Tag Archives: Data Mining

Microsoft Log parser and SharePoint ULS Logs

Recently I had to search all ULS logs on the servers of a customer because a Microsoft engineer (thanks Robin) found this failure in a portion of a provided log:

Aborting profile synchronization for content DB xxx

We wanted to see how often the failure happened in the past. I did some searching and found Microsoft Log Parser 2.2.

With Log Parser you can do SQL like queries in Windows event logs, IIS logs and all kind of text based logs. I am not a genius when it comes to SQL queries, but this query lead to success on the customers servers:

SELECT  * INTO c:\logparser\out.txt FROM ‘C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\LOGS\%computername%*.log’ HAVING Message LIKE ‘%aborting profile sync%’

Some explanation:

  • “INTO c:\logparser\out.txt” puts the output to out.txt
  • “%computername%*.log” was used because only ULS logs should be considered, not the upgrade.log, for example
  • “LIKE ‘%aborting profile sync%’” was used as the actual search query

I saved this query to the file query.txt and ran this command:

LogParser -i:tsv -o:tsv file:c:\logparser\query.txt

Again, some explanation:

  • -i:tsv defines that the input file is tab separated (like the ULS logs)
  • -o:tsv defines that the output file should be tab separated

The search in 1,5 GB ULS logs took about one minute!

When you want to use Log Parser, be sure to take a look at the included help file to learn about more input and output types.