Configuring Microsoft Log Parser to look for 500 server errors

This Log Parser query assumes that the logs are in c:\logs\web and that IIS has been configured to log in Microsoft's W3C extended log format.  With modified syntax this query could be used to analyze log files in other formats.

The query can be run from a DOS prompt within the Log Parser installation folder.  To save excessive typing or pasting into command prompt windows the whole query can be saved as a .bat file.

logparser "SELECT [cs-uri-stem], [cs-uri-query], Count(*) AS [Hits]
FROM c:\logs\web\ex*.log
WHERE sc-status = 500
GROUP BY [cs-uri-stem], [cs-uri-query]
order by [hits], [cs-uri-stem] DESC" -rtp:-1 -i:iisw3c

Once the query has been put into a batch file (Find500Errors.bat), it can be run using the following when typed at the command prompt (which will produce an output file called 500Errors.txt).

Find500Errors.bat > 500Errors.txt

The query output

The 500 server errors Log Parser query shown above creates a report like the following:

/w/Products.ASPNETDocumentationTool.asp|-|ASP_0113|Script_timed_out 18

/w/Products.ASPDocumentationTool.asp |-|ASP_0113|Script_timed_out 18

/w/Products.IndexServerCompanion.SampleSearch.asp|33|800a01f4|Variable_is_undefined:_'LogEvent' 11

/w/News.asp|-|ASP_0113|Script_timed_out 5

/w/Affiliates.asp|-|ASP_0113|Script_timed_out 5

/w/Products.IndexServerCompanion.SampleSearch.aspquery=the&I1.x=0&I1.y=0|126|80041605|
The_query_contained_only_ignored_words._ 4

/w/Products.IndexServerCompanion.Download.aspAction=Step2|48|800a0bcd|
Either_BOF_or_EOF_is_True__or_the_current_record_has_been_deleted.
_Requested_operation_requires_a_current_record. 4

/w/Products.ASPDocumentationTool.Screenshots.asp |-|ASP_0113|Script_timed_out 4

/w/Downloads.asp |108|8007000e|[Microsoft][ODBC_Microsoft_Access_Driver]_Not_enough_space_on_temporary_disk. 2

/w/Downloads.asp |108|80004005|Unspecified_error 2

For each of the errors it reports the page on which the error was encountered, the details of the error and the number of times each page reported the particular error.  Due to the query's order by clause, the most common errors are listed first.  The group by clause is used to group identical errors from each page.

As may be seen from this sample output, a comprehensive overview of the website's problems may be gained.  In this particular example the number of timeout errors would indicate that the website has significant performance issues.  Other errors in this sample include an ASP coding error ("Variable_is_undefined") and an Indexing Services error ("The_query_contained_only_ignored_words").  Fixing these errors could lead to significant enhancement of the user's experience of the website.

Get more information

Can't find what you're looking for? Try Google Search!

	Web eshwar123.blogspot.com