Discussion:
How to parse the iis log files ?
(too old to reply)
Fernando Conde
2009-03-11 16:00:17 UTC
Permalink
Hi,

i want that every time that , for example, event 500 appears in the log of
iis "ex000000.log" generates an alert.

I think to do this with a script.

I dont know exactly how to do this but i think than someone think about this
before and perharps can show me the right way.

Regards.
Anders Bengtsson [MVP]
2009-03-12 07:12:03 UTC
Permalink
Hello Fernando,

You can do that with a monitor looking at a logfile, there is a default monitor
type for that. Dont need a script to monitor a logfile. If event 500 is a
specified word or line.


Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se
Post by Fernando Conde
Hi,
i want that every time that , for example, event 500 appears in the
log of iis "ex000000.log" generates an alert.
I think to do this with a script.
I dont know exactly how to do this but i think than someone think
about this before and perharps can show me the right way.
Regards.
Fernando Conde
2009-03-12 09:08:01 UTC
Permalink
But in the logfiles types only shows text an CSV. In this case , IIS, in the
monitor can i choose the parameter to meets that i want?
For example, if i want to detect http response 500, the parameter
sc-status=500. If i put this in the expression box , this could works?
Post by Anders Bengtsson [MVP]
Hello Fernando,
You can do that with a monitor looking at a logfile, there is a default monitor
type for that. Dont need a script to monitor a logfile. If event 500 is a
specified word or line.
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se
Post by Fernando Conde
Hi,
i want that every time that , for example, event 500 appears in the
log of iis "ex000000.log" generates an alert.
I think to do this with a script.
I dont know exactly how to do this but i think than someone think
about this before and perharps can show me the right way.
Regards.
Nathan Downey [MSFT]
2009-03-12 18:45:18 UTC
Permalink
To be more specific there are a number of potential ApplicationLog monitors
that you can use. These are stored in the System.ApplicationLog.Library MP

There are monitors for reading Binary/GenericCSV/HTTP/FTP logs.

There are examples on how to use GenericCSVLog Monitors here:
http://technet.microsoft.com/en-us/library/dd391805.aspx

To summarize:
Set LogFileDirectory and LogFilePattern to specify your IIS logfile. Set the
seperator to match that in the IIS log. The monitor will split the logfiles
entries based on the seperator you selected and insert them into
Param1;Param2;Param3 etc... So in your expression you can say somthing like
Param1 Equal 500.

-Nathan Downey [MSFT]
Post by Fernando Conde
But in the logfiles types only shows text an CSV. In this case , IIS, in the
monitor can i choose the parameter to meets that i want?
For example, if i want to detect http response 500, the parameter
sc-status=500. If i put this in the expression box , this could works?
Post by Anders Bengtsson [MVP]
Hello Fernando,
You can do that with a monitor looking at a logfile, there is a default monitor
type for that. Dont need a script to monitor a logfile. If event 500 is a
specified word or line.
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se
Post by Fernando Conde
Hi,
i want that every time that , for example, event 500 appears in the
log of iis "ex000000.log" generates an alert.
I think to do this with a script.
I dont know exactly how to do this but i think than someone think
about this before and perharps can show me the right way.
Regards.
Anders Bengtsson [MVP]
2009-03-13 08:20:39 UTC
Permalink
Hello Fernando,

You can configure the monitor to look for sc-status=500 , as Fernando MSFT
wrote

Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se
Post by Fernando Conde
But in the logfiles types only shows text an CSV. In this case , IIS,
in the monitor can i choose the parameter to meets that i want? For
example, if i want to detect http response 500, the parameter
sc-status=500. If i put this in the expression box , this could works?
Post by Anders Bengtsson [MVP]
Hello Fernando,
You can do that with a monitor looking at a logfile, there is a
default monitor type for that. Dont need a script to monitor a
logfile. If event 500 is a specified word or line.
Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se
Post by Fernando Conde
Hi,
i want that every time that , for example, event 500 appears in the
log of iis "ex000000.log" generates an alert.
I think to do this with a script.
I dont know exactly how to do this but i think than someone think
about this before and perharps can show me the right way.
Regards.
Loading...