ActiveSync Report ActiveSync detailed ActiveSync usage report SELECT TO_LOWERCASE (cs-username) AS User, MyDeviceId AS DeviceId, MyDeviceType AS DeviceType, cs(User-Agent) AS User-Agent, COUNT(*) AS Hits, SUM (MyPing) AS Ping, SUM (MySync) AS Sync, SUM (MyFolderSync) AS FolderSync, SUM (MySendMail) AS SendMail, SUM (MySmartReply) AS SmartReply, SUM (MyMeetingResponse) AS MeetingResponse, SUM (MyGetAttachment) AS GetAttachment, SUM (MySmartForward) AS SmartForward, SUM (MyGetHierarchy) AS GetHierarchy, SUM (MyCreateCollection) AS CreateCollection, SUM (MyDeleteCollection) AS DeleteCollection, SUM (MyMoveCollection) AS MoveCollection, SUM (MyFolderCreate) AS FolderCreate, SUM (MyFolderDelete) AS FolderDelete, SUM (MyFolderUpdate) AS FolderUpdate, SUM (MyMoveItems) AS MoveItems, SUM (MyGetItemEstimate) AS GetItemEstimate, SUM (MySearch) AS Search, SUM (MySettings) AS Settings, SUM (MyItemOperations) AS ItemOperations, SUM (MyProvision) AS Provision, SUM (MyResolveRecipients) AS ResolveRecipients, SUM (MyValidateCert) AS ValidateCert, DIV(MAX(time-taken),1000) AS LongestRequestTime(s),DIV(AVG(time-taken),1000) AS AVGRequestTime(s), SUM (MyInvalidContent) AS InvalidContent, SUM (MyServerError) AS ServerError, SUM (MyServerErrorRetryLater) AS ServerErrorRetryLater, SUM (MyMailboxQuotaExceeded) AS MailboxQuotaExceeded, SUM (MyDeviceIsBlockedForThisUser) AS DeviceIsBlockedForThisUser, SUM (MyAccessDenied) AS AccessDenied, SUM (MySyncStateNotFound) AS SyncStateNotFound, SUM (MyDeviceNotFullyProvisionable) AS DeviceNotFullyProvisionable, SUM (MyDeviceNotProvisioned) AS DeviceNotProvisioned, SUM (MyItemNotFound) AS ItemNotFound, SUM (ADD(MyDisabledForSyncCnt1,MyDisabledForSyncCnt2)) AS UserDisabledForSync, SUM (MyTooManyJobsQueued) AS TooManyJobsQueued, SUM (MyOverBudget) AS OverBudget, SUM (MyIIS_5xx) AS IIS_5xx, SUM (MyIIS_4xx) AS IIS_4xx, SUM (MyIIS_503) AS IIS_503, SUM (MyIIS_507) AS IIS_507, SUM (MyIIS_409) AS IIS_409, SUM (MyIIS_451) AS IIS_451 USING EXTRACT_VALUE(cs-uri-query,'DeviceType') AS MyDeviceType, EXTRACT_VALUE(cs-uri-query,'DeviceId') AS MyDeviceId, EXTRACT_VALUE(cs-uri-query,'User-Agent') AS MyUser-Agent, EXTRACT_VALUE(cs-uri-query,'Cmd') AS MyCmd, EXTRACT_VALUE(cs-uri-query,'Log') AS MyLog, SUBSTR(TO_STRING(sc-status),0,1) AS StatusCode, /* Getting any error's that might be in MyLog */ SUBSTR (MyLog, ADD (INDEX_OF (MyLog, 'Error:'), 6), INDEX_OF (SUBSTR(MyLog, ADD (INDEX_OF (MyLog, 'Error:'), 6)), '_')) AS MyLogError, /* Detect if ActiveSync is disabled for User */ /* Exchange 2003 */ CASE EXTRACT_TOKEN(MyLog,0,':') WHEN 'VNATNASNC' THEN 1 ELSE 0 END AS MyDisabledForSyncCnt1, /* Exchange 2010 */ CASE MyLogError WHEN 'UserDisabledForSync' THEN 1 ELSE 0 END AS MyDisabledForSyncCnt2, /* END -- Detecting if ActiveSync is disabled for User */ CASE MyLogError WHEN 'OverBudget' THEN 1 ELSE 0 END AS MyOverBudget, CASE MyLogError WHEN 'TooManyJobsQueued' THEN 1 ELSE 0 END AS MyTooManyJobsQueued, CASE MyLogError WHEN 'InvalidContent' THEN 1 ELSE 0 END AS MyInvalidContent, CASE MyLogError WHEN 'ServerError' THEN 1 ELSE 0 END AS MyServerError, CASE MyLogError WHEN 'ServerErrorRetryLater' THEN 1 ELSE 0 END AS MyServerErrorRetryLater, CASE MyLogError WHEN 'MailboxQuotaExceeded' THEN 1 ELSE 0 END AS MyMailboxQuotaExceeded, CASE MyLogError WHEN 'DeviceIsBlockedForThisUser' THEN 1 ELSE 0 END AS MyDeviceIsBlockedForThisUser, CASE MyLogError WHEN 'AccessDenied' THEN 1 ELSE 0 END AS MyAccessDenied, CASE MyLogError WHEN 'SyncStateNotFound' THEN 1 ELSE 0 END AS MySyncStateNotFound, CASE MyLogError WHEN 'DeviceNotFullyProvisionable' THEN 1 ELSE 0 END AS MyDeviceNotFullyProvisionable, CASE MyLogError WHEN 'DeviceNotProvisioned' THEN 1 ELSE 0 END AS MyDeviceNotProvisioned, CASE MyLogError WHEN 'ItemNotFound' THEN 1 ELSE 0 END AS MyItemNotFound, CASE StatusCode WHEN '5' THEN 1 ELSE 0 END AS MyIIS_5xx, CASE StatusCode WHEN '4' THEN 1 ELSE 0 END AS MyIIS_4xx, CASE TO_STRING(sc-status) WHEN '503' THEN 1 ELSE 0 END AS MyIIS_503, CASE TO_STRING(sc-status) WHEN '507' THEN 1 ELSE 0 END AS MyIIS_507, CASE TO_STRING(sc-status) WHEN '409' THEN 1 ELSE 0 END AS MyIIS_409, CASE TO_STRING(sc-status) WHEN '451' THEN 1 ELSE 0 END AS MyIIS_451, CASE MyCmd WHEN 'Sync' THEN 1 ELSE 0 END AS MySync, CASE MyCmd WHEN 'Ping' THEN 1 ELSE 0 END AS MyPing, CASE MyCmd WHEN 'SendMail' THEN 1 ELSE 0 END AS MySendMail, CASE MyCmd WHEN 'SmartReply' THEN 1 ELSE 0 END AS MySmartReply, CASE MyCmd WHEN 'MeetingResponse' THEN 1 ELSE 0 END AS MyMeetingResponse, CASE MyCmd WHEN 'GetAttachment' THEN 1 ELSE 0 END AS MyGetAttachment, CASE MyCmd WHEN 'FolderSync' THEN 1 ELSE 0 END AS MyFolderSync, CASE MyCmd WHEN 'SmartFoward' THEN 1 ELSE 0 END AS MySmartForward, CASE MyCmd WHEN 'GetHierarchy' THEN 1 ELSE 0 END AS MyGetHierarchy, CASE MyCmd WHEN 'CreateCollection' THEN 1 ELSE 0 END AS MyCreateCollection, CASE MyCmd WHEN 'DeleteCollection' THEN 1 ELSE 0 END AS MyDeleteCollection, CASE MyCmd WHEN 'MoveCollection' THEN 1 ELSE 0 END AS MyMoveCollection, CASE MyCmd WHEN 'FolderCreate' THEN 1 ELSE 0 END AS MyFolderCreate, CASE MyCmd WHEN 'FolderDelete' THEN 1 ELSE 0 END AS MyFolderDelete, CASE MyCmd WHEN 'FolderUpdate' THEN 1 ELSE 0 END AS MyFolderUpdate, CASE MyCmd WHEN 'MoveItems' THEN 1 ELSE 0 END AS MyMoveItems, CASE MyCmd WHEN 'GetItemEstimate' THEN 1 ELSE 0 END AS MyGetItemEstimate, CASE MyCmd WHEN 'Search' THEN 1 ELSE 0 END AS MySearch, CASE MyCmd WHEN 'Settings' THEN 1 ELSE 0 END AS MySettings, CASE MyCmd WHEN 'ItemOperations' THEN 1 ELSE 0 END AS MyItemOperations, CASE MyCmd WHEN 'Provision' THEN 1 ELSE 0 END AS MyProvision, CASE MyCmd WHEN 'ResolveRecipients' THEN 1 ELSE 0 END AS MyResolveRecipients, CASE MyCmd WHEN 'ValidateCert' THEN 1 ELSE 0 END AS MyValidateCert FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/Microsoft-Server-ActiveSync%' GROUP BY User,DeviceType,DeviceId,User-Agent ORDER BY Hits DESC 91930a9f-9680-47d2-8341-b68fac8c6417 IISW3CLOG MAS true ActiveSync Report [Top 20] ActiveSync detailed ActiveSync usage report for the top 20 consumers SELECT TOP 20 TO_LOWERCASE (cs-username) AS User, MyDeviceId AS DeviceId, MyDeviceType AS DeviceType, cs(User-Agent) AS User-Agent, COUNT(*) AS Hits, SUM (MyPing) AS Ping, SUM (MySync) AS Sync, SUM (MyFolderSync) AS FolderSync, SUM (MySendMail) AS SendMail, SUM (MySmartReply) AS SmartReply, SUM (MyMeetingResponse) AS MeetingResponse, SUM (MyGetAttachment) AS GetAttachment, SUM (MySmartForward) AS SmartForward, SUM (MyGetHierarchy) AS GetHierarchy, SUM (MyCreateCollection) AS CreateCollection, SUM (MyDeleteCollection) AS DeleteCollection, SUM (MyMoveCollection) AS MoveCollection, SUM (MyFolderCreate) AS FolderCreate, SUM (MyFolderDelete) AS FolderDelete, SUM (MyFolderUpdate) AS FolderUpdate, SUM (MyMoveItems) AS MoveItems, SUM (MyGetItemEstimate) AS GetItemEstimate, SUM (MySearch) AS Search, SUM (MySettings) AS Settings, SUM (MyItemOperations) AS ItemOperations, SUM (MyProvision) AS Provision, SUM (MyResolveRecipients) AS ResolveRecipients, SUM (MyValidateCert) AS ValidateCert, DIV(MAX(time-taken),1000) AS LongestRequestTime(s),DIV(AVG(time-taken),1000) AS AVGRequestTime(s), SUM (MyInvalidContent) AS InvalidContent, SUM (MyServerError) AS ServerError, SUM (MyServerErrorRetryLater) AS ServerErrorRetryLater, SUM (MyMailboxQuotaExceeded) AS MailboxQuotaExceeded, SUM (MyDeviceIsBlockedForThisUser) AS DeviceIsBlockedForThisUser, SUM (MyAccessDenied) AS AccessDenied, SUM (MySyncStateNotFound) AS SyncStateNotFound, SUM (MyDeviceNotFullyProvisionable) AS DeviceNotFullyProvisionable, SUM (MyDeviceNotProvisioned) AS DeviceNotProvisioned, SUM (MyItemNotFound) AS ItemNotFound, SUM (ADD(MyDisabledForSyncCnt1,MyDisabledForSyncCnt2)) AS UserDisabledForSync, SUM (MyTooManyJobsQueued) AS TooManyJobsQueued, SUM (MyOverBudget) AS OverBudget, SUM (MyIIS_5xx) AS IIS_5xx, SUM (MyIIS_4xx) AS IIS_4xx, SUM (MyIIS_503) AS IIS_503, SUM (MyIIS_507) AS IIS_507, SUM (MyIIS_409) AS IIS_409, SUM (MyIIS_451) AS IIS_451 USING EXTRACT_VALUE(cs-uri-query,'DeviceType') AS MyDeviceType, EXTRACT_VALUE(cs-uri-query,'DeviceId') AS MyDeviceId, EXTRACT_VALUE(cs-uri-query,'User-Agent') AS MyUser-Agent, EXTRACT_VALUE(cs-uri-query,'Cmd') AS MyCmd, EXTRACT_VALUE(cs-uri-query,'Log') AS MyLog, SUBSTR(TO_STRING(sc-status),0,1) AS StatusCode, /* Getting any error's that might be in MyLog */ SUBSTR (MyLog, ADD (INDEX_OF (MyLog, 'Error:'), 6), INDEX_OF (SUBSTR(MyLog, ADD (INDEX_OF (MyLog, 'Error:'), 6)), '_')) AS MyLogError, /* Detect if ActiveSync is disabled for User */ /* Exchange 2003 */ CASE EXTRACT_TOKEN(MyLog,0,':') WHEN 'VNATNASNC' THEN 1 ELSE 0 END AS MyDisabledForSyncCnt1, /* Exchange 2010 */ CASE MyLogError WHEN 'UserDisabledForSync' THEN 1 ELSE 0 END AS MyDisabledForSyncCnt2, /* END -- Detecting if ActiveSync is disabled for User */ CASE MyLogError WHEN 'OverBudget' THEN 1 ELSE 0 END AS MyOverBudget, CASE MyLogError WHEN 'TooManyJobsQueued' THEN 1 ELSE 0 END AS MyTooManyJobsQueued, CASE MyLogError WHEN 'InvalidContent' THEN 1 ELSE 0 END AS MyInvalidContent, CASE MyLogError WHEN 'ServerError' THEN 1 ELSE 0 END AS MyServerError, CASE MyLogError WHEN 'ServerErrorRetryLater' THEN 1 ELSE 0 END AS MyServerErrorRetryLater, CASE MyLogError WHEN 'MailboxQuotaExceeded' THEN 1 ELSE 0 END AS MyMailboxQuotaExceeded, CASE MyLogError WHEN 'DeviceIsBlockedForThisUser' THEN 1 ELSE 0 END AS MyDeviceIsBlockedForThisUser, CASE MyLogError WHEN 'AccessDenied' THEN 1 ELSE 0 END AS MyAccessDenied, CASE MyLogError WHEN 'SyncStateNotFound' THEN 1 ELSE 0 END AS MySyncStateNotFound, CASE MyLogError WHEN 'DeviceNotFullyProvisionable' THEN 1 ELSE 0 END AS MyDeviceNotFullyProvisionable, CASE MyLogError WHEN 'DeviceNotProvisioned' THEN 1 ELSE 0 END AS MyDeviceNotProvisioned, CASE MyLogError WHEN 'ItemNotFound' THEN 1 ELSE 0 END AS MyItemNotFound, CASE StatusCode WHEN '5' THEN 1 ELSE 0 END AS MyIIS_5xx, CASE StatusCode WHEN '4' THEN 1 ELSE 0 END AS MyIIS_4xx, CASE TO_STRING(sc-status) WHEN '503' THEN 1 ELSE 0 END AS MyIIS_503, CASE TO_STRING(sc-status) WHEN '507' THEN 1 ELSE 0 END AS MyIIS_507, CASE TO_STRING(sc-status) WHEN '409' THEN 1 ELSE 0 END AS MyIIS_409, CASE TO_STRING(sc-status) WHEN '451' THEN 1 ELSE 0 END AS MyIIS_451, CASE MyCmd WHEN 'Sync' THEN 1 ELSE 0 END AS MySync, CASE MyCmd WHEN 'Ping' THEN 1 ELSE 0 END AS MyPing, CASE MyCmd WHEN 'SendMail' THEN 1 ELSE 0 END AS MySendMail, CASE MyCmd WHEN 'SmartReply' THEN 1 ELSE 0 END AS MySmartReply, CASE MyCmd WHEN 'MeetingResponse' THEN 1 ELSE 0 END AS MyMeetingResponse, CASE MyCmd WHEN 'GetAttachment' THEN 1 ELSE 0 END AS MyGetAttachment, CASE MyCmd WHEN 'FolderSync' THEN 1 ELSE 0 END AS MyFolderSync, CASE MyCmd WHEN 'SmartFoward' THEN 1 ELSE 0 END AS MySmartForward, CASE MyCmd WHEN 'GetHierarchy' THEN 1 ELSE 0 END AS MyGetHierarchy, CASE MyCmd WHEN 'CreateCollection' THEN 1 ELSE 0 END AS MyCreateCollection, CASE MyCmd WHEN 'DeleteCollection' THEN 1 ELSE 0 END AS MyDeleteCollection, CASE MyCmd WHEN 'MoveCollection' THEN 1 ELSE 0 END AS MyMoveCollection, CASE MyCmd WHEN 'FolderCreate' THEN 1 ELSE 0 END AS MyFolderCreate, CASE MyCmd WHEN 'FolderDelete' THEN 1 ELSE 0 END AS MyFolderDelete, CASE MyCmd WHEN 'FolderUpdate' THEN 1 ELSE 0 END AS MyFolderUpdate, CASE MyCmd WHEN 'MoveItems' THEN 1 ELSE 0 END AS MyMoveItems, CASE MyCmd WHEN 'GetItemEstimate' THEN 1 ELSE 0 END AS MyGetItemEstimate, CASE MyCmd WHEN 'Search' THEN 1 ELSE 0 END AS MySearch, CASE MyCmd WHEN 'Settings' THEN 1 ELSE 0 END AS MySettings, CASE MyCmd WHEN 'ItemOperations' THEN 1 ELSE 0 END AS MyItemOperations, CASE MyCmd WHEN 'Provision' THEN 1 ELSE 0 END AS MyProvision, CASE MyCmd WHEN 'ResolveRecipients' THEN 1 ELSE 0 END AS MyResolveRecipients, CASE MyCmd WHEN 'ValidateCert' THEN 1 ELSE 0 END AS MyValidateCert FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/Microsoft-Server-ActiveSync%' GROUP BY User,DeviceType,DeviceId,User-Agent ORDER BY Hits DESC 8019fbe6-c749-45b3-81a2-80864b70cd93 IISW3CLOG MAS true ActiveSync: 500x HTTP /3 Minutes Finds ActiveSync 500x errors and breaks into 3 minute blocks SELECT QUANTIZE(TO_TIMESTAMP(date, time), 180) AS threemin, COUNT(*) AS Total, TO_LOWERCASE(cs-uri-stem) AS Vdir, sc-status as HTTPstatus INTO '[OUTFILEPATH]\EWSHitsPerHourWithError503.csv' FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '/Microsoft-server-Activesync' AND sc-status = '503' GROUP BY threemin, Vdir, HTTPstatus ORDER BY threemin d13bc572-447f-45ac-9192-9ebdc46b4a22 IISW3CLOG MAS false ActiveSync: Android report by User/Version/Hits Android report by User/Version/Hits /* Android report by User/Version/Hits */ SELECT c-ip AS ClientIP, cs-username AS User, cs(User-Agent) AS Client, Count(cs-username) AS Hits from '[LOGFILEPATH]' WHERE TO_LOWERCASE(cs(User-Agent)) LIKE '%droid%' AND cs-username IS NOT NULL GROUP BY User, c-ip, cs(User-Agent) ORDER BY Hits DESC 21a82d94-8641-4253-b5b2-e6d4b2553f8f IISW3CLOG MAS false ActiveSync: Budget Report [100% Exceeded] Returns all ActiveSync Requests where any budget exceeds 100% /* Returns all Microsoft-Server-ActiveSync requests where any budget is over 100% Sorted by the total of all budgets (AD/CAS/RPC/FC/AB) The policy that is in effect is also listed. These users are exceeding their budget. */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND (TO_INT(AD%) > 100 OR TO_INT(CAS%) > 100 OR TO_INT(AB%) > 100 OR TO_INT(RPC%) > 100 OR TO_INT(FC%) > 100) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC 67387ee8-a051-4010-81ef-59685157e8a5 IISW3CLOG MAS true ActiveSync: Budget Report [75% Exceeded] Returns all ActiveSync requests where any budget exceeds 75% /* Returns all ActiveSync requests where any budget is over 75% Sorted by the total of all budgets (AD/CAS/RPC/FC/AB) The policy that is in effect is also listed. */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND (TO_INT(AD%) > 75 OR TO_INT(CAS%) > 75 OR TO_INT(AB%) > 75 OR TO_INT(RPC%) > 75 OR TO_INT(FC%) > 75) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC ba7473ee-13d1-4e64-8440-012175be40e0 IISW3CLOG MAS true ActiveSync: Devices Report [Top 20 Devices] Returns all ActiveSync hits ordered by device type and number of hits for the top 20 devices by number of hits. /* Top 20 ActiveSync Devices Report by Hits. */ SELECT TOP 20 cs(User-Agent) AS DeviceType, Count(*) as Hits FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' GROUP BY DeviceType ORDER BY Hits, DeviceType DESC 8390f022-fb1b-47ce-b158-3ffc9068196a IISW3CLOG MAS false ActiveSync: Devices Report [Top 20 Devices] Specific Device Returns all ActiveSync hits ordered by device type and number of hits for the top 20 devices by number of hits. /* Top 20 ActiveSync Devices Report by Hits. Add the device string below to count a single device or device type. */ SELECT TOP 20 cs(User-Agent) AS DeviceType, Count(*) as Hits FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs(user-Agent) LIKE /* Put device type here -> */ '%iPad%' GROUP BY DeviceType ORDER BY Hits, DeviceType DESC d170f1f6-3678-443c-b8d8-c3e49f128b5d IISW3CLOG MAS false ActiveSync: Devices Report [Top 20 Devices] Specific Device Returns all ActiveSync hits ordered by device type and number of hits for the top 20 devices by number of hits. /* Top 20 ActiveSync Devices Report by Hits. Add the device string below to count a single device or device type. */ SELECT TOP 20 cs(User-Agent) AS DeviceType, Count(*) as Hits FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs(user-Agent) LIKE /* Put device type here -> */ '%iPad%' GROUP BY DeviceType ORDER BY Hits, DeviceType DESC d170f1f6-3678-443c-b8d8-c3e49f128b5d IISW3CLOG MAS false ActiveSync: Errors by User to CSV Returns all ActiveSync error and aggregates them by error number and user. /* THIS CREATES A FILE: EASUsersByError_500_Plus.CSV Change the filename/path below to suit your needs. */ select cs-username, cs(User-Agent) AS DeviceType, TO_LOWERCASE(cs-uri-stem) AS application, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, Count(*) INTO '[OUTFILEPATH]\EASusersByerror_500_plus.csv' FROM '[LOGFILEPATH]' WHERE TO_STRING(sc-status) LIKE '500' AND cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs-username IS NOT NULL Group BY cs-username, DeviceType, application, HTTPstatus Order BY cs-username, DeviceType fd2ecb66-219a-4f37-95b1-e1a875dbe261 IISW3CLOG MAS false ActiveSync: HTTP 500 /Hour EAS requests per hour with Error 500 description. You can search for specific full error codes such as 500.0.0 etc. /* You will want to enter the http error you want below if you wish to narrow down. IE: 401.1.1326 */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS halfhour, /*3600 = hour, 1800=halfhour, 180= 3min*/ COUNT(*) AS Total, TO_LOWERCASE(cs-uri-stem) AS Vdir, STRCAT(STRCAT(STRCAT(TO_STRING(sc-status),'.'),STRCAT(TO_STRING(sc-substatus),'.')),TO_STRING(sc-win32-status)) as HTTPstatus, cs-uri-stem, cs-uri-query, cs-username, cs(Cookie) INTO '[OUTFILEPATH]\EAShitsperhourwitherrorBadLogon_plus.csv' FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-Activesync%' AND HTTPstatus LIKE '%50%' /*change the error here as needed */ GROUP BY halfhour, Vdir, HTTPstatus, cs-uri-stem, cs-uri-query, cs-username, cs(Cookie) ORDER BY halfhour 5529b3d3-9548-4000-800e-a43dc8dbe7ed IISW3CLOG MAS false ActiveSync: HTTP 503 1/2 hour EAS requests per hour with Error 503 description SELECT QUANTIZE(TO_TIMESTAMP(date, time), 900) AS halfhour, /*3600 = hour, 1800=halfhour, 180= 3min*/ COUNT(*) AS Total, TO_LOWERCASE(cs-uri-stem) AS Vdir, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-Activesync%' AND HTTPstatus = '503.0' /*change the error here as needed */ GROUP BY halfhour, Vdir, HTTPstatus ORDER BY halfhour 68bb229e-db6d-4724-881c-fa892c7ec4b7 IISW3CLOG MAS false ActiveSync: iPad report by User/Version/Hits iPad report by User/Version/Hits /* iPad report by User/Version/Hits */ SELECT c-ip AS ClientIP, cs-username AS User, cs(User-Agent) AS Client, Count(cs-username) AS Hits from '[LOGFILEPATH]' WHERE TO_LOWERCASE(cs(User-Agent)) LIKE '%iPad%' AND cs-username IS NOT NULL GROUP BY User, c-ip, cs(User-Agent) ORDER BY Hits DESC 4035e9b7-265d-41a9-817f-193aef86c51d IISW3CLOG MAS false ActiveSync: iPhone Report by User/Hits/Device iPhone report by IP/User/iPhoneVersion/Hits /* iPhone report by IP/User/iPhoneVersion/Hits */ SELECT c-ip AS ClientIP, cs-username AS User, cs(User-Agent) AS Client, Count(cs-username) AS ExchangeHits from '[LOGFILEPATH]' WHERE cs(User-Agent) LIKE '%iPhone%' AND cs-username IS NOT NULL GROUP BY User, c-ip, cs(User-Agent) ORDER BY ExchangeHits DESC 9f937d5a-9e90-4c50-b1be-2eafa4edfe21 IISW3CLOG MAS false ActiveSync: iPhone Top 20 Report by User/Hits/Device iPhone report by IP/User/iPhoneVersion/Hits /* iPhone report by IP/User/iPhoneVersion/Hits */ SELECT TOP 20 c-ip AS ClientIP, cs-username AS User, cs(User-Agent) AS Client, Count(cs-username) AS ExchangeHits from '[LOGFILEPATH]' WHERE cs(User-Agent) LIKE '%iPhone%' AND cs-username IS NOT NULL GROUP BY User, c-ip, cs(User-Agent) ORDER BY ExchangeHits DESC 18a79b8d-c858-4d38-9ec7-1afe50e5bb34 IISW3CLOG MAS true ActiveSync: Requests > 8 Seconds EAS 8 > 8000ms time-taken SELECT date, time, s-ip, cs-method, cs-uri-query, cs(user-agent), sc-status, sc-substatus, sc-win32-status, time-taken INTO '[OUTFILEPATH]\EAS8sec.csv' FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs-uri-query NOT LIKE '%Cmd=Ping%' AND time-taken>8000 GROUP BY date, time, s-ip, cs-method, cs-uri-query, cs(user-Agent), sc-status, sc-substatus, sc-win32-status, time-taken ORDER BY time-taken DESC bbeb382a-553a-439c-b481-ba10120e407c IISW3CLOG MAS false ActiveSync: Status Code Report HTTP status codes counted by user including friendly error descriptions for status and, sub-status and win32 error codes. /* ActiveSync Status/Error report by user and status code count */ /* Includes friendly names for any errors */ SELECT cs-username, cs-uri-stem, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, CASE HTTPstatus when'200.0' then'HttpStatusOk' when'201.0' then'HttpStatusCreated' when'204.0' then'HttpStatusNoContent' when'206.0' then'HttpStatusPartialContent' when'207.0' then'HttpStatusMultiStatus' when'301.0' then'HttpStatusMovedPermanently' when'302.0' then'HttpStatusRedirect' when'307.0' then'HttpStatusMovedTemporarily' when'304.0' then'HttpStatusNotModified' when'400.0' then'HttpStatusBadRequest' when'400.1' then'HttpStatusInvalidDestination' when'400.2' then'HttpStatusInvalidDepth' when'400.3' then'HttpStatusInvalidIf' when'400.4' then'HttpStatusInvalidOverwrite' when'400.5' then'HttpStatusInvalidTranslate' when'400.6' then'HttpStatusInvalidRequestBody' when'400.7' then'HttpStatusInvalidContentLength' when'401.0' then'HttpStatusUnauthorized' when'401.1' then'HttpStatusBadLogon' when'401.2' then'HttpStatusDeniedConfig' when'401.3' then'HttpStatusDeniedResource' when'401.4' then'HttpStatusDeniedFilter' when'401.5' then'HttpStatusDeniedApplication' when'403.0' then'HttpStatusForbidden' when'403.1' then'HttpStatusExecAccessDenied' when'403.2' then'HttpStatusReadAccessDenied' when'403.3' then'HttpStatusWriteAccessDenied' when'403.4' then'HttpStatusSSLRequired' when'403.5' then'HttpStatusSSL128Required' when'403.6' then'HttpStatusIPAddressReject' when'403.7' then'HttpStatusCertRequired' when'403.8' then'HttpStatusSiteAccessDenied' when'403.9' then'HttpStatusTooManyUsers' when'403.11' then'HttpStatusPasswordChange' when'403.12' then'HttpStatusMapperDenyAccess' when'403.13' then'HttpStatusCertRevoked' when'403.14' then'HttpStatusDirBrowsingDenied' when'403.16' then'HttpStatusCertInvalid' when'403.17' then'HttpStatusCertTimeInvalid' when'403.18' then'HttpStatusAppPoolDenied' when'403.19' then'HttpStatusInsufficientPrivilegeForCgi' when'403.20' then'HttpStatusPassportLoginFailure' when'403.21' then'HttpStatusSourceAccessDenied' when'403.22' then'HttpStatusInfiniteDepthDenied' when'404.0' then'HttpStatusNotFound' when'404.2' then'HttpStatusDeniedByPolicy' when'404.3' then'HttpStatusDeniedByMimeMap' when'404.4' then'HttpStatusNoHandler' when'404.5' then'HttpStatusDeniedByUrlSequence' when'404.6' then'HttpStatusDeniedByVerb' when'404.7' then'HttpStatusDeniedByFileExtension' when'404.8' then'HttpStatusHiddenSegment' when'404.9' then'HttpStatusFileAttributeHidden' when'404.10' then'HttpStatusRequestHeaderTooLong' when'404.11' then'HttpStatusUrlDoubleEscaped' when'404.12' then'HttpStatusUrlHasHighBitChars' when'404.13' then'HttpStatusContentLengthTooLarge' when'404.14' then'HttpStatus404UrlTooLong' when'404.15' then'HttpStatusQueryStringTooLong' when'404.16' then'HttpStatusStaticFileDav' when'404.17' then'HttpStatusPreconditionedHandler' when'404.18' then'HttpStatusDeniedByQueryStringSequence' when'404.19' then'HttpStatusDeniedByFilteringRule' when'405.0' then'HttpStatusMethodNotAllowed' when'406.0' then'HttpStatusNotAcceptable' when'407.0' then'HttpStatusProxyAuthRequired' when'409.0' then'HttpStatusConflict' when'412.0' then'HttpStatusPreconditionFailed' when'413.0' then'HttpStatusEntityTooLarge' when'414.0' then'HttpStatusUrlTooLong' when'415.0' then'HttpStatusUnsupportedMediaType' when'416.0' then'HttpStatusRangeNotSatisfiable' when'417.0' then'HttpStatusExpectationFailed' when'423.0' then'HttpStatusLockedError' when'424.0' then'HttpStatusFailedDependency' when'449.0' then'ActiveSync device blocked due to policy: retry?' when'500.0' then'HttpStatusServerError' when'500.16' then'HttpStatusUNCAccess' when'500.19' then'HttpStatusBadMetadata' when'500.21' then'HttpStatusHandlersModule' when'500.22' then'HttpStatusAspnetModules' when'500.23' then'HttpStatusAspnetHandlers' when'500.24' then'HttpStatusAspnetImpersonation' when'501.0' then'HttpStatusNotImplemented' when'502.0' then'HttpStatusBadGateway' when'502.1' then'HttpStatusTimeout' when'502.2' then'HttpStatusPrematureExit' when'502.3' then'HttpStatusForwarderConnectionError' when'503.0' then'HttpStatusServiceUnavailable' when'503.2' then'HttpStatusAppConcurrent' when'504.0' then'HttpStatusGatewayTimeout' when'507.0' then'HttpStatusInsufficientStorage' END as w3-status-details, CASE sc-win32-status WHEN 0 then'' WHEN 2148074254 then 'handshake in progress' ELSE WIN32_ERROR_DESCRIPTION(sc-win32-status) END as win32-error, sc-win32-status, Count(*) /* to File--> c:\users\documents\MAS_StatusCode_Report.csv */ FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs-username IS NOT NULL Group BY cs-username, cs-uri-stem, HTTPstatus, w3-status-details, win32-error, sc-win32-status Order BY cs-username, cs-uri-stem 9fd6b41d-8733-4917-977d-31f6b181e615 IISW3CLOG MAS false ActiveSync: Status Code Report ActiveSync HTTP Status codes including text description of the status codes select cs-uri-stem, cs-method, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, CASE HTTPstatus when'200.0' then'HttpStatusOk' when'201.0' then'HttpStatusCreated' when'204.0' then'HttpStatusNoContent' when'206.0' then'HttpStatusPartialContent' when'207.0' then'HttpStatusMultiStatus' when'301.0' then'HttpStatusMovedPermanently' when'302.0' then'HttpStatusRedirect' when'307.0' then'HttpStatusMovedTemporarily' when'304.0' then'HttpStatusNotModified' when'400.0' then'HttpStatusBadRequest' when'400.1' then'HttpStatusInvalidDestination' when'400.2' then'HttpStatusInvalidDepth' when'400.3' then'HttpStatusInvalidIf' when'400.4' then'HttpStatusInvalidOverwrite' when'400.5' then'HttpStatusInvalidTranslate' when'400.6' then'HttpStatusInvalidRequestBody' when'400.7' then'HttpStatusInvalidContentLength' when'401.0' then'HttpStatusUnauthorized' when'401.1' then'HttpStatusBadLogon' when'401.2' then'HttpStatusDeniedConfig' when'401.3' then'HttpStatusDeniedResource' when'401.4' then'HttpStatusDeniedFilter' when'401.5' then'HttpStatusDeniedApplication' when'403.0' then'HttpStatusForbidden' when'403.1' then'HttpStatusExecAccessDenied' when'403.2' then'HttpStatusReadAccessDenied' when'403.3' then'HttpStatusWriteAccessDenied' when'403.4' then'HttpStatusSSLRequired' when'403.5' then'HttpStatusSSL128Required' when'403.6' then'HttpStatusIPAddressReject' when'403.7' then'HttpStatusCertRequired' when'403.8' then'HttpStatusSiteAccessDenied' when'403.9' then'HttpStatusTooManyUsers' when'403.11' then'HttpStatusPasswordChange' when'403.12' then'HttpStatusMapperDenyAccess' when'403.13' then'HttpStatusCertRevoked' when'403.14' then'HttpStatusDirBrowsingDenied' when'403.16' then'HttpStatusCertInvalid' when'403.17' then'HttpStatusCertTimeInvalid' when'403.18' then'HttpStatusAppPoolDenied' when'403.19' then'HttpStatusInsufficientPrivilegeForCgi' when'403.20' then'HttpStatusPassportLoginFailure' when'403.21' then'HttpStatusSourceAccessDenied' when'403.22' then'HttpStatusInfiniteDepthDenied' when'404.0' then'HttpStatusNotFound' when'404.2' then'HttpStatusDeniedByPolicy' when'404.3' then'HttpStatusDeniedByMimeMap' when'404.4' then'HttpStatusNoHandler' when'404.5' then'HttpStatusDeniedByUrlSequence' when'404.6' then'HttpStatusDeniedByVerb' when'404.7' then'HttpStatusDeniedByFileExtension' when'404.8' then'HttpStatusHiddenSegment' when'404.9' then'HttpStatusFileAttributeHidden' when'404.10' then'HttpStatusRequestHeaderTooLong' when'404.11' then'HttpStatusUrlDoubleEscaped' when'404.12' then'HttpStatusUrlHasHighBitChars' when'404.13' then'HttpStatusContentLengthTooLarge' when'404.14' then'HttpStatus404UrlTooLong' when'404.15' then'HttpStatusQueryStringTooLong' when'404.16' then'HttpStatusStaticFileDav' when'404.17' then'HttpStatusPreconditionedHandler' when'404.18' then'HttpStatusDeniedByQueryStringSequence' when'404.19' then'HttpStatusDeniedByFilteringRule' when'405.0' then'HttpStatusMethodNotAllowed' when'406.0' then'HttpStatusNotAcceptable' when'407.0' then'HttpStatusProxyAuthRequired' when'409.0' then'HttpStatusConflict' when'412.0' then'HttpStatusPreconditionFailed' when'413.0' then'HttpStatusEntityTooLarge' when'414.0' then'HttpStatusUrlTooLong' when'415.0' then'HttpStatusUnsupportedMediaType' when'416.0' then'HttpStatusRangeNotSatisfiable' when'417.0' then'HttpStatusExpectationFailed' when'423.0' then'HttpStatusLockedError' when'424.0' then'HttpStatusFailedDependency' when'449.0' then'ActiveSync device blocked due to policy' when'500.0' then'HttpStatusServerError' when'500.16' then'HttpStatusUNCAccess' when'500.19' then'HttpStatusBadMetadata' when'500.21' then'HttpStatusHandlersModule' when'500.22' then'HttpStatusAspnetModules' when'500.23' then'HttpStatusAspnetHandlers' when'500.24' then'HttpStatusAspnetImpersonation' when'501.0' then'HttpStatusNotImplemented' when'502.0' then'HttpStatusBadGateway' when'502.1' then'HttpStatusTimeout' when'502.2' then'HttpStatusPrematureExit' when'502.3' then'HttpStatusForwarderConnectionError' when'503.0' then'HttpStatusServiceUnavailable' when'503.2' then'HttpStatusAppConcurrent' when'504.0' then'HttpStatusGatewayTimeout' when'507.0' then'HttpStatusInsufficientStorage' END as w3-status-details, CASE sc-win32-status WHEN 0 then'' WHEN 2148074254 then 'handshake in progress' ELSE WIN32_ERROR_DESCRIPTION(sc-win32-status) END as win32-error, sc-win32-status FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs-method LIKE 'OPTIONS' Group BY cs-uri-stem, cs-method, HTTPstatus, w3-status-details, win32-error, sc-win32-status Order BY cs-uri-stem 11ffcdac-dacf-4228-9a3d-effdc8d6de42 IISW3CLOG MAS false ActiveSync: Top 100 Users per Device Returns all ActiveSync hits ordered by device type and number of hits for the top 20 devices by number of hits. /* Top 100 ActiveSync users by device. If a user has multiple devices they will show up in this report. */ SELECT TOP 100 cs-username as UserName, Count(*) as Hits, cs(user-agent) as DeviceType, cs-uri-stem as VDir FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' GROUP BY DeviceType, cs-username, VDir ORDER BY UserName, Hits DESC 54d851fa-66a4-407f-80d2-42266d52bdad IISW3CLOG MAS true ActiveSync: Top 3 ActiveSync Users Finds the top 3 ActiveSync users and lists them SELECT TOP 3 cs-username AS UserID, cs(User-Agent) AS DeviceType, cs-uri-stem AS Vdir, c-ip AS CLIENT, cs-method, Count(*) FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs-method LIKE 'OPTIONS' GROUP BY UserID, DeviceType, Vdir, Client, cs-method ORDER BY COUNT(*) DESC 8e728a18-42b2-4a07-9aa2-91b4633e602b IISW3CLOG MAS false ActiveSync: Unique Devices by # Hits Returns all ActiveSync hits ordered by unique device type. This query will return a list of all the mobile devices that are syncing with Exchange /* List of all device types using ActiveSync and the total hits per device */ SELECT DISTINCT cs(user-agent) as DeviceType, COUNT(*) as Hits FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' GROUP BY DeviceType ORDER BY Hits DESC 0c5d4c2c-f8a0-4c5b-9214-ba9e2f51259a IISW3CLOG MAS false ActiveSync: User Bandwidth > 10MB Finds all users whose total bandwidth is greater than 10MB for a single request. This query requires the IIS extended fields cs-bytes and sc-bytes which are not enabled in IIS by default. /* Find all ActiveSync users with total bandwidth exceeding 10MB */ /* Requires cs-bytes field presence in the IIS log */ SELECT cs(User-Agent), Div(DIV(sc-bytes, 1024),1024) as MegaBytes, sc-bytes as Bytes, cs-username As UserName FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/Microsoft-Server-ActiveSync%' AND cs-username <> NULL AND ADD(sc-bytes, cs-bytes) > MUL(10000, 1024) ORDER BY MegaBytes DESC 288245dc-255c-4a6b-9cf4-a2766ed5909c IISW3CLOG MAS true ActiveSync: User Bandwidth Top 100 Find top 100 users by total bandwidth for a single request. This query requires the IIS extended fields cs-bytes and sc-bytes which are not enabled in IIS by default. /* Find top 100 ActiveSync users by total bandwidth */ /* Requires cs-bytes field presence in the IIS log */ SELECT TOP 100 cs(User-Agent) as Device, ADD(DIV(DIV(sc-bytes, 1024),1024), DIV(DIV(cs-bytes, 1024),1024)) as MegaBytes, ADD(DIV(sc-bytes, 1024),DIV(cs-bytes, 1024)) as KiloBytes, ADD(sc-bytes, cs-bytes) as Bytes, cs-username As UserName FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/Microsoft-Server-ActiveSync%' AND cs-username <> NULL ORDER BY Bytes, KiloBytes, MegaBytes DESC 77af3d8f-aa81-44c4-a038-caf132f214d1 IISW3CLOG MAS true ActiveSync: User by Proxy Error Find users on the target CAS with proxy errors --> This script to be run against IIS logs on proxied-to CAS or the non Internet facing CAS --> It picks out the user from the cs-uri-query which only exists in proxy requests select EXTRACT_Value(cs-uri-query,'User') AS Username, cs(User-Agent) AS DeviceType, TO_LOWERCASE(cs-uri-stem) AS application, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, Count(*) FROM '[LOGFILEPATH]' WHERE HTTPstatus BETWEEN '402' AND '599' AND cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND Username IS NOT NULL Group BY username, DeviceType, application, HTTPstatus Order BY username, DeviceType 7a7704fe-6abd-4883-b4b2-69f83ec0c194 IISW3CLOG MAS false Authentication Failures Count IIS authentication errors per user SELECT cs-username, sc-status, COUNT(*) AS Total FROM '[LOGFILEPATH]' WHERE cs-username IS NOT NULL AND sc-status BETWEEN 401 AND 403 GROUP BY cs-username,sc-status, cs-uri-stem ORDER BY Total DESC 59b74fbf-e103-46b4-922d-0a0cc0e14911 IISW3CLOG ALL false Autodiscover: Slow Requests by User Finds all autodiscover requests > 2 seconds. /* Autodiscover: Find all requests that take more than 2 seconds to complete */ SELECT time-taken as Milliseconds, cs-username, COUNT(*) AS Hits, cs(user-agent), sc-status FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%Autodiscover%' AND time-taken > 2000 /* <- milliseconds change to taste */ Group BY Milliseconds, sc-status, cs-username, cs-uri-query, sc-status, cs(user-agent) Order By Milliseconds DESC 309bdf17-58bd-4657-b37e-77e164ea142e IISW3CLOG ALL false Average Bandwidth per 1/2 Hour Returns the average bandwidth, as KB per second broken down into 30 minute blocks /* Returns the average bandwidth, as KBytes per second, broken into 30 minute blocks */ /* The sc-bytes and cs-bytes fields are required for this query, these fields are not enabled by default in IIS */ SELECT TO_LOCALTIME(QUANTIZE(time, 1800)) as HalfHour, ADD(SCKBytesSec, CSKBytesSec) as KBytesSec USING DIV(DIV(MUL(1.0, SUM(sc-bytes)), 1024), 1800) as SCKbytesSec, DIV(DIV(MUL(1.0, SUM(cs-bytes)), 1024), 1800) as CSKBytesSec INTO '[OUTFILEPATH]\AvgKBytesPerSec.CSV' FROM '[LOGFILEPATH]' GROUP BY HalfHour ORDER BY HalfHour ASC f410f5ee-2b87-45a8-b82d-e7508e745bf5 IISW3CLOG ALL false Avg Response for a User Average response time for a specific user /* Avg Response for a specific user */ Select cs-username AS UserName, AVG(time-taken) AS AvgTime, Count(*) AS Hits FROM '[LOGFILEPATH]' WHERE cs-username = '%REPLACE_WITH_USERNAME%' GROUP BY cs-username 517d8373-3972-426e-a4e2-da0e7e6f75f4 IISW3CLOG ALL false Avg Response for all users Average response time for all users /* Avg Response for all users */ Select cs-username AS UserName, AVG(time-taken) AS AvgTime, Count(*) AS Hits FROM '[LOGFILEPATH]' GROUP BY cs-username Order BY AvgTime DESC 16cddbfd-104c-47a8-a66c-94d1d3efacf4 IISW3CLOG ALL false CAS: All Requests with more than one hundred 500 errors. All Requests with more than one hundred 500 errors. /* Find all Exchange requests with more than one hundred 500 errors and perform a reverse dns lookup on the client IP*/ SELECT DISTINCT REVERSEDNS(c-ip) AS ClientIP, cs-uri-stem AS RequestURI, cs-uri-query AS QueryString, COUNT(*) As Total FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/owa%' OR cs-uri-stem LIKE '%/ews%' OR cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' OR cs-uri-stem LIKE '%/PowerShell%' OR cs-uri-stem LIKE '%/exchange%' OR cs-uri-stem LIKE '%/ecp%' OR cs-uri-stem LIKE '%/UnifiedMessaging%' OR cs-uri-stem LIKE '%/exchweb%' AND sc-status = 500 GROUP BY ClientIP, RequestURI, QueryString HAVING Total > 10 ORDER BY Total DESC ff5084ce-57a0-4628-9a91-6c5362597f6e IISW3CLOG ALL false CAS-CAS Proxy All requests made by another CAS server as a PROXY client. Run this on the non-internet facing CAS. IE: the proxy target /* Return requests made by other CAS servers (Proxy) on behalf of a user */ /* TODO: TEST THIS QUERY */ SELECT TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) as Timestamp, cs-username AS SourceCAS, cs(user-agent), c-ip as SourceIP, s-ip as TargetIP, cs-uri-stem, cs-uri-query, sc-status, time-taken FROM '[LOGFILEPATH]' WHERE TO_UPPERCASE(cs(user-agent)) LIKE '%PROXY%' ORDER BY Timestamp, cs(user-agent) ASC 97f1d41f-249e-4350-97bd-f4c9c112d72f IISW3CLOG OWA false ECP: by Username [CAS Proxy Target] Find users accessing /ECP counts their hits and errors. This is for a proxy targetnon-internet facing CAS only. See the other query for the Internet facing version. /* This script to be run against IIS logs on proxied-to CAS or the non Internet facing CAS It picks out the user from the cs-uri-query which only exists in proxy requests Targets users accessing the EX2010 /ECP directory */ select cs-username as Username, cs(User-Agent) AS ECPClient, TO_LOWERCASE(cs-uri-stem) AS ECPDirectory, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, Count(*) FROM '[LOGFILEPATH]' WHERE application LIKE '%ECP%' AND cs-username IS NOT NULL Group BY cs-username, ECPClient, ECPDirectory, HTTPstatus Order BY cs-username, ECPClient fcc3d429-f06a-4669-878b-1a82df58da08 IISW3CLOG ECP false ECP: Request by Username [CAS INTERNET] Find users accessing /ECP counts their hits and errors. This is for a Internet facing CAS only. See the other query for the non-Internet facing version. /* This script to be run against IIS logs on the Internet Facing CAS Targets users accessing the EX2010 /ECP directory */ select cs-username as Username, cs(User-Agent) AS ECPClient, TO_LOWERCASE(cs-uri-stem) AS ECPDirectory, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, Count(*) FROM '[LOGFILEPATH]' WHERE ECPDirectory LIKE '%ECP%' AND cs-username IS NOT NULL AND cs-uri-stem NOT LIKE '%ExchangeWebServicesProxy%' Group BY cs-username, ECPClient, ECPDirectory, HTTPstatus Order BY cs-username, ECPClient 700b08af-1c38-4c23-a95c-fce933e112d1 IISW3CLOG ECP false Error Report by Status Gather all errors, count them and total them. SELECT STRCAT( cs-uri-stem, REPLACE_IF_NOT_NULL(cs-uri-query, STRCAT('?',cs-uri-query)) ) AS Request, STRCAT( TO_STRING(sc-status), STRCAT( '.', COALESCE(TO_STRING(sc-substatus), '?' ) ) ) AS Status, COUNT(*) AS Total FROM '[LOGFILEPATH]' WHERE (sc-status >= 400) GROUP BY Request, Status ORDER BY Total DESC 41ac9b96-9d77-4b72-9d2e-d3cedeac3c43 IISW3CLOG ALL true EVENTS: Count Application Log Entries Counts number of times each event in the application log has been logged. /* Count number of times each Event is Logged [Experimental] */ SELECT SourceName, BIT_AND(EventID, 0x3fffffff) as EventID, EventTypeName, COUNT(*) As Entries FROM SECURITY /* <- logname OR \\computername\logname */ GROUP BY SourceName, EventID, EventTypeName ORDER BY Entries DESC 4eb2013e-6b20-4720-9da2-5a18c85f1498 EVTLOG EVT false EVENTS: Count Errors and Warnings Every 24 hours Report counts all errors and warnings per day /* Report counts all errors and warnings per day */ SELECT QUANTIZE(TimeGenerated, 86400) AS Day, COUNT(*) AS [Total Errors] FROM APPLICATION WHERE EventType = 1 OR EventType = 2 GROUP BY Day ORDER BY Day ASC /* Levels: 1=Error, 2=Warning */ 2bd4041f-f9b9-47f1-bf14-3887afb09122 EVTLOG ALL false EVENTS: Find All Remote Logons Find All Remote Logons SELECT timegenerated, EXTRACT_TOKEN(Strings,1,'|') AS Domain, RESOLVE_SID(EXTRACT_TOKEN(Strings,0,'|')) AS User, EXTRACT_TOKEN(Strings,3,'|') AS SessionName, RESOLVE_SID(EXTRACT_TOKEN(Strings,4,'|')) AS ClientName, EXTRACT_TOKEN(Strings,5,'|') AS ClientAddress, EventID FROM Security WHERE EventID=4624 /* xp/2003 = 682 */ ORDER BY timegenerated eb6a64c4-02a7-4afd-b8a0-269906c1e3b9 EVTLOG ALL true EVENTS: Find Event Log Field Names This query only returns the field names of the event log you wish to query. /* Only the field names for the type of event log you are querying will be returned*/ SELECT TOP 0 * From Application 2c0e95cb-868e-413d-a9ac-6893462b5a92 EVTLOG ALL true EVENTS: Sample Sample Event log test /* Find all Event IDs = 1000 that occur per hour */ SELECT quantize(to_time(timegenerated), 3600) AS hour, Count(*) AS Number_of_Events FROM Application WHERE EventID=1000 GROUP BY Hour ORDER BY Number_of_Events 88b76198-13b9-4fde-98f4-09cd00fd8cbe EVTLOG ALL false EVENTS: Top 1000 Errors and Warnings Find the top 1000 errors and warnings from newest to oldest /* Find top 1000 warnings and errors in the Application Log Levels: 1=Error, 2=Warning */ SELECT TOP 1000 TimeGenerated, BIT_AND(EventID, 0x3fffffff) as EventID, EventTypeName as Name, SourceName as Source, Strings, Message, Data INTO '[OUTFILEPATH]\ApplicationLogErrorsWarningTop1000.CSV' FROM APPLICATION WHERE EventType = 1 OR EventType = 2 ORDER BY TimeGenerated DESC d0bb3825-8592-484e-8d22-57ce1691a332 EVTLOG ALL false EWS: [500 Errors] Finds EWS HTTP 500 errors and saves as EWS_500_ERRORS.CSV select cs-username, cs(User-Agent) AS EWSclient, TO_LOWERCASE(cs-uri-stem) AS application, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, Count(*) FROM '[LOGFILEPATH]' WHERE HTTPstatus LIKE '500.0' AND application LIKE '%ews%' AND cs-username IS NOT NULL Group BY cs-username, EWSclient, application, HTTPstatus Order BY cs-username, EWSclient 83c965f1-a143-4c65-b144-a8688286b30f IISW3CLOG EWS false EWS: 500 Errors [CSV] Finds EWS HTTP 500 errors and saves as EWS500ERRORS.CSV select cs-username, cs(User-Agent) AS EWSclient, TO_LOWERCASE(cs-uri-stem) AS application, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, Count(*) INTO 'EWS500Errors.CSV' FROM '[LOGFILEPATH]' WHERE HTTPstatus LIKE '500.0' AND application LIKE '%ews%' AND cs-username IS NOT NULL Group BY cs-username, EWSclient, application, HTTPstatus Order BY cs-username, EWSclient be0e5144-f52d-40eb-95ea-35a8fb2d161e IISW3CLOG EWS false EWS: Average Bandwidth Second/Hour Average bandwidth per second every hour /* Average bandwidth per second/hour */ SELECT TO_LOCALTIME(QUANTIZE(time, 3600)) AS [Hour], ADD([Server Kb/Sec], [Client Kb/Sec]) AS KBytesSec USING DIV(DIV(MUL(1.0, SUM(sc-bytes)), 1024), 3600) AS [Server Kb/Sec], DIV(DIV(MUL(1.0, SUM(cs-bytes)), 1024), 3600) AS [Client Kb/Sec] FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/EWS%' GROUP BY [Hour] ORDER BY [Hour] ASC aee89b9e-a558-497a-b614-1c7f77d8f0ef IISW3CLOG EWS false EWS: Average Response Time 1/2 Hour Returns the average response time for EWS request broken down to 1/2 hour segments /* Average response times every 1/2 hour */ SELECT TO_LOCALTIME(QUANTIZE(time, 1800)) as [1/2 Hour], AVG(time-taken) as [Time (ms)] FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%EWS%' AND sc-status < 400 GROUP BY [1/2 Hour] ORDER BY [1/2 Hour] ASC edeb86c7-c8e9-4571-9cb1-1571e653a14f IISW3CLOG EWS false EWS: BESAdmin Impersonated Login Report [CSV] Use this to find who is accessing EWS via BES and what commands they are running. Ref: http://blogs.technet.com/b/caseys/archive/2012/01/23/troubleshooting-ews-requests-using-iis-logs-with-logparser.aspx /* EWS: Find all BESAdmin Impersonated Logins */ SELECT TO_TIMESTAMP(TO_TIME(time), TO_DATE(date)) as TimeStamp, Count(*) as Total, cs-username as Username, substr(substr(cs-uri-query, INDEX_OF(cs-uri-query, 'Impersonate')),0,INDEX_OF(substr(cs-uri-query, INDEX_OF(cs-uri-query, 'Impersonate')),';')) AS [Impersonate], substr(substr(cs-uri-query, INDEX_OF(cs-uri-query, 'SoapAction')),0,INDEX_OF(substr(cs-uri-query, INDEX_OF(cs-uri-query, 'SoapAction')),';')) AS [SoapAction], substr(substr(cs-uri-query,INDEX_OF(cs-uri-query, 'RC')),0,INDEX_OF(substr(cs-uri-query, INDEX_OF(cs-uri-query, 'RC')),';')) AS [RC Data], cs-uri-stem as URI INTO '[OUTFILEPATH]\BESAdminEWSLogins.CSV' FROM '[LOGFILEPATH]' Where cs-username LIKE '%BESAdmin%' AND cs-uri-query LIKE '%SoapAction%' GROUP BY TimeStamp, Username, [Impersonate], [SoapAction], [RC Data], URI ORDER BY Total DESC db277f7b-b5cf-4d58-b2c5-47a22f115459 IISW3CLOG EWS false EWS: Budget Report [100% Exceeded] Returns all EWS requests where 100% the budget of any budget is exceeded. /* Returns all EWS request where any budget is over 100% Sorted by the total of all budgets (AD/CAS/RPC/FC/AB) The policy that is in effect is also listed. These users are exceeding their budget. */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/ews%' AND (TO_INT(AD%) > 100 OR TO_INT(CAS%) > 100 OR TO_INT(AB%) > 100 OR TO_INT(RPC%) > 100 OR TO_INT(FC%) > 100) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC 797ecf47-b544-4819-9122-051ac956228f IISW3CLOG EWS true EWS: Budget Report [75% Exceeded] All EWS Requests with 75% of any budget was exceeded. /* Returns all EWS request where any budget is over 75% Sorted by the total of all budgets (AD/CAS/RPC/FC/AB) The policy that is in effect is also listed. */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/ews%' AND (TO_INT(AD%) > 75 OR TO_INT(CAS%) > 75 OR TO_INT(AB%) > 75 OR TO_INT(RPC%) > 75 OR TO_INT(FC%) > 75) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC 5eed5dc2-09cf-408f-934f-631363a6945b IISW3CLOG EWS false EWS: Count users with 503 errors Count EWS users with 503 errors /* Count EWS Users with 503 Errors */ SELECT cs-username, cs(User-Agent) AS EWSclient, TO_LOWERCASE(cs-uri-stem) AS application, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, Count(*) FROM '[LOGFILEPATH]' WHERE HTTPstatus LIKE '503' AND application LIKE '%ews%' AND cs-username IS NOT NULL Group BY cs-username, EWSclient, application, HTTPstatus Order BY cs-username, EWSclient 13977f45-ed39-4e18-82c3-4accdca95d83 IISW3CLOG EWS false EWS: Failed SoapActions by Action/Item/User/Error Returns all 500 errors returned for users whose EWS Request contains SoapAction /* Count Failed (HTTP 500x) EWS SoapActions per user and count. */ SELECT REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, sc-status AS Status, cs-username as UserName, Count(*) AS Total FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%ews%' AND cs-username <> NULL AND SoapAction <> '' AND SoapAction <> NULL AND sc-status > 499 GROUP BY SoapAction, Status, UserName ORDER BY SoapAction, Total DESC d37d2c56-1fcc-4d7c-af81-1378f8b8ce11 IISW3CLOG EWS false EWS: GetOOFSettings Report Creates a detailed report including latency and budget for GetUserOOFSettings requests. /* Detailed GetUserOOFSettings Report */ SELECT cs-username as User, Count(*) AS Total, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ';MailboxRPCRequests='), 0, ';') As MBXReqs, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ';MailboxRPCLatency='), 0, ';') As MBXLat, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ';ADRequests='), 0, ';') As ADReqs, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ';ADLatency='), 0, ';') As ADLat, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ';TimeInGetUserOOFSettings='), 0, ';') As OOFTime, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, '/Execute:'), 0, ';'), 'msec', '') As Execute, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ';End('), 0, ')'), 'ms', '') As End, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, '>Conn:'), 0, ','), 'ms', '') As Conn, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ',HangingConn:'), 0, ','), 'ms', '') As HangConn, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Resources:'), 0, '(Health') As Target, sc-status as Status, sc-substatus as SubStatus, sc-Win32-Status as WinErr FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%ews%' AND cs-uri-query NOT LIKE '%GetEvents%' AND cs-uri-query NOT LIKE '%GetMailTips%' AND cs-uri-query LIKE '%GetUserOofSettingsResponse%' AND cs-username LIKE /* place username between %% -> */ '%%' AND cs-username <> NULL AND SoapAction <> '' GROUP BY cs-username, SoapAction, MBXReqs, MBXLat, ADReqs, ADLat, Execute, End, Conn, HangConn, OOFTime, Target, Status, SubStatus, WinErr ORDER BY Total, OOFTime, User, MBXReqs, MBXLat, ADReqs, ADLat Desc 4e7e2618-542e-4e9b-af3c-47c547c9c0fc IISW3CLOG EWS false EWS: HTTP 500 Errors per Hour per User Returns and counts all EWS Requests per Hour for a single user /* Returns and counts all EWS Requests per Hour for a single user Be sure to add the username below by replacing REPLACE_WITH_USERNAME with the user you wish to search for. */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS hour, COUNT(*) AS Total, TO_LOWERCASE(cs-uri-stem) AS Vdir, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, sc-win32-status AS Win32Raw, WIN32_ERROR_DESCRIPTION(sc-win32-status) AS Win32Name FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '/EWS/ex%' AND cs-username LIKE '%REPLACE_WITH_USERNAME%' AND HTTPstatus <> '0000' /* <--change 0000 to 200 to hide 200s etc. */ GROUP BY hour, Vdir, HTTPstatus, Win32Raw, Win32Name ORDER BY hour ed56a28c-a252-4a2d-8709-e38dcdf20b93 IISW3CLOG EWS false EWS: HTTP 500 Errors per Hour w/Description Returns and counts all EWS HTTP 500 errors per hour including HTTP Status and underlying Win32 Error Description /* Returns and counts all EWS HTTP 500 errors per hour including HTTP Status and underlying Win32 Error Description */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS hour, COUNT(*) AS Total, TO_LOWERCASE(cs-uri-stem) AS Vdir, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, sc-win32-status AS Win32Raw, WIN32_ERROR_DESCRIPTION(sc-win32-status) AS Win32Name FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '/EWS/ex%' AND HTTPstatus > '499' GROUP BY hour, Vdir, HTTPstatus, Win32Raw, Win32Name ORDER BY hour 16cf3214-f6f4-49d4-afd8-1897fd76a869 IISW3CLOG EWS false EWS: PROXY (500 Errors) Finds EWS HTTP 500 errors that are CAS Proxy requests /* Return All EWS Proxy Requests with 500 Errors */ SELECT cs-username, cs(User-Agent) AS EWSclient, TO_LOWERCASE(cs-uri-stem) AS URI, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, sc-substatus As SubStatus, Count(*) FROM '[LOGFILEPATH]' WHERE HTTPStatus LIKE '%500%' and cs-uri-stem LIKE '%ExchangeWebServicesProxy%' GROUP BY HttpStatus, SubStatus, cs-username, EWSClient, URI ORDER BY cs-username ASC 3a9aa6be-72cc-4e30-9fbe-d817e8740e32 IISW3CLOG EWS false EWS: Requests Every 3 Minutes Counts the number of EWS requests every 3 minutes and lists them chronologically /* Returns the number of EWS requests made every 3 minutes chronologically */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 180) AS threemin, COUNT(*) AS Total, TO_LOWERCASE(cs-uri-stem) AS Vdir FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '/EWS/ex%' GROUP BY threemin, Vdir ORDER BY threemin 893d42bc-5e7f-4405-b8ff-c7889a4799ee IISW3CLOG EWS true EWS: Requests Every Hour Counts the number of EWS requests every hour and lists them chronologically /* Returns the number of EWS requests made every hour chronologically */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS hour, COUNT(*) AS Total, TO_LOWERCASE(cs-uri-stem) AS Vdir FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '/EWS%' GROUP BY hour, Vdir ORDER BY hour aef4d04e-9098-40c9-af11-2fdbea36e91f IISW3CLOG EWS false EWS: Requests per Hour Returns the requests per hour to /EWS. Use this query to see which times of day the most requests are being made. /* Requests per Hour - Try with Radar Chart [experimental] */ SELECT TO_LOCALTIME(QUANTIZE(TO_TIMESTAMP(date, time), 3600)) AS Hour, COUNT(*) AS [Hits], AVG(time-taken) as [Avg Response Time] FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/ews%' GROUP BY Hour ORDER BY Hour 63021028-9e8b-458c-822c-6b02187313c0 IISW3CLOG EWS false EWS: SOAP Report by SoapAction Creates a detailed report including latency and budget for all SoapAction requests. /* EWS report by SOAP requests. */ SELECT cs-username as User, Count(*) AS Total, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, '/Execute:'), 0, ';'), 'msec', '') As Execute, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ';End('), 0, ')'), 'ms', '') As End, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, '>Conn:'), 0, ','), 'ms', '') As Conn, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, ',HangingConn:'), 0, ','), 'ms', '') As HangConn, time-taken as ResponseTime, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Resources:'), 0, '(Health') As Target, cs(user-agent) as Device FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%ews%' AND cs-uri-query NOT LIKE '%GetEvents%' AND cs-uri-query NOT LIKE '%GetMailTips%' AND cs-uri-query NOT LIKE '%GetUserOofSettingsResponse%' AND cs-username LIKE /* place username between %% -> */ '%%' AND cs-username <> NULL AND SoapAction <> '' GROUP BY cs-username, SoapAction, Execute, End, Conn, HangConn, Target, Responsetime, Device ORDER BY Total, ResponseTime, User DESC 694d4947-fc06-4c94-9e76-58e0757f720e IISW3CLOG EWS false EWS: SoapActions by Action/Item/User Returns all EWS requests containing SoapAction, counts them per action and user making the request. /* Count EWS SoapActions per user and count. */ SELECT REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, sc-status AS Status, cs-username as UserName, Count(*) AS Total FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%ews%' AND cs-username <> NULL AND SoapAction <> '' AND SoapAction <> NULL GROUP BY SoapAction, Status, UserName ORDER BY SoapAction, Total DESC 48c705cb-e923-478c-a0a1-3b3175b06469 IISW3CLOG EWS false EWS: SoapActions by Action/Item/User [CSV] Returns all EWS requests containing SoapAction, counts them per action and user making the request. /* Count EWS SoapActions per user and count. Send to CSV file. */ SELECT REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, sc-status AS Status, cs-username as UserName, Count(*) AS Total INTO '[OUTFILEPATH]\EWSSoapActionsPerUser.CSV' FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%ews%' AND cs-username <> NULL AND SoapAction <> '' AND SoapAction <> NULL GROUP BY SoapAction, Status, UserName ORDER BY SoapAction, Total DESC d4fc29cd-97d1-4f4e-800a-b6604d96a9ce IISW3CLOG EWS false EWS: SoapActions by Action/Item/User [Failures] Returns all SoapAction 500x errors. /* Count Failed (HTTP 500x) EWS SoapActions per user and count. */ SELECT REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, sc-status AS Status, cs-username as UserName, cs(user-agent) as Client, Count(*) AS Total FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%ews%' AND cs-username <> NULL AND SoapAction <> '' AND SoapAction <> NULL AND sc-status > 499 GROUP BY SoapAction, Status, UserName, Client ORDER BY Total, UserName DESC 9743dd84-2752-4599-9960-232acf54e438 IISW3CLOG EWS true EWS: Top 20 EWS Users Find the top 20 EWS users by total number of requests SELECT TOP 20 cs-username AS UserID, cs(User-Agent) AS Application, cs-uri-stem AS Vdir, c-ip AS CLIENT, cs-method, Count(*) FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%EWS%' GROUP BY UserID, Application, Vdir, Client, cs-method ORDER BY COUNT(*) DESC 378e1075-7526-44d9-8608-58a36c8ffe3c IISW3CLOG EWS true EWS: Top 20 EWS Users - Min/Max/Avg Find the top 20 EWS users by total number of requests and include slowest, fastest and average request times SELECT TOP 20 cs-username AS UserID, MAX(time-taken) as [Slowest Time (ms)], MIN(time-taken) as [Fastest Time (ms)], AVG(Time-taken) as [Average Time (ms)], SUM(time-taken) as [Total Time Used (ms)], Count(*) as Requests, cs(User-Agent) AS Application, cs-method as Method FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%EWS%' GROUP BY UserID, Application, cs-method ORDER BY [Slowest Time (ms)], Requests DESC d97856ad-0a83-4561-87a3-931854d129f0 IISW3CLOG EWS true EWS: Top 20 EWS Users CSV Find the top 20 EWS users by total number of requests SELECT TOP 20 cs-username AS UserID, cs(User-Agent) AS Application, cs-uri-stem AS Vdir, c-ip AS CLIENT, cs-method, Count(*) INTO '[OUTFILEPATH]\TOP20.CSV' FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%EWS%' GROUP BY UserID, Application, Vdir, Client, cs-method ORDER BY COUNT(*) DESC 4a2df592-850c-415c-8ad3-c6a8f688f793 IISW3CLOG EWS true EWS: Top 5 EWS Users Finds the top 5 EWS users and lists them SELECT TOP 5 cs-username AS UserID, cs(User-Agent) AS DeviceType, cs-uri-stem AS Vdir, c-ip AS CLIENT, cs-method, Count(*) FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/EWS%' AND cs-method LIKE 'POST' GROUP BY UserID, DeviceType, Vdir, Client, cs-method ORDER BY COUNT(*) DESC 6b98815e-1de5-4408-bdcd-638cce83188a IISW3CLOG EWS false EXADB: Find Address Book Logging Field Names Find Address Book Logging Field Names for Exchange 2010 /* Find Exchange Address Book log field names */ /* Address book input format is under developoment */ SELECT * FROM '[LOGFILEPATH]' 09e8e62d-66e5-40ec-8f21-ba933541ed9a EXADBLOG ALL false ExRCA: Requests Finds all requests made by the Exchange Remote Connectivity Analyzer (testexchangeconnectivity.com) /* Find all ExRCA test requests; due to limitations this cannot find RPC/HTTP requests or EWS Test */ /* Because of this it is likely better to use one of the username queries from the libary and search for the user conducting the test */ SELECT date, time, cs-username, c-ip, s-ip, cs-uri-stem, cs-uri-query, sc-status, sc-win32-status, time-taken FROM '[LOGFILEPATH]' WHERE cs(user-agent) LIKE '%TestExchangeConnectivity.com%' 3c62179f-dc13-4ad9-8d70-a88f6a7741df IISW3CLOG ALL false EXRPC: Find Exchange RPC Client Access Log Field Names Returns the field names for Exchange RPC Client Access Logs. Use this query when writing your own queries and need to know the names of the fields. These are the static field names as defined in the LPCustomInputFormats Plugin. /* Get field names for Exchange RPC Client Access Logs */ SELECT TOP 1 * FROM '[LOGFILEPATH]' WHERE date-time IS NOT NULL Fields: date-time session-id seq-number client-name organization-info client-software client-software-version client-mode client-ip server-ip protocol application-id operation rpc-status processing-time operation-specific failures f0054b57-8830-4fd9-9849-f9196f733326 EXRPCLOG ALL false EXRPC: Find requests with rpc-status or failures > 0 Sample query for Exchange RPC Client Access Logs /* Find all requests where rpc-stats > 0 or Failures > 0 */ SELECT TOP 5000 * FROM '[LOGFILEPATH]' WHERE date-time IS NOT NULL AND rpc-status NOT LIKE '0' OR Failures > 0 d6ed9aae-3861-429c-811d-87670dedaca0 EXRPCLOG ALL false EXSMTP: Sample SmtpSend Query Sample SmtpSend Query for Exchange 2010 SmtpSend protocol logging /* Sample Exchange 2010 SmtpSend Logs */ SELECT TOP 500 * FROM '[LOGFILEPATH]' WHERE date-time IS NOT NULL 4a8cff77-ea25-4c57-868f-b9f7cafe0895 EXSMTPSENDLOG ALL false Find ActiveSync User Find ActiveSync user by User Name. Be sure to add the user name to the query SELECT TOP 3 cs-username AS UserID, cs(User-Agent) AS DeviceType, EXTRACT_TOKEN(cs-uri-query,0,'|') AS Query, cs-uri-stem AS Vdir, STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) AS HTTPstatus, cs-method AS VERB, s-ip AS SERVER, c-ip AS CLIENT, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime INTO '[OUTFILEPATH]\findASuser.csv' FROM * WHERE cs-uri-stem LIKE '%Microsoft-Server-ActiveSync%' AND cs-username LIKE /* Put username here --> */'%johndoe%' GROUP BY GMTTime, HTTPstatus, UserID, Server, DeviceType, VERB, Query, Vdir, Client ORDER BY GMTTime, UserID, client, deviceType, VERB, Vdir, Query, HTTPstatus DESC 65116cbb-b8fd-4d1e-892c-a719c54ba9f5 IISW3CLOG MAS false Find EWS Delays by User [CSV] Be sure to add the user name to the query /* Finds all users with "Delay" in the response, then reports all relevant throttling indicators */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query,0,'UserDelay:'), 0, ';') AS UserDelay, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query,0,'UserDelayCnt:'), 0, ';') AS UserDelayCount, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, cs(User-Agent) AS DeviceType, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query,0,'Policy:'), 0, ',') AS Policy, cs-uri-stem AS Vdir, STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) AS HTTPstatus, s-ip AS SERVER, c-ip AS CLIENT, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime, cs-uri-query INTO '[OUTFILEPATH]\EWSUserDelays.CSV' FROM '[LOGFILEPATH]' WHERE cs-uri-query LIKE '%Delay%' AND cs-uri-stem LIKE '%EWS%' GROUP BY UserID, GMTTime, HTTPstatus, Server, DeviceType, UserDelay, Vdir, Client, cs-uri-query ORDER BY UserID, GMTTime, UserID, client, deviceType, Vdir, UserDelay, HTTPstatus DESC 6d3127cf-c790-40dc-a065-b9c6340b3b0e IISW3CLOG EWS false Find EWS Users w/TimeOutExpired Errors Find Throttled EWS Users SELECT cs-username, cs(User-Agent) AS EWSclient, TO_LOWERCASE(cs-uri-stem) AS application, TO_LOWERCASE(cs-uri-query) AS query, Count(*) FROM '[LOGFILEPATH]' WHERE query LIKE '%ErrorTimeoutExpired%' AND application LIKE '%ews%' Group BY cs-username, EWSclient, application, query Order BY cs-username, EWSclient cc1cdbc1-1684-4e85-b9c1-b801568e7a4c IISW3CLOG EWS false FS: IIS Log File Sizes Last 10 Days You can use this query to measure server activity over that last 10 days based on IIS log file sizes. Larger files = more requests. If you have an NLB run 1 query tab per server to confirm load distribution. The closer the file sizes are between servers, the better the NLB distribution. /* Compare file sizes of the last 10 days of IIS logs*/ SELECT TOP 10 Path, Size, LastWriteTime FROM '[LOGFILEPATH]' ORDER BY LastWriteTime ASC /* LOGFILEPATH should point to an IIS log folder If you have an NLB run 1 query tab per server to confirm load distribution The better the distribution, the closer the file sizes between servers. */ 7a08826e-08c8-46d9-b0ed-12efad1971cf FSLOG ALL false HTTPERR: Abandoned Requests Find times any applicationpool or request queue has abandoned a connection per hour. /* Find times any applicationpool or request queue has abandoned a connection per hour. */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS DateTime, COUNT(*) AS Total, s-reason AS Reason, cs-version AS [Client Version], cs-method AS Method, s-queuename as AppPool, LogFilename FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%Connection_Abandoned_By_AppPool%' OR s-reason LIKE '%Connection_Abandoned_By_ReqQueue%' GROUP BY DateTime, Reason, [Client Version], Method, AppPool, LogFilename ORDER BY DateTime ASC cdff6cb3-20d6-4225-8556-a31fd97803ad IISW3CLOG ALL true HTTPERR: Abandoned Requests - Specific AppPool Finds times any application pool or request queue has abandoned a connection per hour for the specific application pool used as search criteria in the query. /* Find times any applicationpool or request queue has abandoned a connection per hour for the specific appPool. The default is DefaultAppPool */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS DateTime, COUNT(*) AS Total, s-reason AS Reason, cs-version AS [Client Version], cs-method AS Method, s-queuename as AppPool, LogFilename FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%Connection_Abandoned_By_AppPool%' OR s-reason LIKE '%Connection_Abandoned_By_ReqQueue%' AND AppPool LIKE '%DefaultAppPool%' /* <- Replace DefaultAppPool with the pool you wish to find */ GROUP BY DateTime, Reason, [Client Version], Method, AppPool, LogFilename ORDER BY DateTime ASC 611d3bc7-7231-4ad5-bd65-08a8a464fba3 IISW3CLOG ALL false HTTPERR: AppPool Crashes per 1/2 Hour Finds the number of times any application pool crashes or goes off line every 1/2 hour. /* Find times an applicationpool has went off line due to unexpected shutdown or crash every 1/2 hour */ SELECT QUANTIZE(TO_TIMESTAMP(date, time), 1800) AS DateTime, COUNT(*) AS Total, s-reason AS Reason, cs-version AS [Client Version], cs-method AS Method, s-queuename as AppPool, LogFilename FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%AppOffline%' GROUP BY DateTime, Reason, [Client Version], Method, AppPool, LogFilename ORDER BY DateTime ASC 2fb5179e-eafa-4dd4-ba9b-914b19199c7f IISW3CLOG ALL false HTTPERR: Client_Reset Report Find all entries of Client_Reset. The connection between the client and the server was closed before the request could be assigned to a worker process. The most common cause of this behavior is that the client prematurely closes its connection to the server. See all HTTP Error definitions here: http://support.microsoft.com/kb/820729#3 /* Find all entries of Client_Reset. The connection between the client and the server was closed before the request could be assigned to a worker process. The most common cause of this behavior is that the client prematurely closes its connection to the server. */ SELECT TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS Timestamp, c-ip AS [Client IP], s-ip AS [Server IP], cs-version AS [Client Version], cs-method AS Method, cs-uri AS Uri, s-queuename as AppPool, LogFileName FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%Client_Reset%' ORDER BY Timestamp ASC 795967df-0699-4d05-b596-7af64fb2c18e IISW3CLOG ALL false HTTPERR: Common Http.Sys Errors Finds the most common HTTP Errors. The definitions for the errors can be found here: http://support.microsoft.com/kb/820729#3 /* Find the most commonly occurring HTTP Errors Reason Definitions can be found here: http://support.microsoft.com/kb/820729#3 */ SELECT TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS Timestamp, s-reason AS Reason, c-ip AS [Client IP], s-ip AS [Server IP], cs-version AS [Client Version], cs-method AS Method, cs-uri AS Uri, s-queuename as AppPool, LogFilename FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%Timer_AppPool%' OR s-reason LIKE '%Timer_EntityBody%' OR s-reason LIKE '%QueueFull%' OR s-reason LIKE '%Forbidden%' OR s-reason LIKE '%RequestLength%' OR s-reason LIKE '%Precondition%' OR s-reason LIKE '%Timer_MinBytesPerSecond%' OR s-reason LIKE '%ConnLimit%' OR s-reason LIKE '%Connections_Refused%' OR s-reason LIKE '%Connection_Abandoned_By_ReqQueue%' OR s-reason LIKE '%Connection_Abandoned_By_AppPool%' OR s-reason LIKE '%Hostname%' OR s-reason LIKE '%EntityTooLarge%' OR s-reason LIKE '%AppPoolTimer%' ORDER BY Timestamp, Reason ASC 8e50bd76-587d-40ea-ace6-1fd9468b843a IISW3CLOG ALL true HTTPERR: Connections_Refused The kernel NonPagedPool memory has dropped below 20MB and http.sys has stopped receiving new connections. /* The kernel NonPagedPool memory has dropped below 20MB and http.sys has stopped receiving new connections. */ SELECT TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS Timestamp, c-ip AS [Client IP], s-ip AS [Server IP], cs-version AS [Client Version], cs-method AS Method, cs-uri AS Uri, s-queuename as AppPool, LogFilename FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%Connections_Refused%' ORDER BY Timestamp ASC 9501dba5-9454-4f68-b339-ae45848ee61e IISW3CLOG ALL true HTTPERR: Find App Pool Crashes Find times an applicationpool has went off line due to unexpected shutdown or crash. /* Find times an applicationpool has went off line due to unexpected shutdown or crash. */ SELECT TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS DateTime, s-reason AS Reason, c-ip AS [Client IP], s-ip AS [Server IP], cs-version AS [Client Version], cs-method AS Method, cs-uri AS Uri, s-queuename as Queue, LogFilename AS LogFile FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%AppOffline%' GROUP BY DateTime, Reason, [Client IP], [Server IP], [Client Version], Method, Uri, Queue, LogFile ORDER BY DateTime ASC 92eef2f9-7eb9-44ec-9e49-58e88664989a IISW3CLOG ALL false HTTPERR: Queue_Full A service unavailable error occurred (an HTTP error 503). The service is not available because the application request queue is full. /* A service unavailable error occurred (an HTTP error 503). The service is not available because the application request queue is full. */ SELECT TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS Timestamp, c-ip AS [Client IP], s-ip AS [Server IP], cs-version AS [Client Version], cs-method AS Method, cs-uri AS Uri, s-queuename as AppPool, LogFilename FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%QueueFull%' ORDER BY Timestamp ASC 10e5d624-98c8-4008-8635-27632e7f2a27 IISW3CLOG ALL true HTTPERR: Timer_AppPool The connection expired because a request waited too long in an application pool queue for a server application to dequeue and process it. This timeout duration is ConnectionTimeout. By default, this value is set to two minutes. /* The connection expired because a request waited too long in an application pool queue for a server application to dequeue and process it. This timeout duration is ConnectionTimeout. By default, this value is set to two minutes.. */ SELECT TO_TIMESTAMP(TO_DATE(date), TO_TIME(time)) AS Timestamp, c-ip AS [Client IP], s-ip AS [Server IP], cs-version AS [Client Version], cs-method AS Method, cs-uri AS Uri, s-queuename as AppPool, LogFileName FROM '[LOGFILEPATH]' WHERE s-reason LIKE '%Timer_AppPool%' ORDER BY Timestamp ASC cbc91335-87b8-4661-95ae-7818b5367738 IISW3CLOG ALL true IIS: All Requests, Specific User [CSV] Pull all requests for a single user and send to a CSV file. /* Pull all requests by a single user and send to CSV */ /* If an error is returned there may be no matces */ SELECT date, time, cs-username, sc-status, sc-win32-status, time-taken, cs-uri-query INTO '[OUTFILEPATH]\SingleUserActivity.CSV' FROM '[LOGFILEPATH]' WHERE cs-username LIKE '%REPLACE_WITH_USERNAME%' GROUP BY date, time, cs-username, sc-status, sc-win32-status, time-taken, cs-uri-query ORDER BY time-taken d3a0c799-a35f-4727-80a5-26b2ddacb6e6 IISW3CLOG ALL false IIS: Count all Web Service 500 Errors by URI Counts all errors of calls made to any .NET Web Service /* All 500 errors to any IIS/.NET Web Service */ SELECT cs-uri-stem as Uri, sc-status as HttpStatus, sc-substatus as SubStatus, sc-win32-status as Win32Status, COUNT(*) AS Total FROM '[LOGFILEPATH]' WHERE (sc-status = 500) AND (cs-uri-stem LIKE '%.asmx') GROUP BY Uri, HttpStatus, SubStatus, Win32Status ORDER BY Total DESC 57751a8c-e64d-4f54-a391-89880fbfe3b0 IISW3CLOG ALL false IIS: HTTP 401 by User [CSV] HTTP 401 by User /* All 401 errors counted per user and saved to CSV */ SELECT cs-username, sc-status, cs-uri-stem, Count(*) AS Total INTO '[OUTFILEPATH]\401_username.csv' From '[LOGFILEPATH]' Where sc-status = 401 Group By cs-username, sc-status, cs-uri-stem order by cs-username 736db969-30e7-4252-9de0-45c7d19ab00d IISW3CLOG ALL false IIS: HTTP 503 Errors [CSV] Returns all 503 errors by user to a CSV file named 503_BY_Username.csv. SELECT cs-username, sc-status, cs-uri-stem, Count(*) AS Total INTO '[OUTFILEPATH]\503_BY_Username.csv' From '[LOGFILEPATH]' Where sc-status = 503 Group By cs-username, sc-status, cs-uri-stem, cs-uri-query order by cs-username 6f6fab51-5782-4a04-a16a-5b393de584b9 IISW3CLOG ALL false IIS: HTTP Status Codes by Count Returns all status codes and how many times each one occurred. /* Count and sort all HTTP status codes */ SELECT TOP 25 STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) As Status, COUNT(*) AS Hits FROM '[LOGFILEPATH]' GROUP BY Status ORDER BY Hits DESC e80a8693-c0be-49fd-bcab-7e8f6512cfd7 IISW3CLOG ALL true IIS: Page Hits per Single IP All pages/hits made by a single client IP address /* All pages/hits by a given client IP */ select cs-uri-stem, count(cs-uri-stem) as requestcount from '[LOGFILEPATH]' where c-ip = '000.000.000.000' group by cs-uri-stem order by count(cs-uri-stem) desc cade0ee3-14f0-4f68-b7cf-4263cd83ab34 IISW3CLOG ALL false IIS: Password Error Report Finds and counts passwords errors such as password expired, user doesn't exist, account restriction etc. /* Find password releated issues such as account lockouts etc */ SELECT TO_LOWERCASE (cs-username) AS User, COUNT(*) AS Hits, cs(User-Agent) AS User-Agent, sc-win32-status AS ErrorCode, WIN32_ERROR_DESCRIPTION(sc-win32-status) as Reason FROM '[LOGFILEPATH]' WHERE sc-win32-status = '1317' or /* user doesn't exist */ sc-win32-status = '1326' or /* wrong password */ sc-win32-status = '1330' or /* password expired */ sc-win32-status = '1327' or /* account restriction*/ sc-win32-status = '1331' or /* account disabled */ sc-win32-status = '1909' /* account locked out */ GROUP BY User, User-Agent, ErrorCode, Reason ORDER BY Hits DESC /* WIN32_ERROR_DESCRIPTION( win32ErrorCode <INTEGER> ) */ 4d7f65b1-830b-450d-a7ed-92e90bac7d3c IISW3CLOG MISC false IIS: Request per Hour RequestsPerHour description SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS Hour, COUNT(*) AS Total, SUM(sc-bytes) AS TotBytesSent FROM '[LOGFILEPATH]' GROUP BY Hour ORDER BY Hour 451fac87-f83c-4d7d-b8ac-c443852f9ad5 IISW3CLOG ALL false IIS: Request per Hour by Bytes Sent RequestsPerHour description SELECT QUANTIZE(TO_TIMESTAMP(date, time), 3600) AS Hour, COUNT(*) AS Total, SUM(sc-bytes) AS TotBytesSent FROM '[LOGFILEPATH]' GROUP BY Hour ORDER BY Hour 8f89f3ce-6a43-4e94-a1b8-4c5ba3f2d507 IISW3CLOG ALL false IIS: Status/SubStatus Report StatusSubStatusCount description SELECT STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) AS Status, COUNT(*) AS Total FROM '[LOGFILEPATH]' GROUP BY Status ORDER BY Total DESC 62e69b30-4046-4eaf-807e-537211945ae2 IISW3CLOG ALL false IIS: Top 10 IIS Short Paths Top 10 IIS Short Paths /* TOP 10 URI Shortpaths */ SELECT TOP 10 TO_LOWERCASE(EXTRACT_TOKEN( cs-uri-stem ,1, '/' )) AS Path, COUNT(*) AS Total, CASE Path when '' then 'root of website' END as Interesting FROM '[LOGFILEPATH]' GROUP BY Path, Total, Interesting ORDER BY Total DESC ce4e56e2-ed9b-4b8e-8381-782a5c35d56e IISW3CLOG ALL false IIS: Top 20 HTTP Verbs Top 20 Verbs SELECT TOP 20 cs-method, COUNT(*) AS Total, MAX(time-taken) AS MaxTime, AVG(time-taken) AS AvgTime, AVG(sc-bytes) AS AvgBytesSent FROM '[LOGFILEPATH]' GROUP BY cs-method ORDER BY Total DESC 4c13c624-8d15-43b9-b94b-123283467941 IISW3CLOG ALL false IIS: Top 20 URIs Top 20 URIs requested SELECT TOP 20 cs-uri-stem, COUNT(*) AS Total, MAX(time-taken) AS MaxTime, AVG(time-taken) AS AvgTime /* bytes--> AVG(sc-bytes) AS AvgBytes */ FROM '[LOGFILEPATH]' GROUP BY cs-uri-stem ORDER BY Total DESC 2818b23a-5cbe-4e8d-b629-0263313bc4eb IISW3CLOG ALL false IIS: Top 25 Slow URLs TOP 25 Slowest URLsl requests incling Min/Max/Average /* TOP 25 Slowest Url requests */ SELECT TOP 25 cs-uri-stem as URL, MAX(time-taken) As Max, MIN(time-taken) As Min, Avg(time-taken) As Average FROM '[LOGFILEPATH]' GROUP BY URL ORDER By Average DESC 8cf173d8-ba44-4aed-ba8c-eaf7f7ce0559 IISW3CLOG ALL false IIS: User-Agent Report Find all User-Agents and count them. /* User-Agent Report */ SELECT distinct cs(User-Agent), count(*) as hits FROM '[LOGFILEPATH]' GROUP BY cs(user-agent) ORDER BY hits DESC b7e18f3f-b656-4fbd-b3db-21d1b29c1b7f IISW3CLOG ALL true IIS: VDir Hits by IP Hits on a particular virtual directory by IP address /* Hits on a particular page by IP address */ select c-ip, count(c-ip) as requestcount from '[LOGFILEPATH]' where cs-uri-stem like '%/%' group by c-ip order by count(c-ip) desc daf7031a-c803-4b69-951a-f48fbf6752df IISW3CLOG ALL false IIS: Win32 Error Report List only Win32 Error codes. Win32 Error codes are errors that were returned to IIS by the OS or other application. /* List only Win32 Error codes. Win32 Error codes are errors that were returned to IIS by the OS or other application. */ SELECT sc-win32-status As Win32-Status, COUNT(*) AS Hits, WIN32_ERROR_DESCRIPTION(sc-win32-status) as Description FROM '[LOGFILEPATH]' WHERE Win32-Status<>0 GROUP BY Win32-Status ORDER BY Hits DESC 2b2e7d4b-0a9e-4f48-89fb-d4e5bdc0d2ce IISW3CLOG ALL true NETMON: Bytes Per Minute Reports bytes per minute transfered in a Netmon Capture broken down per minute. Multiple files are not allowed. SELECT QUANTIZE(DateTime,60) AS Minute, SUM(FrameBytes) as [Total Bytes], DIV(SUM(FrameBytes), 1024) AS [Total KB], DIV( DIV( SUM(FrameBytes) , 1024) , 1024) AS [Total MB] FROM 'c:\Captures\NetmonCapture.cap' /* <- change filename and path to your capture file */ GROUP BY Minute b9a5ff6e-f3d2-4cef-b481-4a57443abbc6 NETMONLOG CAP false OLA: RPC/HTTP Users by Requests Outlook Anywhere users by number of requests SELECT TOP 1000 cs-username AS UserID, Count(*) AS Requests, cs-method AS Method, cs(user-agent) as Client, cs-uri-query as RPCTarget, cs-uri-stem as Uri, sc-status As Status FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/RPC%' AND UserID <> '' AND UserID IS NOT NULL AND (cs-method = 'RPC_IN_DATA' OR cs-method = 'RPC_OUT_DATA') GROUP BY UserID, RPCTarget, Method, Client, Uri, Status ORDER BY Requests Desc b60fc466-5ff0-404a-a94e-d37c50cea054 IISW3CLOG OLA false OWA: Budget Report [100% Exceeded] Returns all OWA requests where any budget is over 100% /* Returns all OWA request where any budget is over 100% Sorted by the total of all budgets (AD/CAS/RPC/FC/AB) The policy that is in effect is also listed. These users are exceeding their budget. */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/owa%' AND (TO_INT(AD%) > 100 OR TO_INT(CAS%) > 100 OR TO_INT(AB%) > 100 OR TO_INT(RPC%) > 100 OR TO_INT(FC%) > 100) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC d3654feb-bd74-4f68-911d-7a38e0c37b85 IISW3CLOG OWA true OWA: Budget Report [75% Exceeded] Find all OWA requests with any budget over 75% /* Returns all OWA request where any budget is over 75% Sorted by the total of all budgets (AD/CAS/RPC/FC/AB) The policy that is in effect is also listed. */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/owa%' AND (TO_INT(AD%) > 75 OR TO_INT(CAS%) > 75 OR TO_INT(AB%) > 75 OR TO_INT(RPC%) > 75 OR TO_INT(FC%) > 75) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC 875c8a2a-5c28-435d-af24-81351ee37685 IISW3CLOG OWA true OWA: Budget Report [CSV] Creates a CSV all users per amount of total budget used where any single budget is > 0% ordered by the sum of all budgets. Lists the User, Budget details, Server, query and policy applied. SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime INTO '[OUTFILEPATH]\OWA_Budget_Top100.CSV' FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/owa%' AND (TO_INT(AD%) > 0 OR TO_INT(CAS%) > 0 OR TO_INT(AB%) > 0 OR TO_INT(RPC%) > 0 OR TO_INT(FC%) > 0) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC 8829cde2-4be2-45b0-8d59-ec2f929e3810 IISW3CLOG OWA true OWA: Budget Report [Top 100 Users] Returns the Top 100 users per amount of total budget used across the sum of all budgets. Lists the User, Budget details, query and policy applied. SELECT TOP 100 cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'Policy:'), 0, ',') As Policy, EXTRACT_VALUE(cs-uri-query,'mbx') AS CAS, s-ip AS SERVER, cs-uri-query AS Query, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/owa%' AND (TO_INT(AD%) > 0 OR TO_INT(CAS%) > 0 OR TO_INT(AB%) > 0 OR TO_INT(RPC%) > 0 OR TO_INT(FC%) > 0) GROUP BY UserID, ADBudget, CASBudget, ABBudget, RPCBUdget, FCBudget, Policy, CAS, SERVER, Query, GMTTime ORDER BY Total% DESC 635f239a-fc66-442d-98d2-aee1c838afbd IISW3CLOG OWA true OWA: Latency Report [Top 100] OWA Latency for the top 100 users SELECT TOP 100 cs-username AS UserID, TO_INT(EXTRACT_VALUE(cs-uri-query,'prfltncy')) AS TotalLatency, DIV(TotalLatency, 1000) as Seconds, EXTRACT_VALUE(cs-uri-query,'prfrpccnt') AS RPCcount, EXTRACT_VALUE(cs-uri-query,'prfrpcltncy') AS RPClatency, EXTRACT_VALUE(cs-uri-query,'prfldpcnt') AS LDAPcount, EXTRACT_VALUE(cs-uri-query,'prfldpltncy') AS LDAPlatency, STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) AS HTTPstatus, cs-uri-query AS Query, cs-method AS VERB, s-ip AS SERVER, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%OWA%' AND TotalLatency > 100 AND Query NOT LIKE '%Attach%' GROUP BY GMTTime, Query, HTTPstatus, UserID, Server, VERB, TotalLatency, RPCcount, RPClatency, LDAPcount, LDAPlatency ORDER BY TotalLatency DESC 02b08d05-ea6d-4c9d-953d-47d7722e0ab2 IISW3CLOG OWA true OWA: Latency Report [Top 20] OWA Top 20 requests by total latency SELECT TOP 20 cs-username AS UserID, cs-uri-query AS Query, TO_INT(EXTRACT_VALUE(cs-uri-query,'prfltncy')) AS TotalLatency, EXTRACT_VALUE(cs-uri-query,'prfrpccnt') AS RPCcount, EXTRACT_VALUE(cs-uri-query,'prfrpcltncy') AS RPClatency, EXTRACT_VALUE(cs-uri-query,'prfldpcnt') AS LDAPcount, EXTRACT_VALUE(cs-uri-query,'prfldpltncy') AS LDAPlatency, STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) AS HTTPstatus, cs-method AS VERB, s-ip AS SERVER, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%OWA%' AND TotalLatency > 100 AND Query NOT LIKE '%Attach%' GROUP BY GMTTime, Query, HTTPstatus, UserID, Server, VERB, TotalLatency, RPCcount, RPClatency, LDAPcount, LDAPlatency ORDER BY TotalLatency DESC a67c1aca-6fcb-4b9a-80d8-2f3253fefec7 IISW3CLOG OWA true OWA: Latency Report [CSV] OWA Latency report to CSV file SELECT cs-username AS UserID, EXTRACT_TOKEN(cs-uri-query,0,'&prfltncy=') AS Query, TO_INT(EXTRACT_VALUE(cs-uri-query,'prfltncy')) AS TotalLatency, EXTRACT_VALUE(cs-uri-query,'prfrpccnt') AS RPCcount, EXTRACT_VALUE(cs-uri-query,'prfrpcltncy') AS RPClatency, EXTRACT_VALUE(cs-uri-query,'prfldpcnt') AS LDAPcount, EXTRACT_VALUE(cs-uri-query,'prfldpltncy') AS LDAPlatency, STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) AS HTTPstatus, cs-method AS VERB, s-ip AS SERVER, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime INTO '[OUTFILEPATH]\OWALatency.csv' FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%OWA%' AND TotalLatency > 100 AND Query NOT LIKE '%Attach%' GROUP BY GMTTime, Query, HTTPstatus, UserID, Server, VERB, TotalLatency, RPCcount, RPClatency, LDAPcount, LDAPlatency ORDER BY TotalLatency DESC e2a34ce7-0fa0-42c0-87c3-dad2f9c48634 IISW3CLOG OWA true OWA: Status Codes By VDir Reports text translations and counts of all HTTP status codes by virtual directory /* Return counts all HTTP Status Codes with descriptions per Virtual Directory */ /* Caution: It is recommended to use the CSV version of this query */ SELECT TO_LOWERCASE(cs-uri-stem) as Vdir, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, CASE HTTPstatus when '200.0' then 'HttpStatusOk' when '201.0' then 'HttpStatusCreated' when '204.0' then 'HttpStatusNoContent' when '206.0' then 'HttpStatusPartialContent' when '207.0' then 'HttpStatusMultiStatus' when '241.0' then 'returned by the proxied-to CAS when it needs the proxying CAS to retry the request' when '242.0' then 'returned by the proxied-to CAS for a successful ping request.' when '301.0' then 'HttpStatusMovedPermanently' when '302.0' then 'HttpStatusRedirect' when '307.0' then 'HttpStatusMovedTemporarily' when '304.0' then 'HttpStatusNotModified' when '400.0' then 'HttpStatusBadRequest' when '400.1' then 'HttpStatusInvalidDestination' when '400.2' then 'HttpStatusInvalidDepth' when '400.3' then 'HttpStatusInvalidIf' when '400.4' then 'HttpStatusInvalidOverwrite' when '400.5' then 'HttpStatusInvalidTranslate' when '400.6' then 'HttpStatusInvalidRequestBody' when '400.7' then 'HttpStatusInvalidContentLength' when '401.0' then 'HttpStatusUnauthorized' when '401.1' then 'HttpStatusBadLogon' when '401.2' then 'HttpStatusDeniedConfig' when '401.3' then 'HttpStatusDeniedResource' when '401.4' then 'HttpStatusDeniedFilter' when '401.5' then 'HttpStatusDeniedApplication' when '403.0' then 'HttpStatusForbidden' when '403.1' then 'HttpStatusExecAccessDenied' when '403.2' then 'HttpStatusReadAccessDenied' when '403.3' then 'HttpStatusWriteAccessDenied' when '403.4' then 'HttpStatusSSLRequired' when '403.5' then 'HttpStatusSSL128Required' when '403.6' then 'HttpStatusIPAddressReject' when '403.7' then 'HttpStatusCertRequired' when '403.8' then 'HttpStatusSiteAccessDenied' when '403.9' then 'HttpStatusTooManyUsers' when '403.11' then 'HttpStatusPasswordChange' when '403.12' then 'HttpStatusMapperDenyAccess' when '403.13' then 'HttpStatusCertRevoked' when '403.14' then 'HttpStatusDirBrowsingDenied' when '403.16' then 'HttpStatusCertInvalid' when '403.17' then 'HttpStatusCertTimeInvalid' when '403.18' then 'HttpStatusAppPoolDenied' when '403.19' then 'HttpStatusInsufficientPrivilegeForCgi' when '403.20' then 'HttpStatusPassportLoginFailure' when '403.21' then 'HttpStatusSourceAccessDenied' when '403.22' then 'HttpStatusInfiniteDepthDenied' when '404.0' then 'HttpStatusNotFound' when '404.2' then 'HttpStatusDeniedByPolicy' when '404.3' then 'HttpStatusDeniedByMimeMap' when '404.4' then 'HttpStatusNoHandler' when '404.5' then 'HttpStatusDeniedByUrlSequence' when '404.6' then 'HttpStatusDeniedByVerb' when '404.7' then 'HttpStatusDeniedByFileExtension' when '404.8' then 'HttpStatusHiddenSegment' when '404.9' then 'HttpStatusFileAttributeHidden' when '404.10' then 'HttpStatusRequestHeaderTooLong' when '404.11' then 'HttpStatusUrlDoubleEscaped' when '404.12' then 'HttpStatusUrlHasHighBitChars' when '404.13' then 'HttpStatusContentLengthTooLarge' when '404.14' then 'HttpStatus404UrlTooLong' when '404.15' then 'HttpStatusQueryStringTooLong' when '404.16' then 'HttpStatusStaticFileDav' when '404.17' then 'HttpStatusPreconditionedHandler' when '404.18' then 'HttpStatusDeniedByQueryStringSequence' when '404.19' then 'HttpStatusDeniedByFilteringRule' when '405.0' then 'HttpStatusMethodNotAllowed' when '406.0' then 'HttpStatusNotAcceptable' when '407.0' then 'HttpStatusProxyAuthRequired' when '409.0' then 'HttpStatusConflict' when '412.0' then 'HttpStatusPreconditionFailed' when '413.0' then 'HttpStatusEntityTooLarge' when '414.0' then 'HttpStatusUrlTooLong' when '415.0' then 'HttpStatusUnsupportedMediaType' when '416.0' then 'HttpStatusRangeNotSatisfiable' when '417.0' then 'HttpStatusExpectationFailed' when '423.0' then 'HttpStatusLockedError' when '424.0' then 'HttpStatusFailedDependency' when '441.0' then 'Returned by the proxied-to CAS when it needs to request identity' when '442.0' then 'Target CAS needs Timezone f-r-o-m client' when '449.0' then 'ActiveSync device blocked due to policy. Retry after sending a PROVISION command.' when '500.0' then 'HttpStatusServerError' when '500.16' then 'HttpStatusUNCAccess' when '500.19' then 'HttpStatusBadMetadata' when '500.21' then 'HttpStatusHandlersModule' when '500.22' then 'HttpStatusAspnetModules' when '500.23' then 'HttpStatusAspnetHandlers' when '500.24' then 'HttpStatusAspnetImpersonation' when '501.0' then 'HttpStatusNotImplemented' when '502.0' then 'HttpStatusBadGateway' when '502.1' then 'HttpStatusTimeout' when '502.2' then 'HttpStatusPrematureExit' when '502.3' then 'HttpStatusForwarderConnectionError' when '503.0' then 'HttpStatusServiceUnavailable' when '503.2' then 'HttpStatusAppConcurrent' when '504.0' then 'HttpStatusGatewayTimeout' when '507.0' then 'HttpStatusInsufficientStorage - the user exceeded mailbox quota.' END as w3-status-details , CASE sc-win32-status WHEN 0 then ' ' WHEN 2148074254 then 'handshake in progress' ELSE WIN32_ERROR_DESCRIPTION(sc-win32-status) END as win32-error, sc-win32-status, Count(*) As Hits FROM '[LOGFILEPATH]' WHERE vdir LIKE '%owa%' AND cs-username IS NOT NULL Group BY vdir, HTTPstatus, w3-status-details, win32-error, sc-win32-status Order BY Hits, VDir ed57ca1d-de0b-445c-bef7-bd92cb5bc912 IISW3CLOG OWA true OWA: Status Codes By VDir [CSV] Reports text translations and counts of all HTTP status codes by virtual directory and sends the results to csv /* Return counts all HTTP Status Codes with descriptions per Virtual Directory */ /* Caution: It is recommended to use the CSV version of this query */ SELECT TO_LOWERCASE(cs-uri-stem) as Vdir, STRCAT(STRCAT(TO_STRING(sc-status),'.'),TO_STRING(sc-substatus)) as HTTPstatus, CASE HTTPstatus when '200.0' then 'HttpStatusOk' when '201.0' then 'HttpStatusCreated' when '204.0' then 'HttpStatusNoContent' when '206.0' then 'HttpStatusPartialContent' when '207.0' then 'HttpStatusMultiStatus' when '241.0' then 'returned by the proxied-to CAS when it needs the proxying CAS to retry the request' when '242.0' then 'returned by the proxied-to CAS for a successful ping request.' when '301.0' then 'HttpStatusMovedPermanently' when '302.0' then 'HttpStatusRedirect' when '307.0' then 'HttpStatusMovedTemporarily' when '304.0' then 'HttpStatusNotModified' when '400.0' then 'HttpStatusBadRequest' when '400.1' then 'HttpStatusInvalidDestination' when '400.2' then 'HttpStatusInvalidDepth' when '400.3' then 'HttpStatusInvalidIf' when '400.4' then 'HttpStatusInvalidOverwrite' when '400.5' then 'HttpStatusInvalidTranslate' when '400.6' then 'HttpStatusInvalidRequestBody' when '400.7' then 'HttpStatusInvalidContentLength' when '401.0' then 'HttpStatusUnauthorized' when '401.1' then 'HttpStatusBadLogon' when '401.2' then 'HttpStatusDeniedConfig' when '401.3' then 'HttpStatusDeniedResource' when '401.4' then 'HttpStatusDeniedFilter' when '401.5' then 'HttpStatusDeniedApplication' when '403.0' then 'HttpStatusForbidden' when '403.1' then 'HttpStatusExecAccessDenied' when '403.2' then 'HttpStatusReadAccessDenied' when '403.3' then 'HttpStatusWriteAccessDenied' when '403.4' then 'HttpStatusSSLRequired' when '403.5' then 'HttpStatusSSL128Required' when '403.6' then 'HttpStatusIPAddressReject' when '403.7' then 'HttpStatusCertRequired' when '403.8' then 'HttpStatusSiteAccessDenied' when '403.9' then 'HttpStatusTooManyUsers' when '403.11' then 'HttpStatusPasswordChange' when '403.12' then 'HttpStatusMapperDenyAccess' when '403.13' then 'HttpStatusCertRevoked' when '403.14' then 'HttpStatusDirBrowsingDenied' when '403.16' then 'HttpStatusCertInvalid' when '403.17' then 'HttpStatusCertTimeInvalid' when '403.18' then 'HttpStatusAppPoolDenied' when '403.19' then 'HttpStatusInsufficientPrivilegeForCgi' when '403.20' then 'HttpStatusPassportLoginFailure' when '403.21' then 'HttpStatusSourceAccessDenied' when '403.22' then 'HttpStatusInfiniteDepthDenied' when '404.0' then 'HttpStatusNotFound' when '404.2' then 'HttpStatusDeniedByPolicy' when '404.3' then 'HttpStatusDeniedByMimeMap' when '404.4' then 'HttpStatusNoHandler' when '404.5' then 'HttpStatusDeniedByUrlSequence' when '404.6' then 'HttpStatusDeniedByVerb' when '404.7' then 'HttpStatusDeniedByFileExtension' when '404.8' then 'HttpStatusHiddenSegment' when '404.9' then 'HttpStatusFileAttributeHidden' when '404.10' then 'HttpStatusRequestHeaderTooLong' when '404.11' then 'HttpStatusUrlDoubleEscaped' when '404.12' then 'HttpStatusUrlHasHighBitChars' when '404.13' then 'HttpStatusContentLengthTooLarge' when '404.14' then 'HttpStatus404UrlTooLong' when '404.15' then 'HttpStatusQueryStringTooLong' when '404.16' then 'HttpStatusStaticFileDav' when '404.17' then 'HttpStatusPreconditionedHandler' when '404.18' then 'HttpStatusDeniedByQueryStringSequence' when '404.19' then 'HttpStatusDeniedByFilteringRule' when '405.0' then 'HttpStatusMethodNotAllowed' when '406.0' then 'HttpStatusNotAcceptable' when '407.0' then 'HttpStatusProxyAuthRequired' when '409.0' then 'HttpStatusConflict' when '412.0' then 'HttpStatusPreconditionFailed' when '413.0' then 'HttpStatusEntityTooLarge' when '414.0' then 'HttpStatusUrlTooLong' when '415.0' then 'HttpStatusUnsupportedMediaType' when '416.0' then 'HttpStatusRangeNotSatisfiable' when '417.0' then 'HttpStatusExpectationFailed' when '423.0' then 'HttpStatusLockedError' when '424.0' then 'HttpStatusFailedDependency' when '441.0' then 'Returned by the proxied-to CAS when it needs to request identity' when '442.0' then 'Target CAS needs Timezone f-r-o-m client' when '449.0' then 'ActiveSync device blocked due to policy. Retry after sending a PROVISION command.' when '500.0' then 'HttpStatusServerError' when '500.16' then 'HttpStatusUNCAccess' when '500.19' then 'HttpStatusBadMetadata' when '500.21' then 'HttpStatusHandlersModule' when '500.22' then 'HttpStatusAspnetModules' when '500.23' then 'HttpStatusAspnetHandlers' when '500.24' then 'HttpStatusAspnetImpersonation' when '501.0' then 'HttpStatusNotImplemented' when '502.0' then 'HttpStatusBadGateway' when '502.1' then 'HttpStatusTimeout' when '502.2' then 'HttpStatusPrematureExit' when '502.3' then 'HttpStatusForwarderConnectionError' when '503.0' then 'HttpStatusServiceUnavailable' when '503.2' then 'HttpStatusAppConcurrent' when '504.0' then 'HttpStatusGatewayTimeout' when '507.0' then 'HttpStatusInsufficientStorage - the user exceeded mailbox quota.' END as w3-status-details , CASE sc-win32-status WHEN 0 then ' ' WHEN 2148074254 then 'handshake in progress' ELSE WIN32_ERROR_DESCRIPTION(sc-win32-status) END as win32-error, sc-win32-status, Count(*) As Hits INTO '[OUTFILEPATH]\OWAStatusCodeReportByVDir.CSV' FROM '[LOGFILEPATH]' WHERE vdir LIKE '%owa%' AND cs-username IS NOT NULL Group BY vdir, HTTPstatus, w3-status-details, win32-error, sc-win32-status Order BY Hits, VDir b9e5f0ee-5fbc-4b56-91bd-998f5f80ab02 IISW3CLOG OWA true OWA: Top 20 OWA Users Find the top 20 OWA users by total number of requests SELECT TOP 20 cs-username AS UserID, cs(User-Agent) AS Application, cs-uri-stem AS Vdir, c-ip AS CLIENT, cs-method, Count(*) FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%OWA%' GROUP BY UserID, Application, Vdir, Client, cs-method ORDER BY COUNT(*) DESC ad83693a-1fec-48e3-aa1c-8e1941e706da IISW3CLOG OWA true OWA:Hits by IP OWA Requests by IP address /* Hits on a particular page by IP address */ select cs-username as User, c-ip as IPAddress, count(c-ip) as RequestCount from '[LOGFILEPATH]' where cs-uri-stem like '%/owa%' AND cs-username <> NULL group by c-ip, cs-username order by count(c-ip), cs-username desc 934c6ab9-8619-4350-a079-ab1b9e67b668 IISW3CLOG ALL false Powershell: Find 500 Errros Returns a count of all errors for requests to /Powershell /* Count and List all Powershell Errors by URI */ SELECT time as Time, sc-status as StatusCode, sc-win32-status as Win32Code, cs-uri-stem as URI, COUNT(sc-status) FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/PowerShell%' AND sc-status > 499 GROUP BY Time, Date, StatusCode, Win32Code, URI ORDER BY Time DESC d684ade1-fbf9-4742-bb04-f3b54cba5c9b IISW3CLOG PS false Powershell: Hits (HTTP 500) All requests made to /PowerShell that result in a 500 error /* Count and List all Powershell Errors by URI */ SELECT time as Time, cs-username, sc-status as StatusCode, sc-win32-status as Win32Code, cs-uri-stem as URI, COUNT(sc-status) FROM '[LOGFILEPATH]' WHERE cs-uri-stem LIKE '%/PowerShell%' AND sc-status > 499 GROUP BY cs-username, Time, Date, StatusCode, Win32Code, URI ORDER BY Time DESC c2181028-833a-4833-bbf5-e1ff84716b75 IISW3CLOG PS false REGISTRY: Find Registry Query Field Names Finds Registry Query Field Names for use when writing your own registry queries /* Get Registry Query Field Names - Does not return results */ SELECT TOP 0 * FROM HKCU\SOFTWARE\MICROSOFT WHERE LastWriteTime >= SUB(SYSTEM_TIMESTAMP(), TIMESTAMP('2999-02-10', 'yyyy-MM-dd')) b3df3a58-c844-4a65-9006-128174330633 REGLOG MISC false REGISTRY: Writes Since Previous Date Find all Key\Values written to since the chosen date /* Find Registry values that have been writtin to since ??? */ SELECT Path, ValueName, Value FROM \\COMPUTER\HKCU\SOFTWARE\MICROSOFT /* <- \\Computer\HIVE\KEY */ WHERE LastWriteTime >= SUB(SYSTEM_TIMESTAMP(), TIMESTAMP('0000-02-10', 'yyyy-MM-dd')) /* <- date since modified */ 665b6b82-99d5-44ac-9433-3da4bd94421b REGLOG MISC false Throttling: Find Delays Finds all users with "Delay" in the response, then reports all relevant throttling indicators /* Finds all users with "Delay" in the response, then reports all relevant throttling indicators */ SELECT cs-username AS UserID, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query,0,'UserDelay:'), 0, ';') AS UserDelay, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query,0,'UserDelayCnt:'), 0, ';') AS UserDelayCount, REPLACE_STR(EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'SoapAction='), 0, ';'), 'm:', '') As SoapAction, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AD:'), 0, ',') As ADBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'CAS:'), 0, ',') As CASBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'AB:'), 0, ',') As ABBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'RPC:'), 0, ',') As RPCBudget, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query, 0, 'FC:'), 0, ',') As FCBudget, SUBSTR(ADBudget, ADD( LAST_INDEX_OF(ADBudget, '/') , 1) , 1) AS AD%, SUBSTR(CASBudget, ADD( LAST_INDEX_OF(CASBudget, '/') , 1) , 1) AS CAS%, SUBSTR(ABBudget, ADD( LAST_INDEX_OF(ABBudget, '/') , 1) , 1) AS AB%, SUBSTR(RPCBudget, ADD( LAST_INDEX_OF(RPCBudget, '/') , 1) , 1) AS RPC%, SUBSTR(FCBudget, ADD( LAST_INDEX_OF(FCBudget, '/') , 1) , 1) AS FC%, ADD(ADD(ADD(TO_INT(AD%), TO_INT(CAS%)), ADD(TO_INT(AB%), TO_INT(RPC%))), TO_INT(FC%)) As Total%, cs(User-Agent) AS DeviceType, EXTRACT_PREFIX(EXTRACT_SUFFIX(cs-uri-query,0,'Policy:'), 0, ',') AS Policy, cs-uri-stem AS Vdir, STRCAT(TO_STRING(sc-status), STRCAT('.', TO_STRING(sc-substatus))) AS HTTPstatus, s-ip AS SERVER, c-ip AS CLIENT, STRCAT(TO_STRING(date, 'yyyy-MM-dd'), STRCAT(' ', TO_STRING(time, 'hh:mm:ss'))) AS GMTTime, cs-uri-query FROM '[LOGFILEPATH]' WHERE cs-uri-query LIKE '%Delay%' GROUP BY GMTTime, HTTPstatus, UserID, Server, DeviceType, UserDelay, Vdir, Client, cs-uri-query ORDER BY UserDelay, GMTTime, UserID, client, deviceType, Vdir, UserDelay, HTTPstatus DESC 67a91771-ed35-494a-a57b-7d3e5cd3c3af IISW3CLOG ALL true