-windows-2008.aspx</a></li> <li><strong>Modifying IIS 6 log data in Windows 2003</strong><br> <a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/benjaminperkins/archive/2012/05/03/modifying-iis-6-log-data-in-windows-2003.aspx">http://blogs.msdn.com/b/benjaminperkins/archive/2012/05/03/modifying-iis-6-log-data-in-windows-2003.aspx</a></li> <li><strong>Configuring HTTP Compression in IIS 7</strong><br> <a href="https://web.archive.org/web/20130604073815/http://technet.microsoft.com/en-us/library/cc771003.aspx">http://technet.microsoft.com/en-us/library/cc771003.aspx</a></li> <li><strong>Charting with LogParser using OWC</strong><br> <a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/carloc/archive/2008/08/07/charting-with-logparser.aspx">http://blogs.msdn.com/b/carloc/archive/2008/08/07/charting-with-logparser.aspx</a></li> <li><strong>Robert McMurray's Blogs on LogParser</strong><br> <a href="https://web.archive.org/web/20130604073815/http://blogs.msdn.com/b/robert_mcmurray/archive/tags/logparser/">http://blogs.msdn.com/b/robert_mcmurray/archive/tags/logparser/</a></li> <li><strong>Microsoft Log Parser Toolkit: A Complete Toolkit for Microsoft's Undocumented Log Analysis Tool</strong><br> <a href="https://web.archive.org/web/20130604073815/http://www.amazon.com/Microsoft-Log-Parser-Toolkit-undocumented/dp/1932266526">http://www.amazon.com/Microsoft-Log-Parser-Toolkit-undocumented/dp/1932266526</a></li> </ul><aside id="author-info" class="about-author"><h1>By聽Benjamin Perkins</h1><p><img src="https://web.archive.org/web/20130604073815im_/http://i1.iis.net/media/7279216/image21.jpeg?cdn_id=2013-05-01-001" alt="Benjamin Perkins"/>Benjamin Perkins is a co-author of 'Professional Microsoft IIS 8' and is an expert on IIS and ASP.NET. Benjamin is employed by Microsoft and is a Senior Support Escalation Engineer on the IIS and ASP.NET team.</p></aside></article> </section> <section class="col-right"> <div id="FeaturedAd" data-adzoneid="12693" data-adtypeid="5" class="ad-300x250 " data-adwidth="300px" data-adheight="250px" style="width:300px;height:250px;"></div> <nav class="nav-base nav-iconed"><h1>Table of Contents</h1><h2>Installation Issues</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/installation-issues/troubleshooting-iis-7x-installation-issues"><span><span class="icon icon-article">Article</span></span>Troubleshooting IIS 7.x Installation Issues</a></li></ul><h2>Security Issues</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/security-issues/troubleshooting-ssl-related-issues-server-certificate"><span><span class="icon icon-article">Article</span></span>Troubleshooting SSL related issues (Server Certificate)</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/security-issues/troubleshooting-forms-authentication"><span><span class="icon icon-article">Article</span></span>Troubleshooting Forms Authentication</a></li></ul><h2>ASP.NET Issues</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/aspnet-issues/troubleshooting-invalid-viewstate-issues"><span><span class="icon icon-article">Article</span></span>Troubleshooting Invalid viewstate issues</a></li></ul><h2>Diagnosing HTTP Errors</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/diagnosing-http-errors/how-to-use-http-detailed-errors-in-iis"><span><span class="icon icon-article">Article</span></span>How to Use HTTP Detailed Errors in IIS 7.0</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/diagnosing-http-errors/troubleshooting-http-5022-bad-gateway-error-in-cgi-applications"><span><span class="icon icon-article">Article</span></span>Troubleshooting HTTP 502.2 Bad Gateway error in CGI applications</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/diagnosing-http-errors/troubleshooting-unexpected-issues"><span><span class="icon icon-video">Video</span></span>Troubleshooting Unexpected Issues</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/diagnosing-http-errors/troubleshooting-http-400-errors-in-iis"><span><span class="icon icon-article">Article</span></span>Troubleshooting HTTP 400 Errors in IIS</a></li></ul><h2>Using Failed Request Tracing</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/how-to-enable-failed-request-tracing-for-unc-hosting"><span><span class="icon icon-article">Article</span></span>How to Enable Failed Request Tracing for UNC Hosting</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshooting-failed-requests-using-tracing-in-iis"><span><span class="icon icon-article">Article</span></span>Troubleshooting Failed Requests Using Tracing in IIS 7</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/using-failed-request-tracing-rules-to-troubleshoot-application-request-routing-arr"><span><span class="icon icon-article">Article</span></span>Using Failed Request Tracing Rules to Troubleshoot Application Request Routing (ARR)</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/using-failed-request-tracing/troubleshoot-with-failed-request-tracing"><span><span class="icon icon-article">Article</span></span>Troubleshoot with Failed Request Tracing</a></li></ul><h2>Performance Issues</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-smb-netbios-fcn-limit-issues-with-remote-content"><span><span class="icon icon-article">Article</span></span>Troubleshooting SMB NetBIOS/FCN limit issues with Remote Content</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-high-cpu-in-an-iis-7x-application-pool"><span><span class="icon icon-article">Article</span></span>Troubleshooting High CPU in an IIS 7.x Application Pool</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-native-memory-leak-in-an-iis-7x-application-pool"><span><span class="icon icon-article">Article</span></span>Troubleshooting native memory leak in an IIS 7.x Application Pool</a></li><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-iis-compression-issues-in-iis6-iis7x"><span><span class="icon icon-article">Article</span></span>Troubleshooting IIS Compression issues in IIS6/IIS7.x</a></li><li class="current"><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/performance-issues/troubleshooting-iis-performance-issues-or-application-errors-using-logparser"><span><span class="icon icon-article">Article</span></span>Troubleshooting IIS Performance Issues or Application Errors using LogParser</a></li></ul><h2>Remote Administration Issues</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/remote-administration-issues/diagnosing-failures-with-remote-administration"><span><span class="icon icon-article">Article</span></span>Diagnosing Failures with Remote Administration</a></li></ul><h2>Web Platform Installer Issues</h2><ul><li><a href="/web/20130604073815/http://www.iis.net/learn/troubleshoot/web-platform-installer-issues/troubleshooting-problems-with-microsoft-web-platform-installer"><span><span class="icon icon-article">Article</span></span>Troubleshooting Problems with Microsoft Web Platform Installer</a></li></ul></nav> <p id="MicroTextAd" data-adzoneid="0" data-adtypeid="348" class="ad-text " data-adwidth="100%" data-adheight="40px" style="height:40px;"></p> <div id="MicrosoftTranslatorWidget"><noscript><a href="https://web.archive.org/web/20130604073815/http://www.microsofttranslator.com/bv.aspx?a=http%3a%2f%2fwww.iis.net%2f">Translate this page</a><br/>Powered by <a href="https://web.archive.org/web/20130604073815/http://www.microsofttranslator.com/">Microsoft庐 Translator</a></noscript></div> <script type="text/javascript"> /* <![CDATA[ */ setTimeout(function() { var s = document.createElement("script"); s.type = "text/javascript"; s.charset = "UTF-8"; s.src = ((location && location.href && location.href.indexOf('https') == 0) ? "https://web.archive.org/web/20130604073815/https://ssl.microsofttranslator.com" : "https://web.archive.org/web/20130604073815/http://www.microsofttranslator.com" ) + "/ajax/v2/widget.aspx?mode=manual&from=en&layout=ts"; var p = document.getElementsByTagName('head')[0] || document.documentElement; p.insertBefore(s, p.firstChild); }, 0); /* ]]> */ </script> </section> </div> <div id="BottomAd" data-adzoneid="0" data-adtypeid="4" class="ad centered-ad-728" data-adwidth="728px" data-adheight="90px" style="width:728px;height:90px;"></div> <footer id="footer-site"> <ul> <li class="text-links">This site is managed for Microsoft by Neudesic, LLC. | 漏 2013 Microsoft. All rights reserved.</li> <li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/privacy">Privacy Statement</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/terms-of-use">Terms of Use</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/contact">Contact Us</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.neudesicmediagroup.com/Advertising.aspx?site=iis">Advertise With Us</a></li> </ul> <ul> <li>Follow us on:</li> <li><a href="https://web.archive.org/web/20130604073815/http://www.twitter.com/inetsrv/">Twitter</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://facebook.com/inetsrv/">Facebook</a></li> </ul> <ul class="no-title"> <li><a href="https://web.archive.org/web/20130604073815/http://forums.iis.net/1080.aspx">Feedback on IIS</a></li> <li><a href="https://web.archive.org/web/20130604073815/http://www.iis.net/learn">Powered by IIS8</a></li> </ul> <a href="https://web.archive.org/web/20130604073815/http://microsoft.com/" class="logo-footer">Microsoft</a> </footer> </div> <input type="hidden" id="meta-contentType" value="ArticleContentPicker"/> <input type="hidden" id="meta-contentLiveDate" value="2012-12-18"/> <input type="hidden" id="meta-articleContentType" value="Tutorial"/> <input type="hidden" id="meta-articleContentTypeValue" value="32"/> <script src="https://web.archive.org/web/20130604073815js_/http://i1.iis.net/umbraco-beta-scripts/jquery-1.8.2.min.js?cdn_id=2013-05-01-001" type="text/javascript"></script> <script type="text/javascript">$.ajaxSetup({ cache: false });var omni_guid="7be61f04-a606-46ea-b947-66e755ac1529";var searchDomain='https://web.archive.org/web/20130604073815/http://www.iis.net';</script> <script type="text/javascript">var s=document.createElement('script');s.type='text/javascript';s.src='https://web.archive.org/web/20130604073815/http://i1.iis.net/umbraco-beta-scripts/prod-article.min.js?cdn_id=2013-05-01-001';document.body.appendChild(s);</script> <noscript><a href="https://web.archive.org/web/20130604073815/http://www.omniture.com/" title="Web Analytics"><img src="https://web.archive.org/web/20130604073815im_/http://msstonojstemp.112.2o7.net/b/ss/msstonojstemp/1/H.20.2--NS/0" height="1" width="1" alt=""/></a></noscript> </body> </html>