Access log parsing

Question

Hi, I want to parse my access log. Objective is to get the value of any query string parameter independent of its location. Also is there any free URL parsing s/w or website.

Answer 1

If you're on Windows, take a look at Microsoft's Log Parser:

http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1287

A query to obtain query strings for all 500 errors would be something like:

logparser "SELECT cs-uri-query, Count(*) AS Total FROM ex*.log WHERE sc-status>=500 GROUP BY cs-uri-query ORDER BY Total DESC " -rtp:-1

Note that cs-uri-query is the "column" you're interested in. Other examples (including the above) documented at:

http://www.securityfocus.com/infocus/1712