Video Screencast Help
Archiving and eDiscovery Community Blog

A Little Bit of Reporting

Created: 12 Jul 2012 • Updated: 29 May 2014 • 2 comments
Rob.Wilcox's picture
+1 1 Vote
Login to vote

I have written before about the greatness that embodied within Log Parser. It is a fantastic tool. When I was asked the following questions, I immediately turned for Log Parser. The questions were:

· Number of people connecting to the search web site:

· Number of restore from the web site

· Number of retrieve from the users

So here is how to answer it. First of all, download and install Log Parser ‘somewhere’. It doesn’t have to be on your Enterprise Vault, Log Parser can read the logs via a UNIC path. For simplicity it’s what I did though (so you could try it too).

Download- Log Parser 2.2 - Microsoft Download Center

Over time I’ve found that often the easiest way to run Log Parser is to put the SQL you want to execute in to a file, and then call/run it from a command line. Here are the SQL files that I created:

searches.sql

/* */
/* Output the number of searches per day (including search.asp, and searcho2k.asp) */
/* */

select
TO_DATE(QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(date, time)), 86400)) AS Day,
count(*) as Hits
from
C:\WINDOWS\system32\LogFiles\W3SVC1\*
where
cs-uri-stem like '%search%.asp'
and
sc-status = 200
group By
Day

restores.sql

/* */
/* Output the number of restores per day (restoreo2k.asp) */
/* */

select
TO_DATE(QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(date, time)), 86400)) AS Day,
count(*) as Hits
from
C:\WINDOWS\system32\LogFiles\W3SVC1\*
where
cs-uri-stem like '%restoreo2k.asp'
and
sc-status = 200
group By
Day

retrievals.sql

/* */
/* Output the number of retrievals per day (download.asp) */
/* */

select
TO_DATE(QUANTIZE(TO_LOCALTIME(TO_TIMESTAMP(date, time)), 86400)) AS Day,
count(*) as Hits
from
C:\WINDOWS\system32\LogFiles\W3SVC1\*
where
cs-uri-stem like '%download.asp'
and
sc-status = 200
group By
Day

To run those you issue commands like :

logparser –i:w3c file:searches.sql –stats:off

This gives output like this:

Day Hits
---------- ----
2012-06-20 1
2012-06-28 3
2012-06-29 3
2012-07-09 1

That’s quite good I think. In a future blog I’ll show you how to make this more awesome.

Comments 2 CommentsJump to latest comment

EnterpriseUser123's picture

More awesome?  This IS awesome. Thank you for contributing to the community, I'll be testing these in my environment to see if I can emulate it.

+1
Login to vote
Rob.Wilcox's picture

Thanks for the kind comment.

 

The more awesome version = a live web page with today's stats on it....  is in progress.  The pages/app are done, I'm just fiddling around testing it.

+1
Login to vote