Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm working on a public website that is used by both external visitors and internal employees. I'm after the external visitor hits, but I can't think of a good way to filter out the internal IP ranges.

Using LogParser, what is the best way to filter IISW3C logs by IP range?

This is all I've come up with so far, which can't possibly be the best or most efficient way.

WHERE [c-ip] NOT LIKE (10.10.%, 10.11.%)

Any help is appreciated.

share|improve this question
add comment

2 Answers

I always recommend this page from SecurityFocus for parsing log files with LogParser.

share|improve this answer
    
That is a good article (and one I have bookmarked) but they don't really search like I'm trying to do. They do a sub-select for IP addresses appearing elsewhere and some targeted where c-ip = X OR c-ip = Y type queries. I'm trying to exclude specific IP blocks. –  Josh Feb 1 '10 at 15:26
add comment
up vote 1 down vote accepted

After a lot of looking, I ended up using what I listed in the question. I still don't think it is the most efficient, but it works and is readable.

WHERE [c-ip] NOT LIKE (10.10.%, 10.11.%)
share|improve this answer
1  
we have the same problem on our sites; the load balancer pings the sites constantly and we need to filter that IP out of the logs as well. I'm starting to think there needs to be a pre-processing step where we grep/replace out those lines.. –  Jeff Atwood Apr 30 '10 at 16:56
    
Ahh. That's a good idea too. –  Josh May 20 '10 at 14:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.