운꼬시로

sc-status Srv1   Srv2   Srv3   Srv4   Srv5   Srv6   Srv7   Srv8

--------- ------ ------ ------ ------ ------ ------ ------ ------

200       576313 585078 573956 574218 566388 599807 572982 589815

206       242    238    247    262    236    216    192    246

301       6148   6388   6378   6154   6140   6600   6293   6398

302       166817 168700 166471 165909 163386 172658 166764 170363

304       125493 126640 125908 126204 124139 130669 125855 129026

400       4      3      3      2      2      7      7      3

403       130    106    146    170    148    154    148    95

404       9023   9149   9835   8833   8811   9489   9250   9369

405       0      1      0      0      0      0      0      0

406       2      10     5      11     4      7      8      4

500       1361   342    363    337    332    323    340    351

501       18     22     21     25     31     27     34     30

I created the following Logparser file (statuscodes_by_servers_in_cluster.sql) to create the site by side server table of HTTP status code values.

statuscodes_by_servers_in_cluster.sql

SELECT

sc-status,

       SUM(_Srv1) AS Srv1,

       SUM(_Srv2) AS Srv2,

       SUM(_Srv3) AS Srv3,

       SUM(_Srv4) AS Srv4,

       SUM(_Srv5) AS Srv5,

       SUM(_Srv6) AS Srv6,

       SUM(_Srv7) AS Srv7,

       SUM(_Srv8) AS Srv8

USING

       CASE s-computername WHEN 'ServerName1' THEN 1 ELSE 0 END AS _Srv1,

       CASE s-computername WHEN 'ServerName2' THEN 1 ELSE 0 END AS _Srv2,

       CASE s-computername WHEN 'ServerName3' THEN 1 ELSE 0 END AS _Srv3,

       CASE s-computername WHEN 'ServerName4' THEN 1 ELSE 0 END AS _Srv4,

       CASE s-computername WHEN 'ServerName5' THEN 1 ELSE 0 END AS _Srv5,

       CASE s-computername WHEN 'ServerName6' THEN 1 ELSE 0 END AS _Srv6,

       CASE s-computername WHEN 'ServerName7' THEN 1 ELSE 0 END AS _Srv7,

       CASE s-computername WHEN 'ServerName8' THEN 1 ELSE 0 END AS _Srv8

FROM

       \\ServerName1\logshare$\%logfilename%,

       \\ServerName2\logshare$\%logfilename%,

       \\ServerName3\logshare$\%logfilename%,

       \\ServerName4\logshare$\%logfilename%,

       \\ServerName5\logshare$\%logfilename%,

       \\ServerName6\logshare$\%logfilename%,

       \\ServerName7\logshare$\%logfilename%,

       \\ServerName8\logshare$\%logfilename%

GROUP BY

        sc-status

ORDER BY

        sc-status

You will notice that the HTTP 500 status codes are rather high on one of our servers (SRV1).   Now that we have identified which server looks unhealthy we can drill down and identify the problem application or URI which is causing the high level of 500’s server errors.

The next Logparser query I like to use is a spill by URI for the specific HTTP 500 status code on the cluster.   Using Logparser I created a file called cs-uri-stem_by_servers_in_cluster.sql and fed in the same input IIS log files from all the IIS servers in the cluster called u_ex07111409.log.

URI spill for ‘500’ HTTP status code for a complete cluster:

logparser -rtp:-1 file:cs-uri-stem_by_servers_in_cluster.sql?logfilename=u_ex07111409.log

sc-status Srv1 Srv2 Srv3 Srv4 Srv5 Srv6 Srv7 Srv8 cs-uri-stem

--------- ---- ---- ---- ---- ---- ---- ---- ---- ----------------------------------------------

500       0    0    0    0    0    0    0    1    /brasil/pr/2002/ms_edu_minas.stm

500       0    0    0    1    0    0    0    0    /brasil/pr/2002/ms_games_br.stm

500       0    0    0    0    0    1    0    0    /brasil/technet/topicos/codered.stm

500       1    0    0    0    0    0    0    0    /brasil/windows2000/requisitos.stm

500       0    0    0    0    2    0    0    0    /egypt/

500       0    0    0    0    1    0    0    1    /esp

500       0    0    0    0    0    0    0    35   /fwquery/

500       28   9    10   35   21   20   23   31   /gbadapp/errorpages/error.aspx

500       267  160  184  260  270  270  274  275  /ibadapp/errorpages/error.aspx

500       1    0    0    0    0    0    0    0    /middleeast/press/2001/may/gold_cert.stm

500       0    0    0    1    0    0    0    0    /middleeast/press/2001/may/officexpa.stm

500       1060 7    17   38   35   32   38   0    /obadapp/errorpages/error.aspx

500       0    0    0    0    0    0    1    0    /projectserver

500       4    2    1    2    1    0    4    5    /shared/1/navigation.asmx/DisplayDlNavHtml

500       0    0    0    0    2    0    0    1    /shared/2/navigation.asmx/DisplayDlNavHtml

500       0    0    0    0    0    0    0    2    /xml/overview.asp

I created the following Logparser file (cs-uri-stem_by_servers_in_cluster.sql) to create the URI spill by server for the HTTP 500 status code.

cs-uri-stem_by_servers_in_cluster.sql

SELECT

sc-status,

       SUM(_Srv1) AS Srv1,

       SUM(_Srv2) AS Srv2,

       SUM(_Srv3) AS Srv3,

       SUM(_Srv4) AS Srv4,

       SUM(_Srv5) AS Srv5,

       SUM(_Srv6) AS Srv6,

       SUM(_Srv7) AS Srv7,

       SUM(_Srv8) AS Srv8,

       cs-uri-stem

USING

       CASE s-computername WHEN 'ServerName1' THEN 1 ELSE 0 END AS _Srv1,

       CASE s-computername WHEN 'ServerName2' THEN 1 ELSE 0 END AS _Srv2,

       CASE s-computername WHEN 'ServerName3' THEN 1 ELSE 0 END AS _Srv3,

       CASE s-computername WHEN 'ServerName4' THEN 1 ELSE 0 END AS _Srv4,

       CASE s-computername WHEN 'ServerName5' THEN 1 ELSE 0 END AS _Srv5,

       CASE s-computername WHEN 'ServerName6' THEN 1 ELSE 0 END AS _Srv6,

       CASE s-computername WHEN 'ServerName7' THEN 1 ELSE 0 END AS _Srv7,

       CASE s-computername WHEN 'ServerName8' THEN 1 ELSE 0 END AS _Srv8

FROM

       \\ServerName1\logshare$\%logfilename%,

       \\ServerName2\logshare$\%logfilename%,

       \\ServerName3\logshare$\%logfilename%,

       \\ServerName4\logshare$\%logfilename%,

       \\ServerName5\logshare$\%logfilename%,

       \\ServerName6\logshare$\%logfilename%,

       \\ServerName7\logshare$\%logfilename%,

       \\ServerName8\logshare$\%logfilename%

WHERE  sc-status = 500

GROUP BY

       cs-uri-stem,

       sc-status

ORDER BY

        cs-uri-stem

There are a couple URIs that are throwing the 500 errors on SRV1.  The majority of the errors coming from the URI “/obadapp/errorpages/error.aspx”.    The next step is to determine if there was a window where this URI/application was performing poorly.

The next Logparser query I like to use is to spill by HTTP status code and by time (in minutes) for the problem server in question.  This will determine if the URI / application on ServerName1 (SRV1) was throwing the 500 errors consistently throughout the hour or during a specific window of time.   Using Logparser I created a file called httpstatuspivot.sql and fed in the same input IIS log file from ServerName1 called u_ex07111409.log.

Spill of HTTP status codes by time

logparser -rtp:-1 file:httpstatuspivot.sql?logfilename=\\ServerName1\logshare$\u_ex07111409.log

Minute              200s  206s 301s 302s 304s 403s 404s 405s 406s 500s 501s

------------------- ----- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----

2007-11-14 09:00:00 11143 3    128  3302 2477 6    158  6    0    3    0

2007-11-14 09:01:00 10659 4    103  3158 2399 2    142  2    0    3    0

2007-11-14 09:02:00 11139 6    129  3215 2410 1    154  1    0    4    0

2007-11-14 09:03:00 10749 1    116  3141 2192 3    161  3    0    4    0

2007-11-14 09:04:00 10814 2    132  3130 2179 2    180  2    0    3    0

I created the following Logparser file (httpstatuspivot.sql) to create the spill by time (in minutes) for the server which was throwing the 500 errors.  Also, an excellent TechNet article entitled “Inside Microsoft.com - Analyze Web Stats with Log Parser” also covers pivoting output of your Logparser query.

httpstatuspivot.sql

SELECT quantize(to_localtime(to_timestamp(date,time)),60) AS Minute,

    SUM([_200]) AS [200s],

    SUM([_206]) AS [206s],

    SUM([_301]) AS [301s],

    SUM([_302]) AS [302s],

    SUM([_304]) AS [304s],

    SUM([_403]) AS [403s],

    SUM([_404]) AS [404s],

    SUM([_403]) AS [405s],

    SUM([_406]) AS [406s],

    SUM([_500]) AS [500s],

    SUM([_501]) AS [501s]

USING

    CASE sc-status WHEN 200 THEN 1 ELSE 0 END AS [_200],

    CASE sc-status WHEN 206 THEN 1 ELSE 0 END AS [_206],

    CASE sc-status WHEN 301 THEN 1 ELSE 0 END AS [_301],

    CASE sc-status WHEN 302 THEN 1 ELSE 0 END AS [_302],

    CASE sc-status WHEN 304 THEN 1 ELSE 0 END AS [_304],

    CASE sc-status WHEN 403 THEN 1 ELSE 0 END AS [_403],

    CASE sc-status WHEN 404 THEN 1 ELSE 0 END AS [_404],

    CASE sc-status WHEN 401 THEN 1 ELSE 0 END AS [_405],

    CASE sc-status WHEN 406 THEN 1 ELSE 0 END AS [_406],

    CASE sc-status WHEN 500 THEN 1 ELSE 0 END AS [_500],

    CASE sc-status WHEN 501 THEN 1 ELSE 0 END AS [_501]

FROM %logfilename%

GROUP BY Minute

  ORDER BY Minute

IIS7 Logparser Gadget

Bill sent me e-mail on Saturday announcing that he wrote his first Windows Sidebar Gadget. It allows him to start PerfMon or other arbitrary programs from the Windows Sidebar.

I wanted to write a gadget for a long time and use it for one or the other IIS7 demo in the three talks I give on TechEd Barcelona. Bill's mail made me finally do it. So I spent the whole day Saturday to come up with my own gadget and right before dinner time the "IIS7 Logparser Gadget" was born (click the link to download it).

It runs a user-definable Logparser query, reads the first result and shows it on the gadget. Here is how it works:

1) gadget.xml is a global configuration file containing descriptions, etc. Not too interesting. The only important entry is the html file that gets invoked to show the gadget. In our case it is Logparser.html.

<?xml version="1.0" encoding="utf-8" ?>
<gadget>
  <name>Logparser Gadget</name>
  <namespace>Logparser.Gadget</namespace>
  <version>1.0</version>
  <author name="Thomas Deml">
    <info url="www.iis.net" />
  </author>
  <icons>
    <icon src="icon.png" />
  </icons>
  <copyright>2006</copyright>
  <description>Logparser Gadget that runs custom query</description>
  <hosts>
    <host name="sidebar">
      <base type="HTML" apiVersion="1.0.0" src="Logparser.html" />
      <permissions>full</permissions>
      <platform minPlatformVersion="0.3" />
    </host>
  </hosts>
</gadget>

2) logparser.htm is the html file that contains the code that shows the gadget and runs the query. In logparser.html you find the meat of the gadget. The Javascript code defines the default logparser query (it looks a bit cryptic, but the query returns the sum of http requests that ran in the last hour) and sets up a timer to run the query every 30 seconds. If an error occurs I write it to the logparser_gadget_error.log file.

<html>
 <head>
  <title>Logparser Gadget</title>
  <style>
    body {
    width:130;
    height:74;
    background: url('Image.png');
    padding-top: 0px;
    }
  </style>
 </head>
 <body onload="countdown()" >
  <span id="gadgetContent" style='font-family: Calibri; font-size: 10pt; color: Black'>init</span>
  <script>
  <!--
    var g_logFileLocation = System.Environment.getEnvironmentVariable("systemdrive") + "\\inetpub\\logs\\logfiles\\w3svc1\\*.log"
    var g_queryInterval = 30000;
    var g_queryDescription = "Requests in the last hour: "
    var g_query = "SELECT COUNT(*) FROM " + g_logFileLocation + " WHERE SUB(TO_INT(TO_LOCALTIME(SYSTEM_TIMESTAMP())),TO_INT(TO_LOCALTIME(TO_TIMESTAMP(date,time)))) < 3600"
    System.Gadget.Settings.write("queryInterval", g_queryInterval);
    System.Gadget.Settings.write("queryDescription", g_queryDescription);
    System.Gadget.Settings.write("query", g_query);
    System.Gadget.settingsUI = "Settings.html"
    System.Gadget.onSettingsClosed = SettingsClosed;
    function SettingsClosed()
    {
      g_query = System.Gadget.Settings.read("query");
      g_queryInterval = System.Gadget.Settings.read("queryInterval");
      g_queryDescription = System.Gadget.Settings.read("queryDescription");
    } 
    function countdown()
    {
      var LogParser=new ActiveXObject("MSUtil.LogQuery");
      var recordSet;
      var result;
      var objInputFormat = new ActiveXObject("MSUtil.LogQuery.IISW3CInputFormat");
      objInputFormat.Recurse = 0;
      try {
        recordSet = LogParser.Execute( g_query, objInputFormat);
        for(; !recordSet.atEnd(); recordSet.moveNext())
        { 
          result = recordSet.getRecord().toNativeString(0);
        }
      }
      catch (err)
      {
        try {
          var fs = new ActiveXObject("Scripting.FileSystemObject");
          var logfilename = System.Environment.getEnvironmentVariable("temp") + "\\logparser_gadget_error.log"
          var logfile = fs.OpenTextFile(logfilename, 2, true);
          logfile.WriteLine(System.Time.getLocalTime(System.Time.currentTimeZone) + ": " + err.description);
          logfile.Close();
          gadgetContent.innerHTML = "Error - see logfile"
       }
       catch (errinner)
       {
         gadgetContent.innerHTML = errinner.description;
         return; 
       }
     }
     if (result != null)
     {
       gadgetContent.innerHTML = "<center>" + g_queryDescription + "<br><B>" + result + "</B></center>"
     }
     else
     {
       gadgetContent.innerHTML = "no results"
     }
       Id = window.setTimeout("countdown()",g_queryInterval);
     }
    -->
    </script>

  </body>
</html>

3) settings.htm is pretty straightfoward, too. It allows you to change the Logparser query, the query description and the query interval (defaults to run every 30 seconds right now). It gets called when you right click on the gadget and click "Options".

<html>
  <head>
   <style>
    body{
      width:600;
      height:200;
    }
   </style>
   <script>  

    System.Gadget.onSettingsClosing = SettingsClosing;
    function init() {
      query.value = System.Gadget.Settings.read("query");
      queryDescription.value = System.Gadget.Settings.read("queryDescription");
      queryInterval.value = System.Gadget.Settings.read("queryInterval");
    }

    function SettingsClosing(event)
    {
      if (event.closeAction == event.Action.commit) {
        System.Gadget.Settings.write("query", query.value);
        System.Gadget.Settings.write("queryDescription", queryDescription.value);
        System.Gadget.Settings.write("queryInterval", queryInterval.value);
      }
      event.cancel = false;
    }
   </script>
 </head>
 <body onload="init()">
   <div id="mySpan" style='font-family: Tahoma; font-size: 8pt; ' >
     Logparser Query:<br />
     <input style='font-family: Tahoma; font-size: 8pt; width: 250; ' type='text' id='query' ><br />
     Query Description:<br />
     <input style='font-family: Tahoma; font-size: 8pt; width: 250; ' type='text' id='queryDescription' length='600'><br />
     Refresh Interval (msec):<br />
     <input style='font-family: Tahoma; font-size: 8pt; ' type='text' id='queryInterval' length='10'>
   </div>
 </body>
</html>

LogParserを駆動しているWSHをPowerShellに移植

いやぁPowerShellのパワーはすごいですわ。

$query = [System.IO.File]::ReadAllText($ParamFileName)

こんなことも簡単にできるし

$oIISW3CInputFormat = New-Object -comobject "MSUtil.LogQuery.IISW3CInputFormat"
$oNATOutputFormat = New-Object -comobject "MSUtil.LogQuery.NativeOutputFormat"
$oLogQuery = New-Object -comobject "MSUtil.LogQuery"
$oLogQuery.ExecuteBatch( $query , $oIISW3CInputFormat, $oNATOutputFormat )

Num_of_Access_by_Date.bat
LogParser file:Num_of_Access_by_Date.sql
          -o:CHART
          -oTsFormat:yyyy/MM/dd
          -chartType:Area

Num_of_Access_by_Date.sql
SELECT date, COUNT(*) AS NumOfAccess
INTO Num_of_Access_by_Date.gif
FROM u_ex*.log
GROUP BY date

この結果として、こんな感じのイメージが出力されます。

もう少し手を加えて、タスク スケジューラを利用して、
月別や週別のグラフを自動的に生成することも簡単ですね。

私の場合は、複数のサーバから出力されたイメージを参照できるページを
ASP.NETで作成したりして、簡単なレポート サイトを作ったりしています。

Path                                                        CreationTime
----------------------------------------------------------- ------------------
c:\inetpub\wwwroot\Default.asp                              6/22/2003 6:00:01
c:\inetpub\wwwroot\About.asp                                6/22/2003 6:00:00
c:\inetpub\wwwroot\global.asa                               6/22/2003 6:00:00
c:\inetpub\wwwroot\Products.asp                             6/22/2003 6:00:00


例２）

To identify these log entries you must make a list of all files on your site that have resulted in 200 HTTP status codes. From your log files directory, execute the following query:

C:\WINNT\System32\LogFiles\W3SVC1>logparser "SELECT DISTINCT TO_LOWERCASE(cs-uri-stem) AS URL, Count(*) AS Hits FROM ex*.log WHERE sc-status=200 GROUP BY URL ORDER BY URL" -rtp:-1

URL                                      Hits
---------------------------------------- -----
/About.asp                               122
/Default.asp                             9823
/downloads/setup.exe                     701
/files.zip                               1
/Products.asp                            8341
/robots.txt                              2830

例３）
C:\>logparser -i:fs "SELECT TO_LOWERCASE(SUBSTR(Name,
LAST_INDEX_OF(Name,'.'), STRLEN(Name))) AS Extension, Count(*) as Files
from c:\inetpub\wwwroot\*.*, c:\inetpub\scripts\*.* WHERE Attributes
NOT LIKE 'D%' GROUP BY Extension ORDER BY Files DESC" -rtp:-1
Extension Files
--------- -----
.gif      704
.asp      180
.jpg      44
.css      43
.htm      28
.txt      21
.html     6
.dll      5
.zip      4

例４）
C:\WINNT\System32\LogFiles\W3SVC1>LogParser "SELECT
TO_STRING(TO_TIMESTAMP(date, time), 'yyyy-MM-dd') AS Day, cs-uri-stem,
COUNT(*) AS Total FROM ex*.log WHERE (sc-status<400 or
sc-status>=500) AND (TO_LOWERCASE(cs-uri-stem) LIKE '%.asp%' OR
TO_LOWERCASE(cs-uri-stem) LIKE '%.exe%') GROUP BY Day, cs-uri-stem
ORDER BY cs-uri-stem, Day" -rtp:-1
Day        cs-uri-stem         Total
---------- ------------------- -----
2003-04-01 /Default.asp        127
2003-04-02 /Default.asp        121
2003-04-03 /Default.asp        132
2003-04-04 /Default.asp        116
2003-04-05 /Default.asp        107
2003-04-06 /Default.asp        144
2003-04-07 /Default.asp        466
2003-04-08 /Default.asp        174
2003-04-09 /Default.asp        118

例５）
C:\WINNT\System32\LogFiles\W3SVC1>logparser "SELECT date,
QUANTIZE(time, 3600) AS hour, sc-status, Count(*) AS Errors FROM
ex03*.log WHERE sc-status>=400 GROUP BY date, hour, sc-status HAVING
Errors>25 ORDER BY Errors DESC" -rtp:-1
date       hour     sc-status Errors
---------- -------- --------- ------
2003-06-22 22:00:00 404       110
2003-04-21 13:00:00 404       36
2003-04-19 23:00:00 404       36
2003-04-19 13:00:00 404       27

例６）
C:\WINNT\System32\LogFiles\W3SVC1>logparser "SELECT c-ip,
cs-uri-stem, Count(*) as Hits FROM ex*.log WHERE
TO_LOWERCASE(cs-uri-stem) NOT LIKE '%.gif' AND
TO_LOWERCASE(cs-uri-stem) NOT LIKE '%.jpg%' AND c-ip IN (SELECT c-ip
FROM ex030622.log WHERE sc-status=404) AND sc-status=200 GROUP BY c-ip,
cs-uri-stem" -rtp:-1
c-ip            cs-uri-stem         Hits
--------------- ------------------- ----------------
199.154.189.199 /Default.asp        3
199.154.189.199 /main.css           3
199.154.189.199 /Products.asp       7
199.154.189.199 /About.asp          1
63.54.202.2     /Products.asp       18
63.54.202.2     /main.css           1
81.112.9.62     /Default.asp        1

例７）
C:\WINNT\System32\LogFiles\W3SVC1>logparser "SELECT cs-uri-stem,
sc-status, Count(*) AS Total FROM ex*.log WHERE
TO_LOWERCASE(cs-uri-stem) LIKE '%.asp%' or TO_LOWERCASE(cs-uri-stem)
LIKE '%.exe%' GROUP BY cs-uri-stem, sc-status ORDER BY cs-uri-stem,
sc-status" -rtp:-1
cs-uri-stem                                   sc-status Total
--------------------------------------------- --------- -----
/Default.asp                                  200       9258
/Default.asp                                  500       3
/MSOffice/cltreq.asp                          404       12
/MailResult.asp                               404       1
/asp/aspmail.asp                              302       86
/asp/aspmail.asp                              500       28
/autocomplete.asp                             404       2
/awards.asp                                   404       4


例８）
C:\WINNT\System32\LogFiles\W3SVC1>logparser "SELECT cs-uri-stem,
cs-method, Count(*) AS Total FROM ex*.log WHERE (sc-status<400 or
sc-status>=500) AND (TO_LOWERCASE(cs-uri-stem) LIKE '%.asp%' or
TO_LOWERCASE(cs-uri-stem) LIKE '%.exe%') GROUP BY cs-uri-stem,
cs-method ORDER BY cs-uri-stem, cs-method" -rtp:-1
cs-uri-stem                          cs-method Total
------------------------------------ --------- -----
/Default.asp                         GET       9136
/Default.asp                         HEAD      125
/asp/aspmail.asp                     GET       3
/asp/aspmail.asp                     POST      111
/awards/Default.asp                  GET       269
/compare/Default.asp                 GET       437
/compare/Default.asp                 HEAD      3
/download/Default.asp                GET       5018
/download/Default.asp                HEAD      436
/download/default.asp                GET       727
/download/default.asp                HEAD      1
/orders/Default.asp                  GET       1420
/orders/Default.asp                  POST      3
例８）
C:\WINNT\System32\LogFiles\W3SVC1>logparser "SELECT cs-uri-stem,
Count(*) as Hits, AVG(sc-bytes) AS Avg, Max(sc-bytes) AS Max,
Min(sc-bytes) AS Min, Sum(sc-bytes) AS Total FROM ex*.log WHERE
TO_LOWERCASE(cs-uri-stem) LIKE '%.asp%' or TO_LOWERCASE(cs-uri-stem)
LIKE '%.exe%' GROUP BY cs-uri-stem ORDER BY cs-uri-stem" -rtp:-1
cs-uri-stem              Hits  Avg    Max     Min  Total
------------------------ ----- ------ ------- ---- --------
/Default.asp             9261  18321  19920   145  16967359
/MSOffice/cltreq.asp     12    227    269     221  2724
/MailResult.asp          1     221    221     221  221
/asp/aspmail.asp         114   545    704     218  62232
/complete.asp            2     230    240     221  461
/orders/Default.asp      269   6998   7625    6692 1882463

LOGPARSERって知ってますか？

簡単に言うと、.logを分析するプログラムです。
使い勝手が良いプログラムですが、これと言った本もなく苦労しています。
ASPからVBScriptを使って管理画面化するプログラムをつくりましょう。
基本ソースは下記の通りです。フォームから変数を渡すと好きなようにカスタムできます。

<%
Dim ILogQuery, Iw3c
Set ILogQuery = Server.CreateObject("MSUtil.LogQuery")
set IW3C = Server.CreateObject("MSUtil.LogQuery.w3cInputFormat")
 
 
set recordset = ILogQuery.Execute("SELECT * FROM C:\winnt\system32\logfiles\w3svc1\*.log", Iw3c)

strCol = recordSet.getColumnCount()
while not recordset.atend

set record=recordSet.getRecord()
for x=0 to StrCol-1
response.write record.getvalue(x) & " "
next
response.write "<br>"

recordset.movenext
wend
Set ILogQuery = nothing

Set Iw3c = nothing

%>