Windows Log Files

-

Today I needed to dig on a client's set of log files. I'm happy with text-based log files, but this time most of the research has to be done on Windows 2003 Server Event Logs. The problem is that in order to view this files you have to be running Windows 2003 Server and you have to use the Event Viewer program (or so I thought).

After having some trouble because I was not aware that Event Viewer is not happy when your files are read-only (as when you are handed over a copy on a CD-ROM) I decided it has to be a better way. Unfortunately, Event Viewer error message just said "wrong parameter" which is not telling you much about the cause of the problem.

A bit of Google and I discovered a software gem called LogParser, which can parse most of the different log files Microsoft OSs and applications create and, to ice the cake you can present your queries using SQL sentences on the command line. Many input and output formats are supported and it can also deal with your Apache server using NCSA format if you are running Linux.

Given that LogParser is a command line tool, there are certain things a GUI-based tool might seem more appropriated (especially when you are planning on browsing the log contents as opposed to be looking for an specific piece of information). A bit more Google and I learned about Event Log Explorer which is exactly a more user-friendly version of Microsoft Event Viewer, with several nice search and filtering options. This program is not free but you can download a trial version for free to see if it fits your needs. BTW, be warned this program (as MS Event Viewer) won't work if your log files are on read-only media.

Event Log files tend to get quite large if you monitor many activities (or if you have many users, or just a few but very active ones) but the good news is that these files are highly compresible. A quick test revealed that WinRAR packed in just 18 MB more than 536 MB made of several .evt files (almost a 30:1 ratio). Next time you are told the system will be wasting lots of harddisk space because you are keeping the logs for a while you know the answer to fight back.

Comments

Paul Cooley said…
In response to your question you left on Linux Lore :

I agree completely Logpaser is indeed a powerful tool. However, I've not heard nor have I seen
anything that indicates it has been made available for Linux. Maybe one day, but it isn't today.

Paul Cooley
3:25 pm
misan said…
Thanks for the feedback.

I haven't tried to use LogParser over wine yet (or Codeweaver's CrossOver Office) but it might work.

Cheers,

Miguel
11:07 pm
Post a Comment

Popular posts from this blog

VFD control with Arduino using RS485 link

-
Image
Variable Frequency Drives ( VFD ) allow the control of spindles so speed can accurately be controlled and a detailed acceleration profile for the spindle and reverse rotation can all be handled. In essence a VFD is an three phase inverter for three-phase AC motor. I am using a popular (I mean cheap) Chinese VFD and though the reference manual is not great, I could see there is a built-in RS-485 port. I usually control the start, stop and speed selection using the keyboard on the unit but I thought it will be more useful if I could control everything from the same Arduino is doing our CNC table control. Some cheap RS-485 off eBay and some lines of code later, I can start, stop and change the speed from an Arduino. What a cool thing to have! Some configuration of your VFD are needed before you can use it like that.  You need to set PD163=1 (I am using address 1 in the code). PD=164=1 (for setting serial to 9600bps) and PD165=0 (for using ASCII and 8N1 character format)
Read more

How to get sinusoidal s-curve for a stepper motor

-
Image
After some experimentation, and delving a bit into the math of motion, I realized there can be a significant difference on the motion of a machine by just making small changes. A common and popular approach to smooth one axis of motion is to use a trapezoidal speed pattern, where acceleration and deceleration are uniformly accelerated movements (aka constant acceleration motion) separated by a portion happening at cruising speed. The problem comes with the fact that, while that approach is simple to understand and to code, it does contain sudden changes in the acceleration, that show as spikes on the acceleration derivative, called jerk. These sudden changes in the acceleration translate into undesired vibration in our machines. Most of that can be eliminated by selecting a motion pattern that does not contain sudden changes of acceleration. If we chose a mathematical function for our speed whose second derivative is continuous, then we reduce system vibration quite a lot. One ma
Read more

Importing OpenSCAD designs into Onshape

-
Image
After using Onshape CAD software for a while I am really fond of it. So one natural thing to do, specially once they have released the Instructor's kit is to start using it in the classroom too. But one thing I was not so sure how to do was to use old designs I made using OpenSCAD. It does not mean I am completely quitting using OpenSCAD but suddenly I can see I can do assemblies in Onshape that will look quite nice for showing and documentation purposes if only I could easily import from OpenSCAD. I am glad to report that the route OpenSCAD --> FreeCAD --> Onshape worked brilliantly. Even more when a few tricks were applied. While some people suggest to import CSG files from OpenSCAD to FreeCAD, I have had more success by directly importing SCAD files into FreeCAD. One trick that worked well for me was to get rid of $fn references, so now circles become real circles (or cylinders) in FreeCAD. If a part keeps some $fn references then your cylinders or circles wi
Read more