iislog
iislog is a tool for fast search events in logs files produced by one or more IIS servers. Searches can be done for:
- user
- errors
- long queries
- url parts
Reports can be limited to a range of dates or hours. Static files can be ignored in the result.
Result is send to console, in CSV format. First line has header. Example:
isslogs.exe --from-days-ago=12 --hide-assets --errors Logs-IIS\*IIS*.zip
date;status;s-ip;cs-username;cs-uri-stem;cs-uri-query;time-taken(ms);time-taken;status-label
"2017-01-31 09:08:40";500.0;10.30.136.200;DOMAIN\user;/myapp/;"|121|800a0046|File:___Permission_denied__Error_opening_log_file_C:\Windows\TEMP\API.Log";2246;2.246s;"Module or ISAPI error occurred"
"2017-01-31 10:34:43";500.0;10.30.136.200;DOMAIN\user;/myapp/;"|121|800a0046|File:___Permission_denied__Error_opening_log_file_C:\Windows\TEMP\API.Log";1216;1.216s;"Module or ISAPI error occurred"
"2017-01-31 10:35:03";404.0;10.30.136.200;-;/myapps/;"-";93;93ms;"Not found"
"2017-01-31 10:35:14";500.0;10.30.136.200;DOMAIN\user;/myapp/;"|121|800a0046|File:___Permission_denied__Error_opening_log_file_C:\Windows\TEMP\API.Log";889;889ms;"Module or ISAPI error occurred"
Usage
usage: iislog [<flags>] <file>...
a tool for searching in IIS logs files.
Author jfc@responsiveconsulting.fr
Flags:
--help Show context-sensitive help (also try --help-long and
--help-man).
--from=DATETIME get logs from 'DATETIME' UTC
--to=DATETIME get logs to 'DATETIME' UTC
--from-days-ago=DAYS get logs from DAYS ago
--to-days-ago=DAYS get logs until DAYS before today
--since=DURATION get logs since DURATION. DURATION can be like 2s,
24h...
--url=URL ... Reports lines containing url. Several --url options
can be given. Lines are reported whenever one url
matches
--user=USER ... Reports lines from authenticated USER. Several --user
options can be given. Lines are reported whenever an
user matches
--errors filter logs on protocol errors (4xx and 5xx)
--hide-assets hide assets (html,gif,ico,css,jpg,png,js) from result
list
--long-queries=DURATION show queries longer than 'DURATION'. Accepted values
like 200ms, 3s, 1m...
Args:
<file> file, path, zip archive
Functionalities
- Limit search between dates time
- Search across several files
- Search in zipped logs
- Search errors 4xx and 5xx
- List all log entries
- Sort by date time entries coming from several servers logs
- List long queries
- List queries from an user
- List queries to an URL
- Nice unescaped reported queries