How can I search IIS logs of several servers at the same time?

Question

I need to search the logs of all the servers in the array for a particular string. Specifically, I need to determine if a given user is using OWA, EWS, or something else with our CAS servers.

Is there a simple way for me to search all servers in the CAS Array in parallel?

Since this is mainly an IIS question, and Web Arrays are very common I doubt this is a "new" question but I can't find a similar answer elsewhere.

Please be a little more descriptive. The W3SVC logs? In a CAS Array? Fill in as much detail as possible — Mathias R. Jessen, Jan 23 '12 at 16:09
@JudasIscariot1651 - Updated... I don't think it matters what logs, just looking to search many TXT files in parallel. Would think this is a common need since servers started scaling out — makerofthings7, Jan 23 '12 at 16:19

score 4 · Accepted Answer · edited Apr 13 '17 at 12:13

4

The two answers are log centralization or remote commands.

See Windows Server Event Log Collection and Analysis for the first and do some searching for Powershell for the second (example: Powershell Remoting: Howto Run a Comand on multiple Machines with individual Parameters?)

edited Apr 13 '17 at 12:13

Community

1

answered Jan 23 '12 at 16:32

Jeff Ferland

20,239
2
61
85

1

While there is dedicated software that will parse logs I'd probably write a PowerShell script to create multiple jobs across the farm – Jim B Jan 23 '12 at 20:14

score 2 · Answer 2 · answered Jan 23 '12 at 16:29

When you start needing to cross correlate logs between servers you should really look at a central log server such as Splunk. While it is possible to do so with other products like log parser, grep, etc most are designed for a single file as you have found.

score 1 · Answer 3 · edited Apr 13 '17 at 12:14

one answer logparser.exe http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=24659

also a good companion is Visual log parser http://visuallogparser.codeplex.com/

Examples http://technet.microsoft.com/en-us/library/ee692659.aspx

More examples http://blogs.msdn.com/b/carloc/archive/2008/02/06/logparser-scripts-for-various-occasions.aspx

Some more examples Recommended LogParser queries for IIS monitoring?

score 1 · Answer 4 · answered Jan 24 '12 at 00:04

You mean W3C logs, not event logs, right?

LogParser supports the use of multiple log files as input (i.e. *.log works in a FROM clause), so it's just a matter of consolidating the log files (or ensuring that they're accessible), which is usually fairly trivial to script.

How can I search IIS logs of several servers at the same time?

4 Answers4