Log Parser queries to find 400 and 500 http status codes

• September 9, 2007
• James Skemp
• software, tutorials / guides

In a previous article, I discussed how to use Log Parser to find 404 errors in IIS log files. This time, I've made it a little broader, by giving some queries to find all 400 codes, and all 500 codes, through log files.

There may be a better way to find these codes (instead of my IN statement), but a standard LIKE doesn't seem to work.

Again, these assume that you've currently got a command line open in the folder containing your IIS logs, and that you are logging the above information, as well as that logparser is setup in your PATH line.

400 Status Codes

logparser -rtp:-1 "SELECT cs-uri-stem, cs-uri-query, date, sc-status, cs(Referer) INTO 400sReport.txt FROM ex*.log WHERE (sc-status >= 400 AND sc-status < 500) ORDER BY sc-status, date, cs-uri-stem, cs-uri-query"

500 Status Codes

logparser -rtp:-1 "SELECT cs-uri-stem, cs-uri-query, date, sc-status, cs(Referer) INTO 500sReport.txt FROM ex*.log WHERE (sc-status >= 500 AND sc-status < 600) ORDER BY sc-status, date, cs-uri-stem, cs-uri-query"

A Google search for http status codes will give a number of resources regarding exactly what these codes mean. 

Updated 2007.09.10

Added the correct parameter to display all date in one big 'table', so the column headings don't repeat every 10 lines.

• log parser
• iis
• analytics