Re: How to parse the iis log files ?

[Anders Bengtsson [MVP]]

Hello Fernando,

You can do that with a monitor looking at a logfile, there is a default monitor
type for that. Dont need a script to monitor a logfile. If event 500 is a
specified word or line.

Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

> Hi,
>
> i want that every time that , for example, event 500 appears in the
> log of iis "ex000000.log" generates an alert.
>
> I think to do this with a script.
>
> I dont know exactly how to do this but i think than someone think
> about this before and perharps can show me the right way.
>
> Regards.
>

[Fernando Conde]

But in the logfiles types only shows text an CSV. In this case , IIS, in the
monitor can i choose the parameter to meets that i want?
For example, if i want to detect http response 500, the parameter
sc-status=500. If i put this in the expression box , this could works?

[Nathan Downey [MSFT]]

To be more specific there are a number of potential ApplicationLog monitors
that you can use. These are stored in the System.ApplicationLog.Library MP

There are monitors for reading Binary/GenericCSV/HTTP/FTP logs.

There are examples on how to use GenericCSVLog Monitors here:
http://technet.microsoft.com/en-us/library/dd391805.aspx

To summarize:
Set LogFileDirectory and LogFilePattern to specify your IIS logfile. Set the
seperator to match that in the IIS log. The monitor will split the logfiles
entries based on the seperator you selected and insert them into
Param1;Param2;Param3 etc... So in your expression you can say somthing like
Param1 Equal 500.

-Nathan Downey [MSFT]

"Fernando Conde" <Fernan...@discussions.microsoft.com> wrote in message
news:9C3E0E04-C2A7-4D9A...@microsoft.com...

[Anders Bengtsson [MVP]]

Hello Fernando,

You can configure the monitor to look for sc-status=500 , as Fernando MSFT
wrote