Windows Log Files

-

Today I needed to dig on a client's set of log files. I'm happy with text-based log files, but this time most of the research has to be done on Windows 2003 Server Event Logs. The problem is that in order to view this files you have to be running Windows 2003 Server and you have to use the Event Viewer program (or so I thought).

After having some trouble because I was not aware that Event Viewer is not happy when your files are read-only (as when you are handed over a copy on a CD-ROM) I decided it has to be a better way. Unfortunately, Event Viewer error message just said "wrong parameter" which is not telling you much about the cause of the problem.

A bit of Google and I discovered a software gem called LogParser, which can parse most of the different log files Microsoft OSs and applications create and, to ice the cake you can present your queries using SQL sentences on the command line. Many input and output formats are supported and it can also deal with your Apache server using NCSA format if you are running Linux.

Given that LogParser is a command line tool, there are certain things a GUI-based tool might seem more appropriated (especially when you are planning on browsing the log contents as opposed to be looking for an specific piece of information). A bit more Google and I learned about Event Log Explorer which is exactly a more user-friendly version of Microsoft Event Viewer, with several nice search and filtering options. This program is not free but you can download a trial version for free to see if it fits your needs. BTW, be warned this program (as MS Event Viewer) won't work if your log files are on read-only media.

Event Log files tend to get quite large if you monitor many activities (or if you have many users, or just a few but very active ones) but the good news is that these files are highly compresible. A quick test revealed that WinRAR packed in just 18 MB more than 536 MB made of several .evt files (almost a 30:1 ratio). Next time you are told the system will be wasting lots of harddisk space because you are keeping the logs for a while you know the answer to fight back.

Comments

Paul Cooley said…
In response to your question you left on Linux Lore :

I agree completely Logpaser is indeed a powerful tool. However, I've not heard nor have I seen
anything that indicates it has been made available for Linux. Maybe one day, but it isn't today.

Paul Cooley
3:25 pm
misan said…
Thanks for the feedback.

I haven't tried to use LogParser over wine yet (or Codeweaver's CrossOver Office) but it might work.

Cheers,

Miguel
11:07 pm
Post a Comment

Popular posts from this blog

VFD control with Arduino using RS485 link

-
Image
Variable Frequency Drives ( VFD ) allow the control of spindles so speed can accurately be controlled and a detailed acceleration profile for the spindle and reverse rotation can all be handled. In essence a VFD is an three phase inverter for three-phase AC motor. I am using a popular (I mean cheap) Chinese VFD and though the reference manual is not great, I could see there is a built-in RS-485 port. I usually control the start, stop and speed selection using the keyboard on the unit but I thought it will be more useful if I could control everything from the same Arduino is doing our CNC table control. Some cheap RS-485 off eBay and some lines of code later, I can start, stop and change the speed from an Arduino. What a cool thing to have! Some configuration of your VFD are needed before you can use it like that.  You need to set PD163=1 (I am using address 1 in the code). PD=164=1 (for setting serial to 9600bps) and PD165=0 (for using ASCII and 8N1 character format)
Read more

How to get sinusoidal s-curve for a stepper motor

-
Image
After some experimentation, and delving a bit into the math of motion, I realized there can be a significant difference on the motion of a machine by just making small changes. A common and popular approach to smooth one axis of motion is to use a trapezoidal speed pattern, where acceleration and deceleration are uniformly accelerated movements (aka constant acceleration motion) separated by a portion happening at cruising speed. The problem comes with the fact that, while that approach is simple to understand and to code, it does contain sudden changes in the acceleration, that show as spikes on the acceleration derivative, called jerk. These sudden changes in the acceleration translate into undesired vibration in our machines. Most of that can be eliminated by selecting a motion pattern that does not contain sudden changes of acceleration. If we chose a mathematical function for our speed whose second derivative is continuous, then we reduce system vibration quite a lot. One ma
Read more

Stepper motor step signal timing calculation

-
Image
While we use stepper motors in many devices, the timing of the step signals is not always well understood. Most of us can see how a fixed speed is a bad idea unless the speed of motion is really slow, but it is fixed speed what is really to generate with simple code. You just can use the Arduino Blink example to send a fixed frequency of pulses to a stepper motor driver. If too slow, just reduce the delay value. But for most real-life applications variable speed controls will perform better. These systems will speed up the motor to a given maximum speed and it will slow it down to stop at the desired step count. But understanding the math behind this process is sometimes not obvious. Let us start with the simple case of the so-called trapezoidal speed motion profile. Here motion takes place in three phases: acceleration, constant speed (cruising) and deceleration. But the point is how can our code create such a behavior. Stepper motor drivers usually accept two signals to control
Read more