MS Log Parser 2.2 Request Error

Question

I am trying to determine if a user uploaded a file from FTP using MS Log Parser 2.2

I was not able to get the parser SQL query, although I used a few example queries.

The Down Down water request does not work:

strSQL = "SELECT date,COUNT(*) AS downloads,c-ip " strSQL = strSQL & "FROM C:\temp\Log\*.log " strSQL = strSQL & "WHERE cs-method='RETR' " strSQL = strSQL & "GROUP BY date,c-ip " 

Mistake:

 RecordSet cannot be used at this time [Unknown Error] 

Question:

How to create a request:

  - SELECT Date and Time of download - Where user = 'xxx' - WHERE RETR = is a download - WHERE Filename = u_ex150709.log or xxx 

Responses to C # are also welcome.

VB.net Code:

 Dim rsLP As ILogRecordset = Nothing Dim rowLP As ILogRecord = Nothing Dim LogParser As LogQueryClassClass = Nothing Dim W3Clog As COMW3CInputContextClassClass = Nothing Dim UsedBW As Double = 0 Dim Unitsprocessed As Integer Dim strSQL As String = Nothing LogParser = New LogQueryClassClass() W3Clog = New COMW3CInputContextClassClass() Try strSQL = "SELECT date,COUNT(*) AS downloads,c-ip " strSQL = strSQL & "FROM C:\temp\Log\*.log " strSQL = strSQL & "WHERE cs-method='RETR' " strSQL = strSQL & "GROUP BY date,c-ip " 'run the query against W3C log rsLP = LogParser.Execute(strSQL, W3Clog) 'Error occurs in the line below rowLP = rsLP.getRecord() 

Answer 1

Like you, I wrote tools that use LogParser, for example http://eventanalyser.appointmentsbook.com/

Although in 2004 (using .Net 1.1) I was unable to download: https://visuallogparser.codeplex.com/

Check the source code, put your request into it (VisualLogParser), and then just link to it in your project and enjoy the open source community community.

Regarding your request for FTP liping, here is the MSDN article: http://blogs.msdn.com/b/robert_mcmurray/archive/2010/09/02/detecting-ftp-leeches-with-logparser.aspx

 SELECT date,COUNT(*) AS downloads,c-ip,x-session FROM *.log WHERE cs-method='RETR' GROUP BY date,c-ip,x-session HAVING COUNT(*) > 100 

One thing stands out from your query, when you look at the one I created a GUI for dynamic creation, you are missing single quotes around the file path:

 strSQL = strSQL & "FROM C:\temp\Log\*.log " 

Try the following:

 strSQL = strSQL & "FROM 'C:\temp\Log\*.log' " 

(and use StringBuilder, not string concatenation ... just to get used to best practice)

In accordance with:

If quotation marks do not solve the problem first, try a single log file rather than wildcard *.log to narrow down the syntax error. LogParser is not designed to help diagnose problematic queries; instead, Gabriele Giuseppini designed it to be fast, very fast !