Is Microsoft’s Log Parser a Windows Syslog Agent?

Someone recently asked me if Microsoft’s Log Parser application could be used as a syslog agent. To be honest, I had not heard of the application so I looked it up and tried it out. This post is a result of what I learned.

microsoft-logo_1

What is Microsoft’s Log Parser?

From the Microsoft Log Parser page:

Log Parser 2.2 is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows operating system such as the Event Log, the Registry, the file system, and Active Directory.  You tell Log Parser what information you need and how you want it processed. The results of your query can be custom-formatted in text based output, or they can be persisted to more specialty targets like SQL, SYSLOG, or a chart.  Most software is designed to accomplish a limited number of specific tasks. Log Parser is different… the number of ways it can be used is limited only by the needs and imagination of the user.  The world is your database with Log Parser.

Cool, sounds like it can handle almost any input and return almost any output!

How much does Microsoft Log Parser cost?

Free, it is available for download here.

Once you install Microsoft Log Parser, how do you use it?

Once you install and open the product you get a Log Parser command prompt with the following information:

The first thing that caught my attention was the need for a <SQL query>, but who has time to RTFM? On I went looking at the examples specifically looking for one highlighting syslog:

OK, so basically every command requires a SQL query to process the input and send the output. Seemed simple enough so I created a file called test.txt located at C:\ and put some text in the file to ingest and send over to my Log Insight instance. Next, I constructed a Log Parser command as follows:

Well that was pretty easy, but did it work? Next over to Log Insight to see if my event made it over:

log-insight-log-parser

Look at that, it did! For those curious, the format of a Log Parser event appears to be: <timestamp> <hostname> LogParser:<filename> <lineNumber> <message>.

So once you get use to the syntax, it appears Log Parser is capable of sending Windows events to a remote syslog destination like Log Insight, but I did run into one major issue. While Log Parser had no problem reading a file and sending the events over syslog, I did not see an easy way for it to monitor a file and only send changes over syslog. This means Log Parser could be used for one-time troubleshooting of an application, but can not easily be used for log aggregation and correlation between systems. Now, to be fair, I did not have much time to play with the application so maybe I missed it and if I did please let me know in the comments!

Is Microsoft’s Log Parser a Windows syslog agent?

Based on my limited engagement with Log Parser, here is how I think it stacks up:

  • Pros
    • Can monitor any input you care about (including eventviewer, SQL, and more)
    • Can output results in any format you care about (including syslog)
    • Standard query language (SQL)
  • Cons
    • Command line only
    • Not well documented
    • Not well adopted in the syslog space
    • Not intuitive or easy to use
    • No easy ability to monitor a file for changes (I think)
  • Unknown
    • Resource utilization
    • Performance/Speed
    • Support
    • Other features
    • Bugs

Bottom line: Log Parser is a cool tool for one-time troubleshooting, but I would not recommend it as a Windows syslog agent. If you are looking for a Windows syslog agent, please see this post: Syslog Agents on Windows.

© 2013 – 2014, Steve Flanders. All rights reserved.

2 thoughts on “Is Microsoft’s Log Parser a Windows Syslog Agent?

  1. Barkingdoggy says:

    It can work as an agent. This is the SQL:

    SELECT TimeGenerated as TimeStamp,ComputerName as Host,EventID as Tag,EventCategory as Facility,EventType as Severity,Message as Message INTO @xxx.yyy.jjj.com:514 FROM Security where TRIM(EventTypeName) =’Failure Audit event’ AND TimeGenerated >= SUB( TO_LOCALTIME(SYSTEM_TIMESTAMP()), TIMESTAMP(’00:15:30, ‘hh:mm:ss’))

    See http://forums.iis.net/t/1144985.aspx for the whole solution.

    I’m stuck for the moment trying to display the resulting syslog entries properly in Log Analyzer. Info is not displayed in the proper Log Analyzer fields.

    • Thanks for sharing! A few comments on this method:
      * I would not call this easy 😉
      * I assume this only works if the log files has timestamps. If monitoring a file, this cannot be guaranteed.
      * I also have doubts that this command will work with all timestamp formats like those found in files.

Leave a Reply