Sharepoint Forum

Ask Question   UnAnswered
Home » Forum » Sharepoint       RSS Feeds

Log files: WSS vs SPS

  Asked By: Curtis    Date: Feb 20    Category: Sharepoint    Views: 2919

I have been trying to write a C# program to parse the SharePoint Portal Server 2003 log files located in the C:\windows\system32\logfiles\STS\.... directory.

I used the log file formatting info from the MSDN article, "Usage Event Logging in Windows SharePoint Services", July 2004. msdn.microsoft.com/.../...wssusageeventlogging.asp

Using C# to parse binary files is… well… challenging. (But, that is another topic.) I digress...

Anyway, the short story, the article is wrong (or maybe a bit short on accuracy).

Each log file entry has a fixed header with byte counts, status codes, etc. Followed by null terminated ASCII strings whose lengths were given in the log entry header.

I produced a hex/string dump printout of select areas of the log files and used my pencil to manually parse entries and verify the accuracy of the format described in the article. I found 5 extra bytes in each header that are not accounted for in the article. Plus, the "cbSiteUrl" field is correct… mostly.

1) Does anyone know if the article is up to date?
2) Is there a difference between WSS and SPS 2K3 as far as log files are concerned?



6 Answers Found

Answer #1    Answered By: Jagjit Phutane     Answered On: Feb 20

Your code extracts data from the WSS log  file as formatted by the Microsoft article I referenced. However, I am running SPS 2003 and the data in the log files  I have are slightly different. The header portion of my log files have 5 extra bytes. (A block of two bytes and a block of three bytes.) Because of the difference, the MS code (and yours) will crash and burn when run on the log files I have.

I will put my question on the MS newsgroups. Maybe they can explain the difference, maybe SPS 2003 log files are different than WSS log files.

Answer #2    Answered By: Janak Jadeja     Answered On: Feb 20

I wanted to let you know that the issue of non-standard log  files in
SharePoint is something that we have just recently resolved with
Microsoft's help. Through a Premier Support and MCS engagement, they
worked to provide us with a conversion utility that will take the
SharePoint log files  and convert them into a W3C compliant format
(while stripping out SPS crawler traffic) that can be integrated
with the IIS log files and then in turn analyzed using any off the
shelf web analystics program  (like WebTrends). This is a large step
towards providing something that more closely meets enterprise
requirements (like ad-hoc reporting and advanced filtering

I'm not at liberty to provide the code for the utility or any
guarantees about product integration but can say that this
requirement and feedback has made it directly to the SharePoint
product group at MS and I expect a trickle down to occur.

Answer #3    Answered By: Jude Alston     Answered On: Feb 20

Just to clarify one point, is there a difference
between WSS and SPS log  file formats?

Until MS releases a supported solution, I believe I have the beginnings
of an interim solution.

Answer #4    Answered By: Araceli Eaton     Answered On: Feb 20

I haven't done log  parsing yet but this tool may be helpful:

Answer #5    Answered By: Nisarg Kapadia     Answered On: Feb 20

I figured out the SPS/WSS log  file parsing problem I was having. The
MSDN article describing the format of th log file is MOSTLY right.

When I tried to read each log entry header field individually, the C#
program crashed and burned. I found five extra bytes within the fixed
sized header. After looking at a hex dump of the file and a disassembly
of the C# program, it hit me. The C++ compiler inserted extra bytes to
keep struct fields on word and dword boundaries. When SPS writes out
the struct, it includes the extra 5 fill bytes. SharePoint code did not
declare the struct fields to be packed, therefore the extra bytes
inserted for performance purposes.

Not having a lot of time to discover the "perfect and proper" layout
attributes, I used explicit struct layout to mimic the log entry header.
It also requires using the Marshal object to work with unmanaged memory.

Answer #6    Answered By: Akanksha Jain     Answered On: Feb 20

Couple of questions:

1. This was done for SharePoint2003, does it still work for
SharePoint2007 (WSS3/MOSS2007)?
2. Does anyone have a copy of the code/exe?

Didn't find what you were looking for? Find more on Log files: WSS vs SPS Or get search suggestion and latest updates.