Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am looking to extract from iis when a certain user session indicated here by aspnetsessionid times out prior to 10 minutes session timeout I have set on this application.

I am trying to parse iis logs and I am not sure how to take each sessionid and count how many minutes it lasted.

After I have this first part solved, I will look for which of the sessions ended with a call to the page timeout.aspx although it would be nice to specify this in one query.

I am trying to work on this query

SELECT  
TO_STRING(time, 'm') as mins,
    EXTRACT_TOKEN(EXTRACT_TOKEN(cs(Cookie), 1, 'ASP.NET_SessionId='), 0, ';+__ut') as    ASPNETSESSIONID From C:\logs\ex11*.log
GROUP BY ASPNETSESSIONID, mins

Here is an example of my log file instance I am trying to catch

Line Number Date    Time    Client-IP   Server IP   Server Port Request Verb    Request URI, ASPNETSessionID
255 4/1/2011    19:40:55    222.222.22.22   111.11.111.11   443 GET /webpage.aspx   1234567890
256 4/1/2011    19:40:55    222.222.22.22   111.11.111.11   443 GET /jscript/SessionTimeout/SessionTimeout.js   1234567890
257 4/1/2011    19:40:58    222.222.22.22   111.11.111.11   443 POST    /VerifySession.aspx 1234567890
260 4/1/2011    19:41:04    222.222.22.22   111.11.111.11   443 POST    /Formle.aspx    1234567890
261 4/1/2011    19:41:04    222.222.22.22   111.11.111.11   443 GET /jscript/SessionTimeout/SessionTimeout.js   1234567890
263 4/1/2011    19:41:05    222.222.22.22   111.11.111.11   443 POST    /VerifySession.aspx 1234567890
265 4/1/2011    19:41:10    222.222.22.22   111.11.111.11   443 POST    /FormItemsTable.aspx    1234567890
266 4/1/2011    19:41:10    222.222.22.22   111.11.111.11   443 GET /FormRecord.aspx    1234567890
267 4/1/2011    19:41:10    222.222.22.22   111.11.111.11   443 GET /jscript/SessionTimeout/SessionTimeout.js   1234567890
268 4/1/2011    19:41:12    222.222.22.22   111.11.111.11   443 POST    /VerifySession.aspx 1234567890
273 4/1/2011    19:41:23    222.222.22.22   111.11.111.11   443 POST    /FormRd.aspx    1234567890
274 4/1/2011    19:41:23    222.222.22.22   111.11.111.11   443 GET /jscript/SessionTimeout/SessionTimeout.js   1234567890
275 4/1/2011    19:41:25    222.222.22.22   111.11.111.11   443 POST    /VerifySession.aspx 1234567890
276 4/1/2011    19:41:25    222.222.22.22   111.11.111.11   443 GET /Timeout.aspx   1234567890
share|improve this question

1 Answer 1

http://stackoverflow.com/questions/5539229/whiting-a-group-by-query-for-logparser-to-look-for-a-pattern/5540840#5540840

import the data into db, then query

SELECT * from ((SELECT MAX(LocalDateTime) FROM dpo.importtable AS [initial] WHERE sessionid = raw_data.sessionid) - (SELECT MIN(LocalDateTime) FROM dpo.importtable AS [initial] WHERE sessionid = raw_data.sessionid) as diff) as g where diff < CAST('1900-01-01 00:10:00.000' AS datetime)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.