Hello,
I have set up a scheduled job to run every minute to use logparser to import the various IIS log files into a database. I am using a checkpoint file to enable incremental parsing.
I noticed that a deliberate bad password FTP request I made seemed to be taking an age to appear in the database. When I looked in the log file however I could see that it had been flushed to the log file but wasn't being imported.
On further investigation I noticed that according to the FTP log files there were 5 consecutive logged rows at 3:00AM followed by 4 consecutive logged rows at 07:30AM and 2 at 13:00.
The records the logparser query had inserted however just included 6 rows, the 5 rows at 3AM (LogRows 5-9). and only The final row at 07:30 (which it had given the LogRow number 279) to.
I assume that because LogParser thinks it has processed up to row 279 that is the reason why rows 10 and 11 never made it into the database.
I also notice that there would have been 270 executions of the logparser query between 3:00AM and 07:30AM and that the LogRow also jumped by 270.
I suspect that there might be a bug where it incorrectly increments the LogRow by 1 even if nothing was parsed.
Is there any work around I can use to mitigate this?
Cheers,
Martin