Skip to main content

Larry Kuhn

Larry Kuhn
  

 Midwest Bloggers

  Arbindo Chattopadhyay
  U.S. Midwest SharePoint Community
  Ram Gopinathan
  Larry Clarkin
  Kevin Hammond
  Dave Bost
  Angela Binkowski
  Andrew Ehrensing
  John West

 User Groups

  Chicago SharePoint User Group
  Chicago .NET Users Group
  Chicago Windows User Group
  Chicago Visual Studio Team System User Group
Larry Kuhn > Posts > What's Up with SharePoint?
What's Up with SharePoint?

Let's suppose your job requires you to answer the above question.  Over and over again.  Here's how to get a quick read on the situation.

1. On each of your SharePoint servers, install LogParser: Download details: Log Parser 2.2

2. On the desktop of each server, create a file called WhatUpWithSharePoint.cmd and set the contents as follows: (of course, you'll will need to adjust the paths if you have not stuck with the default locations for Log Parser or SharePoint Logs).

"C:\Program Files\Log Parser 2.2\LogParser" "SELECT * FROM 'C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\LOGS\*.log' WHERE message LIKE '%%Error%%' OR level = 'Exception' OR level = 'Critical' ORDER BY Timestamp DESC " -i:TSV -o:DATAGRID -e:10 -dtlines:600

Update 5/25/08: Added -dtlines parameter. As a commenter noted, the EventID column can contain both numbers and letters.  If the first 100 rows contain only numbers, LogParser will infer Integer data type, which leads to parse errors when it eventually encounters letters further on in the file. Picking a bigger number for -dtlines can avoid this.

3. Double click to run it and you'll see something like this:

image

Of course, this doesn't give you the answer, but it gives you a good idea of where to begin to look.  Once you spot things that look suspicious or related to current concerns you can revise the sample query I listed above to zero in on particular areas of the logs.  Typically you would want to further enhance the WHERE clause to pinpoint specific Category, Level or time ranges of Timestamp.  LogParser.chm in the LogParser install directory is there to help you.

Happy Mothers Day, btw...

Comments

Errors with that query maybe?

C:\Projects\CSI.ESS\SCRIPTS>"C:\Program Files\Log Parser 2.2\LogParser" "SELECT * FROM 'C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\ LOGS\*.log' WHERE message LIKE '%Error%' OR level = 'Exception' OR level = 'Crit ical' ORDER BY Timestamp DESC " -i:TSV -o:DATAGRID -e:10 Task aborted. Too many parse errors - aborting Parse errors: Error while parsing field EventID: Value is not a relative integer LogFile "C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\LOGS\MYCOMPUTER-20080510-1256.log", Row number 586, Value "uls1 Monitorable Tracing Service" Error while parsing field EventID: Value is not a relative integer LogFile "C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\LOGS\MYCOMPUTER-20080510-1256.log", Row number 4563, Value "uls1 Monitorable Tracing Service" Error while parsing field EventID: Value is not a relative integer LogFile "C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\LOGS\MYCOMPUTER-20080510-1256.log", Row number 5144, Value "uls1 Monitorable Tracing Service" Error while parsing field EventID: Value is not a relative integer LogFile "C:\Program Files\Common Files\Microsoft Shared\web server
at 5/11/2008 7:53 PM

re: Errors with that query maybe?

Alex,
My query had worked for me on all the logs had tried it on prior to creating the post, but I did eventually run in tot he same problem as you.  Here's what caused it... LogParser infers the data type of a given column of input in a TSV file by inspecting the values in the first 100 rows.  What is happening in your case is that those first 100 rows had numerals only in the EventID column, so the data type Integer was inferred. Then when non-numeric characters are encountered later on in the file, the parse error is thrown.
 
Visually inspect your log file or use the error messages to figure out the row number where the first occurance of non-numeric characters in EventID column is (row 586 in your case) and then add a parameter to your query called -dtlines: and put that row number or a higher one on there.
 
I updated the main post with this info.  Thanks for your comment!
- Larry
Larry Kuhn at 5/18/2008 11:54 AM

re: Errors with that query maybe?

Very cool. Just when I decide to spend some time looking into LogParser again, I do a search to see if anyone else has had this error and found my original comment to your post along with your resolution! Upon implementing your solution, everything works great! Thanks SO much!
at 7/28/2008 2:21 PM

Add Comment

Items on this list require content approval. Your submission will not appear in public views until approved by someone with proper rights. More information on content approval.

Title


Body (required) *

Name (required) *


URL

Type the Web address: (Click here to test)  

Type the description: 

Attachments