2

Im trying to parse an IIS log file using LogParser 2.2, however im having a problem when it comes to the user agent because it sees the spaces in the following user agent and thinks it's a new field...

"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.121 Safari/535.2"

And it doesnt care about the "" around the string, anyone know of anyway to make it treat anything in between the "" as one field?

thanks,

p.s. This is from an log generated by the IIS Advanced Logging module.

electricsheep
  • 5,114
  • 9
  • 37
  • 41

1 Answers1

0

That's because the w3c standard does not include using whitespaces, what will happen is log parser will see the whitespace and assume it's a new field, with or without the quotes. From the following page

"Entries consist of a sequence of fields relating to a single HTTP transaction. Fields are separated by whitespace, the use of tab characters for this purpose is encouraged. If a field is unused in a particular entry dash "-" marks the omitted field. Directives record information about the logging process itself."

http://www.w3.org/TR/WD-logfile.html

Robert McMurray writes a blog about how to write a COM Plugin, which in my research trying to solve the very same issue, seems to be the best solution (short of writing a regex that replaces all whitespace inside "" with a "+")

http://blogs.iis.net/robert_mcmurray/archive/2013/02/28/advanced-log-parser-part-7-creating-a-generic-input-format-plug-in.aspx

Hope this helps

Edit: I've determined that there is a way to do this, see the following example using a X-Header-For field I've manually added to IIS Advanced Logging, the important bits are bold.

LogParser.exe "SELECT SUBSTR(X-Header-For, 0, INDEX_OF(X-Header-For, ',')) as [Remote Ip], date, time, cs-uri-stem, s-contentpath, sc-status FROM $log" -i:W3C -dQuotes ON

jidar
  • 551
  • 1
  • 4
  • 9
  • Given the quote from the standard, isn't this just a bug with the IIS Advanced Logging module? Use tabs between the fields and everything is OK? – CodeBuddy Aug 04 '16 at 13:58