Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a public website that is used by both external visitors and internal employees. I'm after the external visitor hits, but I can't think of a good way to filter out the internal IP ranges.

Using LogParser, what is the best way to filter IISW3C logs by IP range?

This is all I've come up with so far, which can't possibly be the best or most efficient way.

WHERE [c-ip] NOT LIKE (10.10.%, 10.11.%)

Any help is appreciated.

share|improve this question
up vote 1 down vote accepted

After a lot of looking, I ended up using what I listed in the question. I still don't think it is the most efficient, but it works and is readable.

WHERE [c-ip] NOT LIKE (10.10.%, 10.11.%)
share|improve this answer
we have the same problem on our sites; the load balancer pings the sites constantly and we need to filter that IP out of the logs as well. I'm starting to think there needs to be a pre-processing step where we grep/replace out those lines.. – Jeff Atwood Apr 30 '10 at 16:56
Ahh. That's a good idea too. – Josh May 20 '10 at 14:16

I always recommend this page from SecurityFocus for parsing log files with LogParser.

share|improve this answer
That is a good article (and one I have bookmarked) but they don't really search like I'm trying to do. They do a sub-select for IP addresses appearing elsewhere and some targeted where c-ip = X OR c-ip = Y type queries. I'm trying to exclude specific IP blocks. – Josh Feb 1 '10 at 15:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.