Great Weekend!

What a great weekend! The weather was perfect and I went biking with some friends...not like the tour, but still fun :)

Microsoft LogParser 2.2 Tutorial Update...

Someone pointed out to me that Microsoft LogParser 2.2 Tutorial VIII download link was wrong...I updated it in the post. You can find the download here. Sorry about that.

UserName without AD domain in C#

Someone asked in one of the forums recently can you get the username for someone in AD using C# without the domain addition. So if you have a logon name of test@mydomain.com or domain.com\test...how can you get just test?

This is actually quite easy and can be done like this:

private string ExtractPureUsername(string username)
   {
       string[] parts = username.Split('@');
       if (parts.Length == 2)
       {
           return parts[0];
       }

       parts = username.Split('\\');
       if (parts.Length == 2)
       {
           return parts[1];
       }

       return username;
   }

So now you can simply write:

username = ExtractPureUsername(username);

Having brought up the topic of AD and C#, I think I'll start to share some samples next week of how to work with AD using C#.

AzMan and Powershell

I figured I would start this as a work in progress. How can I connect to AzMan using Powershell?

$AppName = "MyAppName"

# Open the store
$AzStore = new-object -COMObject AzRoles.AzAuthorizationStore
$AzStore.Initialize(0, "msxml://E:\BigBadAzMan.xml", $null)

# Access the app
$MyApp = $AzStore.OpenApplication($AppName)
$MyApp.Submit()

# now do stuff

What can you do with the above so far? Well, you can extend it to do anything you like. Add roles, Add operations, Add users to roles, and anything else the AzMan API gives you. Maybe I'll build on this and start to build a powershell provider for AzMan (I believe some basic ones already exist).

--Work in Progress

Microsoft LogParser 2.2 Tutorial X

Click here to see part IX.

I went through a ton of things regarding logparser over the last week or so. I wanted to end the tutorials with some more queries that I have used. Comment here if you have any specific things you would like to parse.

• LogParserPlus: Collection of some nice queries
• Parse FileZilla Server logs
• LogParser + Eventcomb to find malware
• LogParser to analyze Exchange

Below, I will post answers to some questions that I received via email:

How do I pass multiple params to logparer query?

--http://blogs.msdn.com/adcman/archive/2006/05/15/598149.aspx
logparser file:query.sql?a=1+b=2

How do I split date and time in a logparser query?

logparser "SELECT TO_DATE(DateTime) As Date, TO_TIME(TO_LOCALTIME(DateTime)) As Time...."

Can I query with logparser and not modify LastAccess on a file?
Yes, the default is off, but you can pass a param to your query.

-preserveLastAccTime ON|OFF (default is OFF)

Microsoft LogParser 2.2 Tutorial IX

Click here to see part VIII.

With only 1-2 more tutorials to go, I wanted to give some references to where you can find information and resources on Logparser. The first place to go for all the questions you may have is to the IIS Forums for LogParser. There are however some other resources which I am listing below:

Books:

• Microsoft LogParser Toolkit -- The ultimate bible written by Gabriele himself
• IIS 7.0 Resource Kit -- The resource kit book for IIS 7 (you can look at IIS 6 as well)
• Windows Forensics Book -- Many exist on forensics, this is a good one

Websites:

• Rahul Soni's Blog -- Has some good examples
• TechNet
• Steve Schofield's Blog
• Linux Lore -- One of the first sites I used to help me get started
• IIS7 Logparser Gadget
• GlueGood's Blog -- One of the BEST sites for full completed examples
  

User Interfaces:

• LogParser Lizard -- Probably the best one out there
  
• Bob Bacus GUI
• Visual LogParser
• Ajax Lab Command Prompt for LogParser -- ASP.NET based

I'll probably post one more tutorial with some more sample queries.

Microsoft LogParser 2.2 Tutorial VIII

Click here to see part VII.

As we come to the end of the logparser tutorials, I wanted to show a basic C# library that can be extended for your needs. This library had a lot of input from various co-workers and blogs. This version of the library is an old stripped down version since the newer version has a lot more code that is propitiatory. I am sure you can extend this and would love to see what you come up with. You can find the codebase for the sample below here.

The main idea of this is to have a simple console application where you can drop a log file and a query and parse it in C# using LogParser. This can be extended to go into an Asp.Net application or a windows GUI for a business user.

Shown below is a snippet of the very basic console.

 class Program
  {
      static void Main(string[] args)
      {
          new Program().Run();
      }

      void Run()
      {
          W3cView _view = new W3cView();
          W3cQueries _queries = new W3cQueries();

          //Each query is listed below
          _view.CountOfTotalRequests(_queries.CountTotalRequests());
          _view.Table(_queries.Top10HitsWithExtensionAspx());
          Console.ReadLine();
      }
  }

The W3C query file which has the list of the sql files that are called looks like this:

 class W3cQueries
  {
      QueriesHelper queriesHelper = new QueriesHelper();

      public int CountTotalRequests()
      {
          return queriesHelper.GetInt("CountTotalRequests.sql");
      }

      public LogRecords Top20HitsWithExtensionAspx()
      {
          return queriesHelper.GetRecords("Top10HitsWithExtensionAspx.sql");
      }     
    
      //Add more queries
  }

I would love to see any extensions that any of you come up with based off this.

LogParser Matrix Style

One last fun output:

logparser
"select * from security"
-o:neuroview

Perhaps not the best output format, but nice anyway