Log Parser Lizard provides a modern graphical user interface to MS Log Parser 2.2 for analyzing logs using SQL queries

Page updated February 20, 2021.

Log Parser Lizard provides a great Graphical User Interface (GUI) to Microsoft Logparser 2.2. No cloud or web server needed. It is a versatile desktop tool that gives automated SQL query access to any system log or text-based data including Web Server Logs (IIS, Apache, W3C, SharePoint, MS Exchange, FTP, etc...), Windows System Events and even application log files (generated with log4net, Nlog, SeriLog, etc.). Also great for Data Visualization (dataviz), Business Intelligence (BI) and Extract Transform Load (ETL) tasks.

When was the last time you have checked the log files for suspicious activity? Now would be a good time to review them!

Any file is a database with Log Parser Lizard

Log Parser is wonderful because it effectively lets you run SQL queries against text files:

SELECT DISTINCT src-ip FROM pfirewall.log WHERE action='DROP'

SELECT cs-uri-stem FROM c:\InetPub\Logs\ex*.log
GROUP BY cs-uri-stem HAVING COUNT(*) > 50

SELECT to_lowercase(extract_extension(cs-uri-stem)) AS PageType, SUM(sc-bytes)
FROM ex131118.log, ex131119.log GROUP BY PageType

And Log Parser Lizard is wonderful because it shows that data in a beautiful GUI:

Log Parser Lizard is a GUI for Microsoft Logparser, definitely the best one available on the market today. Log Parser is a very powerful and versatile query software tool that provides universal query access (using SQL) to text-based data, such as log files, XML files, and TSV/CSV text files, as well as key data sources on the Microsoft Windows operating system, such as the Windows Event Log, IIS log, the registry, the File System, the Active Directory services and much more.

Microsoft Logparser is an enhanced query software that digs through information in log files seamlessly and efficiently using SQL queries without storing log data into database.

Because the command-line interface is not very intuitive, we have created Log Parser Lizard, a FREE GUI tool for managing queries and exporting results to Excel, charts, dashboards and even design your own report.. In addition, we have added input filters for custom RegEx and log4net input log formats and also Android logs (with support for console input and regular expressions). You can also write and manage queries for Microsoft SQL Server (T-SQL), OLEDB queries, and you can even analyze big data in the cloud using Google BigQuery services. There are some helpful examples included in the installation package to help you start using Log Parser Lizard  as your query software,web log analyzer and system log analyzer.

Why Log Parser Lizard?

Microsoft does funny things sometimes. They made incredible software package that is not supported and is difficult to use, namely Microsoft Log Parser 2.2. It is painful even for experienced IT administrators to use, due to its knotty command-line interface.

Enter Log Parser Lizard GUI. It leverages the existing technology stack provided by Microsoft, so you know that you know it is quality software. It allows you view the data in a consolidated format. Not just one format, though. Any format you like! It allows you to select what data you want to view with convenient buttons and you can fine-tune it via the easy SQL entry field. It is pre-populated with the most relevant query for your convenience.

MS Logparser and Log Parser Lizard together are essential tools for:

• Forensics

• Debugging

• Collecting logs

• Big Data analysis

• Data Visualization

• Reports

Log Parser Lizard has consistently been awarded top ratings by independent testing labs and recommended by reviewers worldwide. Today LPL has a user base of about 2000 installations each month, based on trend analysis for the last three years and approximately 200,000 users worldwide. Get your copy Now!

Log Parser Lizard features

We utilize a modern Office 2010 tabbed multiple document interface with ribbons, to guarantee the best user experience. The query editor has syntax highlighting and code auto-completion, code snippets, query constants, inline VB.NET code, and more! The query management feature provides a nice way to organize Log Parser queries.

The results output in a default table view similar to Excel, but with more advanced features at your fingertips. Sorting, grouping, searching, filtering, conditional formatting, formula fields, column chooser, and split view. Additionally, you can transform the data in a Excel, HTML, MHT or PDF report, and consolidate the data into a chart for clearer readability. You can use command line to automate the process.

When it comes to data mining and multi-dimensional analysis, an advanced and feature complete pivot table and tree map provides business users unrivaled insights into daily operations.

If you are using (or planning to use) Google’s Big Data services (particularly Google BigQuery) to process your large data/log files (IIS or not – doesn't meter), with Google's servers doing all the big data heavy lifting, you can use Log Parser Lizard to be able to fly through vast data sets with all the visualization options they're accustomed to in the software. If you are a developer, you may build a custom Microsoft VB.Net Plugin for LPL too.

Building dashboards using the designer is a simple matter of selecting the appropriate UI element (Chart, Pivot Table, Data Card, Gauge, Map or Grid) and dropping data fields onto corresponding arguments, values, and series. It’s built so you can do everything inside Log Parser Lizard: from data-binding and dashboard design to filtering, drill down and server side query parameters.

WYSIWYG Report Designer is a Microsoft Word® inspired reporting platform, designed to simplify the way in which the users generate business reports. Report designer leverages the intuitive nature of a word processor and integrates the power of a banded report designer into one.

Click here to see complete list of features available in FREE and PAID version

Buy Software License Now

Purchase the fully featured licensed version of Log Parser Lizard tool (Professional edition) and enjoy browsing your log data. It will come with these advanced features available only in licensed version of Log Parser Lizard:

• Pivot Grid and Tree Map for advanced data mining and multi-dimensional analysis.
• Store queries in SQL Server database for easily share among users and computers in organization (also for backups, auditing and everything that database storage allows)
• Advanced print preview for creating documents print or send them by e-mail from Log Parser Lizard.
• Export data to PDF, RTF, XLS, XLSX, HTML, MHT, CSV, TSV, XML (MS .Net data table) and TXT files.
• Dashboard Viewer
• Dashboard Designer
• WYSIWYG Report Designer
• Built-in Web Server with support for JSON Web API and Web Application
• Basic customer support

The free version has all the features enabled for a limited period of time (20 days). The licensed edition of the tool can be bought from our website once you are completely satisfied with working of the trial version. After making the payment (using PayPal, Mastercard, Visa, checks, etc) to purchase the software, you will receive the activation key and download link within 15 minutes.

Download Now    Check Prices

Impressions of our streamlined user interface

Dashboard designer (Professional edition):

WYSIWYG Report designer (Professional edition):

All available input formats:

• W3C Input Format - parse parses log files in the W3C Extended Log File Format: Microsoft Internet Information Services (IIS), FTP, Apache, Exchange Tracking, Sharepoint, Personal Firewall, Microsoft ISA Server, Windows Media Services, Simple Mail Transfer Protocol (SMTP), etc...
• Windows Event Log - reads event information from local and remote System, Application, Security, and custom event logs, as well as from Event Log backup files (.evtx).
• Active Directory Services - enumerate Active Directory objects using SQL.
• Comma-separated values (CSV) - CSV text files are generated by a large number of applications and tools, including Microsoft Excel and PerfMon.
• Tab-separated and space-separated values (TSV) - this is also the format of the output of many command-line tools.
• Regular Expression Enhanced - most flexible for parsing text based log files - any text file is a database.
• XML Input Format - multiple XML documents and configuration files can be parsed in different ways.
• TEXTLINE Input Format - parse text files in any format not supported natively. Better than grep.
• IIS W3C Logs - MS IIS web sites logging in the W3C Extended format.
• File System - better use SQL to enumerates the files and directories.
• Registry values - enumerates local or remote registry keys and values.
• Logparser COM Input Plugin - with custom plugins, you can literally query any data source.
• IIS Log File Format.
• IIS Centralized Binary Log File.
• Enterprise Tracing for Windows (ETW).
• Multiline RegEx (Log4Net) Input Format.
• SQL Server T-SQL Query - use LPL to query relational databases too.
• C# (C-Sharp) .Net Data Source - run simple C# code and display data in grid.
• HTTP Error log
• IIS ODBC
• NCSA Log File Format
• NetMon Network Monitor
• TEXTWORD Input Format
• URLScan IIS filter
• RegEx Input Format
• OLE DB SQL Query (MySQL, Oracle, Access, PostgreSQL, etc.)
• Facebook Query Language - FQL
• Text file RegEx Input Format
• Google BigQuery
• Ultimate Dates Table
• HTML Table Reader
• Excel File Reader
• Visual Basic .Net Data Source
• Powershell Script

Download Now    Buy License

Why is data visualization important?

Visualizations help people see things that were not obvious to them before. Even when data volumes are very large, patterns can be spotted quickly and easily. Visualizations convey information in a universal manner and make it simple to share ideas with others. It lets people ask others, "Do you see what I see?" And it can even answer questions like "What would happen if we made an adjustment to that area?"

Click here to register your copy and support future development of this product. As a reward you will gain access to all locked features.

About Microsoft LogParser

Microsoft has produced its Log Parser as a query software and log analyzing command line tool.  Its current release is version 2.2.  It is available as a free download from Microsoft on their Log Parser page.

With LogParser you use queries written in a dialect of the SQL language to specify the operations that transform input records generated by an Input Format into output records that are delivered to an Output Format. While many GUI tools are out there that provide filters, even those that allow the user to build custom filters can't compare with the power of writing a custom SQL query in Log Parser. Log parser can accept most common log formats and output it into one of many formats of your choosing for analysis of relevant data.

Log Parser is made up of three components

• Input Formats are generic record provider (records are equivalent to rows in a SQL table. Log Parser's built-in Input Formats can retrieve data from the following sources:
  • IIS log files (W3C, IIS, NCSA, Centralized Binary Logs, HTTP Error logs, URLScan logs, ODBC logs)
  • Windows Event Log
  • Generic XML, CSV, TSV and W3C - formatted text files (e.g. Exchange Tracking log files, Personal Firewall logfiles, Windows Media Services log files, FTP log files, SMTP log files, apache log files etc.)
  • Windows Registry
  • Active Directory Objects
  • File and Directory information
  • NetMon .cap capture files
  • Extended/Combined NCSA log files
  • ETW traces
  • Custom plugins (through a public COM interface)
  • In addition to these input formats Log Parser Lizard GUI have added input filters for:
    • Parsing text based log files line-by-line with Regular Expressions (RegEx Input Format)
    • Log4net and log4j file format (also with support for regular expressions). This input format is also used for parsing multiline text log files (one record is spread through one or more text lines) from various sources
    • SQL server T-SQL queries, retrieves data from SQL server tables and views. For a quick way to export some data from SQL Server to Excel file or to a chart image.
• A SQL-Like Engine Core processes the records generated by an Input Format, using a dialect of the SQL language that includes common SQL clauses (SELECT, WHERE, GROUP BY, HAVING, ORDER BY), aggregate functions (SUM, COUNT, AVG, MAX, MIN), and a rich set of functions (e.g. SUBSTR, CASE, COALESCE, REVERSEDNS, etc.); the resulting records are then sent to an Output Format.
• Output Formats are generic consumers of records; they can be thought of as SQL tables that receive the results of the data processing.
  Log Parser's built-in Output Formats can:
  • Write data to text files in different formats (CSV, TSV, XML, W3C, user-defined, etc.)
  • Send data to a SQL database
  • Send data to a SYSLOG server
  • Create charts and save them in either GIF or JPG image files
  • Display data to the console or to the screen

View the Log Parser Forums for additional information and help on MS Logparser.

Direct Access to Log Data

Simply click one of the tabs and you will see a group of queries that are most relevant to that particular set of log files. You can edit and save a new query in the query group as desired. There are a number of samples included in the package. Amazingly, the File System tab allows you to query the file system directly! And the others are great at number crunching as well. You can simply click through and see everything you want. Additional Log Parser input formats for parsing text files using regular expressions are also included.

Click here to register your copy and support future development of this product. As a reward you will gain access to all locked features.

Using Log Parser

Let's see an example of using Log Parser from a command line. Run Windows command prompt, set current directory path to the directory that contains the executable "logparser.exe" (default "C:\Program Files\Log Parser 2.2") and enter the following command line:

LogParser -i:EVT -fullText:OFF -o:CSV -tabs:OFF "SELECT * INTO output.csv FROM SYSTEM"

This will save all records from System Event Log on the local system in a comma separated text file “output.csv”. This example shows that the Log Parser command is made up of the SQL query and the Input and Output formats options. These kinds of commands are very powerful in scripts for automatic execution and monitoring of the servers. For more information about using Log Parser from a command line, please refer to the help file or look at resources paragraph on this page.

If you are comfortable and familiar with SQL queries and command prompt commands and switches, you will have no problem using the Log Parser, but if you aren't you will have to learn the basics of SQL to effectively work with this tool.

Although LogParser is fantastic, there are a few things that some users didn't like about it:

1. Command line interface can be difficult to learn and adopt for new users.
2. The graphing output and charts are good, but will create a dependency on MS Office. You can’t graph something on a machine without Office installed (as most production servers)
3. No support for a custom text file formats and multiline text log files

This is why we developed a new Log Parser GUI and have shared it with you in the hope of becoming your log reader of choice.

In short, if you keep and analyze any type of log this will make your life easier. By getting to know this tool and its capabilities you'll have better management of your systems, improved development process and have a forensic tool that you'll find new uses for every time you use it. This is a must-have for any systems engineer who needs to take a proactive approach to system monitoring.

Basics of writing a Logparser SQL Query

A basic SQL query must have, at a minimum, two basic building blocks: the SELECT clause, and the FROM clause. For starters: start Log Parser Lizard, click on the “New Query” button on the toolbar, from a drop down list select “Windows Event Log” and in the Query text box in the bottom of the window write the following command:

SELECT * FROM System

The SELECT clause is used to specify which input record fields we want to appear in the output. The FROM clause is used to specify which specific data source we want the Input Format to process. Different Input Formats interpret the value of the FROM clause in different ways; for instance, the EVT Input Format requires the value of the FROM clause to be the name of a Windows Event Log, which in our example is the "System" Event Log.

The special "*" wildcard after a SELECT keyword means "all the fields" (like in standard SQL). Most of the time, an output of all of the fields of the log records might not be desired. You might only want to see only the fields that are of your interest. To accomplish this, instead of the "*" wildcard in the SELECT clause, you will have to write a comma-separated list of the names of the fields you wish to be displayed.

SELECT TimeGenerated, EventTypeName, SourceName FROM System

The Log Parser SQL-like language also supports a wide variety of functions, including arithmetical functions (e.g. ADD, SUB, MUL, DIV, MOD, QUANTIZE, etc.), string manipulation functions (e.g. SUBSTR, STRCAT, STRLEN, EXTRACT_TOKEN, etc.), and timestamp manipulation functions (e.g. TO_DATE, TO_TIME, TO_UTCTIME, etc.). Functions can also appear as arguments of other functions.

SELECT TO_DATE(TimeGenerated), TO_UPPERCASE( EXTRACT_TOKEN(EventTypeName, 0, ' ') ), SourceName FROM System

То change the name of a field-expression in the SELECT clause by using an alias you can use the AS keyword followed by the new name of the field.

SELECT TO_DATE(TimeGenerated) AS DateGenerated, TO_UPPERCASE( EXTRACT_TOKEN(EventTypeName, 0, ' ') ) AS TypeName, SourceName FROM System

When retrieving data from an Input Format, it is common to want to filter out unneeded records and only keep those that match specific criteria. To accomplish this task, you can use another basic building block of the Log Parser SQL language: the WHERE clause which is used to specify a Boolean expression that must be satisfied by an input record for that record to be listed in the output. Input records that do not satisfy the condition will be discarded. Conditions specified in the WHERE clause can be more complex, making use of comparison operators (such as ">", "<=", "<>", "LIKE", "BETWEEN", etc.) and boolean operators (such as "AND", "OR", "NOT"). The WHERE clause must immediately follow the FROM clause.

SELECT TimeGenerated, EventTypeName, SourceName FROM System WHERE ( SourceName = 'Service Control Manager' AND EventID >= 7024)

The ORDER BY clause can be used to specify that the output records should be sorted according to the values of selected fields. By default, output records are sorted according to ascending values. We can change the sort direction by appending the DESC (for descending) or ASC (for ascending) keywords to the ORDER BY clause.

SELECT SourceName, EventID, TimeGenerated FROM System ORDER BY TimeGenerated

Sometimes we might need to aggregate multiple input records together and perform some operation on groups of input records. To accomplish this, the Log Parser SQL like language has a set of aggregate functions (also referred to as "SQL functions") that can be used to perform basic calculations on multiple records. These functions include SUM, COUNT, MAX, MIN, and AVG. The GROUP BY clause is used to specify which fields we want the group subdivision to be based on. After the input records have been divided into these groups, all the aggregate functions in the SELECT clause will be calculated separately on each of these groups, and the query will return an output record for each group created.

SELECT EventTypeName, Count(*) FROM System GROUP BY EventTypeName

For filtering results from groups you can use the HAVING clause. The HAVING clause works just like the WHERE clause, with the only difference being that the HAVING clause is evaluated after groups have been created, which makes it possible for the HAVING clause to specify aggregate functions.

SELECT EventTypeName, Count(*) FROM System GROUP BY EventTypeName HAVING EventTypeName =’Error event'

The DISTINCT keyword is used to indicate that the output of a query should consist of unique records. Duplicate output records are discarded. It is also possible to use the DISTINCT keyword inside the COUNT aggregate function, in order to retrieve the total number of different values appearing in the data.

SELECT DISTINCT SourceName FROM System

SELECT COUNT( DISTINCT SourceName) FROM System

Use the TOP keyword in the SELECT clause to return only a few records at the top of the ordered output.

SELECT TOP 10 SourceName, Count(*) as Total FROM System GROUP BY SourceName ORDER BY Total DESC

These are simple queries, but they clearly show that this log tool is more powerful for analyzing syslog events than any other event log viewer. For more samples, you can always look at the examples provided with the program. They don’t all work out-of-the-box but can be very helpful.

There are a number of great resources on the Internet for learning more about MS Logparser and Log Parser Lizard

Please check our Help Center and the following links for additional information:

• Log Parser 2.2 download
• Logparser Forums
• Computer Forensics How-To: Microsoft Log Parser
• Using Log Parser Lizard with SharePoint
• Examples (SQL) queries for IIS Analysis
• Sysmon queries on GitHub
• Under the hood of Logparser
• Microsoft Script Center page - The Microsoft logparser overview page
• Forensic IIS log exploration with LogParser
• Using the Logparser Utility to Analyze Exchange/IIS Logs
• LogParser 2.2 and ASP.NET
• Auditing the Event Logs
• Log Parser Plus
• Aggressive Virus Defense
• Log Parser Rocks! More than 50 Examples
• Automating log analysis with LogParser, Log Parser Lizard and sendEmail

F.A.Q

Q: Why another Log Parser? Why use it instead of Google Analytics or Splunk?

Because the Google Analytics reports are inaccurate. Web reporting tools like Google Analytics and other cloud-based log managers (like Splunk, Loggly, Logstash...) are OK but not good enough for a number of reasons. Here are three big ones:

• Google Analytics and similar services don�t track anything that doesn�t have an HREF element (a click on a form submit button, AJAX callback or play button on a video for example)
• Google Analytics can't tell you about the problems of missing pages, java scripts or images, SQL injection, directory traversal, cross site script (XSS), failed login attempts, etc.
• You need to send sensitive information or import log files into their databases without even knowing what they were doing wit it.

Now that you understand the possible reasons why Google Analytics is inaccurate you will see the importance of analyzing your log data completely differently. And what about if you�ve been tasked with collecting all security audit success and failure events from all company workstations and servers into a central location, where you can then define and search for anomalies. Here comes the help from Microsoft Log parser and Log Parser Lizard. And LPL can even query relational databases like SQL Server and others.

Q: Why should I download?

Everyone loves to play with new software! It lets you browse the log files of your computer in new and interesting ways, at NO CHARGE!

Q: Where can I find previous version?

Download previous version of Log Parser Lizard 4.0.9 from here, version 5.6.2 from here or version 6.8.3 from here (all are not supported anymore)

Q: Is it really free?

Yes, the download of Log Parser Lizard GUI is completely free! It lets you perform many of the tasks that you want to do in the Microsoft Windows Operating system.

Q: Why should I upgrade?

There are advanced features in Professional version that most people will find useful. Also free trial is available for 20 days only so if you need LPL for more you should upgrade.

Q: What's the pricy one?

In the corporate environment, the IT Staff need to share information between computers. The additional feature allows this through a Microsoft SQL Server backend.

Q: What if I don't like it?

If you purchase Log Parser Lizard GUI and are dissatisfied for any reason, there is a Money Back Guarantee! Simply contact Lizard Labs Software within 15 days of your purchase and receive a no-hassle refund.

Q: How to uninstall Log Parser Lizard?

Log Parser Lizard can be uninstalled by:

• Open the Windows Control Panel
• Select 'Uninstall a Program'
• Find Log Parser Lizard in the list of programs and double click on it
• Click the 'Uninstall' button in the Log Parser Lizard Uninstall window

By purchasing a license, you not only become a registered user but also actively contribute to the ongoing development and improvement of our software.

Download Now    Buy License