记一次Windows日志分析：LogParse

Logparser.exe "SELECT distinct count(*) as Times,cs-host as Host,cs-uri-stem as    PageUrl into 'D:\Loginfo\IISLog\error\20100428.log.txt' FROM    D:\Loginfo\IISLog\100428.log where sc-status=404 Group by Host,PageUrl order by    Times desc" -o:tsv

5>分析自定义的日志

LogParser.exe "select distinct Host, Uid,SessionId, CASE STRLEN(TRIM(AccountId))    WHEN NULL THEN 0 ELSE 1 END as IsLogin into C:\****.txt from    'D:\Loginfo\LogInfo_1004280930.log' where Host >''" -i:TSV -fixedSep:ON    -iHeaderFile D:\Loginfo\PVLogHeadFile\PVLogHeadFile.txt -o:tsv -fileMode:0

-fileMode:0，为 0 表示追加，为 1 表示覆盖原文件

LogParser.exe "SELECT * FROM 'D:\LogInfo\LogInfo_1001032230.log' TO dbo.[table]"    -o:SQL -server:[server] -driver:"SQL Server" -database:[database]    -username:[username] -password:[password] -i:tsv

(2) 导入到本机数据库存在的表中

LogParser.exe "select * into [database].dbo.[table] from    'D:\LogInfo\LogInfo_1001032230.log'" -o:sql -database:[dtabase] -i:tsv    -iCodepage:65001

(3) 导入并创建表

LogParser.exe "SELECT * FROM 'D:\LogInfo\LogInfo_1001032230.log' TO dbo.[table]"    -o:SQL -server:[server] -driver:"SQL Server" -database:[database]    -username:[username] -password:[password] -i:tsv -createtable:ON

Note:

using System;
using LogQuery = MSUtil.LogQueryClass;
using LogRecordSet = MSUtil.ILogRecordset;
using TsvInputFormat = MSUtil.COMTSVInputContextClass;
using System.Windows.Forms;
class LogParserUtil
{/* / <summary> */
/* / 计算失败率 */
/* / </summary> */
    public double GetFailureRate( string headerFile, string logPath )
    {        double failureRate = 1;
        LogQuery oLogQuery = new LogQuery();
        TsvInputFormat oTsvInputFormat = new TsvInputFormat();
        oTsvInputFormat.iHeaderFile = headerFile;
        LogRecordSet oRecordSet;
        double totalQty = 0;
        double successQty = 0;
        string query = string.Empty;
        try
        {            #region 所有的条数--Log 中包含「reccode=」的行数
            query = @ "select count(*) as qty from '" + logPath + "' where loginfo
like '%reccode=%'";
            oRecordSet = oLogQuery.Execute( query, oTsvInputFormat );
            if ( !oRecordSet.atEnd() )
            {                totalQty = (int) oRecordSet.getRecord().getValue( "qty" );            }
            oRecordSet.close();
            #endregion
            #region 成功的条数--Log 中包含「reccode=0,」的行数
            query = @ "select count(*) as qty from '" + logPath + "' where loginfo
like '%reccode=0,%'";
            oRecordSet = oLogQuery.Execute( query, oTsvInputFormat );
            if ( !oRecordSet.atEnd() )
            {                successQty = (int) oRecordSet.getRecord().getValue( "qty" );            }
            oRecordSet.close();
            #endregion
            if ( totalQty > 0 && totalQty >= successQty )
            {                failureRate = Math.Round( (1 - successQty / totalQty) * 100, 2 );            }        }
        catch ( Exception ex )
        {            MessageBox.Show( ex.ToString() );        }
        return(failureRate);    }
/* / <summary> */
/* / 计算调用平均时间 */
/* / </summary> */
    public double GetAvgLockSec( string headerFile, string logPath )
    {        double avgLockSec = 0;
        LogQuery oLogQuery = new LogQuery();
        TsvInputFormat oTsvInputFormat = new TsvInputFormat();
        oTsvInputFormat.iHeaderFile = headerFile;
        try
        {            string query = "select
AVG(TO_REAL(EXTRACT_VALUE(EXTRACT_TOKEN(SUBSTR(loginfo,INDEX_OF(loginfo,'lockse
c=')),0,' '),'locksec'))) as avglocksec from '" + logPath + "' where loginfo like
'%locksec=%'";
            LogRecordSet oRecordSet = oRecordSet = oLogQuery.Execute( query,
                                          oTsvInputFormat );
            if ( !oRecordSet.atEnd() )
            {                double item = 0;
                if ( !oRecordSet.getRecord().isNull( 0 ) )
                {                    item =
                        double.Parse( oRecordSet.getRecord().getValue( 0 ).ToString() );                }
                avgLockSec = Math.Round( item, 2 );            }
            oRecordSet.close();        }
        catch ( Exception ex )
        {            MessageBox.Show( ex.ToString() );        }
        return(avgLockSec);    }}