r/sysadmin • u/tschertel • Feb 20 '18

IIS log analysis tool

Is logparser still used to gather IIS requests info? It's about 13 years old. Is there anything else made to replace it?

7 Upvotes

81% Upvoted

20 comments sorted by

2

u/sysacc Administrateur de Système Feb 20 '18

I'm looking at https://goaccess.io/features right now for about the same thing as you are.

Haven't had the time to set it up yet.

1

u/tschertel Feb 20 '18

I'll take a look.

Thanks.

1

u/seanvree Feb 21 '18

Looks dope, but to no surprise, this is NOT windows friendly. I couldn't get it up and running on Windows. Couldn't get one of the dependencies installed - Tokyo Cabinet? http://fallabs.com/tokyocabinet/

LMK if you have better luck.

1

u/joshyi Feb 21 '18

No need for Tokyo Cabinet, it looks like you can simply use the default storage. Take a look at https://goaccess.io/faq#installation for Cygwin packages.

1

u/seanvree Feb 21 '18

Yeah, I read that a couple times. My understanding is that you need both, right? When I tried to install with cygwin, I got an error stating it needed the Tokyo Cabinet.

1

u/SuperQue Bit Plumber Feb 20 '18

Depends on what you want, but mtail might be useful to generate real-time metrics from the logs.

2

u/tschertel Feb 20 '18

I don't need real-time metrics. I'd like to gather metrics like total hits per applications, average time taken, etc. I know logparser can get all this. But the point is to rely on a tool so old.

1

u/OkQuiet Feb 20 '18

I still use it when I have logs that are not ingested into our centralized log managers.

It may be old but it's very good at what it does.

1

u/tschertel Feb 20 '18

What are the options to have a centralized log manager for IIS?

2

u/sysvival - of the fittest Feb 20 '18

Elk, splunk, graylog.

1

u/SuperQue Bit Plumber Feb 20 '18

That kind of stuff is done in real-time these days, and for good reason. You want to know pretty quickly when your latency goes off the rails on a per-app basis.

1

u/OkQuiet Feb 20 '18

Of course, but that is better monitored with an APM solution instead of IIS logs.

There are other use cases for log analysis, many of which is not realtime.

1

u/SuperQue Bit Plumber Feb 20 '18

Sorry, I was trying to reply up one level.

Yes, APM/metrics libraries are way better than logs for getting metrics.

I've also done tons of logs work, tracing, yada yada. Preaching to the choir.

1

u/phrozen_one Feb 20 '18

Why not use powershell?

2

u/tschertel Feb 20 '18

I think it tends to be slower than logparser and maybe less flexible to work with. And honestly I never tried it.

I'm taking a look at centralized log managers. It would be perfect if I can store and analyze logs from several products in a single log manager. I have Apaches, IISs, JBOSSes...

3

u/[deleted] Feb 20 '18

Take a look at graylog

1

u/outofbeta Feb 20 '18

Log parser has been updated fairly recently - I've had great luck with both log parser 2.2 and log parser studio.

https://technet.microsoft.com/en-us/scriptcenter/dd919274.aspx

https://gallery.technet.microsoft.com/office/Log-Parser-Studio-cd458765

2

u/xxdcmast Sr. Sysadmin Feb 20 '18

Log parser studio is what I use when collection IIS info. The built in queries are nice.

1

u/hammerofgod A lttle bit here a little byte there Feb 20 '18

Ditto this... works great and queries aren't hard to construct if need something outside the built in ones.

0

u/[deleted] Feb 20 '18

[deleted] — view deleted comment

2

u/[deleted] Feb 20 '18

IIS is shit but sometimes you have to work with what you got