As IT security professionals, we scan networks and use different tools to do our work. We can end up with a dozen log files to analyze. A couple of days ago, I found a useful Microsoft tool called Log Parser.
Log parser is a powerful, versatile tool that provides universal query access to text-based data such as log files, XML files and CSV files, as well as key data sources on the Windows® operating system such as the Event Log, the Registry, the file system, and Active Directory®. You tell Log Parser what information you need and how you want it processed. The results of your query can be custom-formatted in text based output, or they can be persisted to more specialty targets like SQL, SYSLOG, or a chart.
It has useful features for querying different data sources. I experimented with it and came up with the following command lines.
Put the logs in a directory and make sure they share an extension, such as .log or .txt. Open a command prompt and run the following command.
Example 1: Find vulnerability markers
Code1 line
1
LogParser.exe -i:textline "select text from C:\Scans\*.log where text like '%VUL%'" -o:CSV
This command searches the log files for hosts marked as vulnerable. Change the search text to the string you need. The output is:
Code7 lines
1
2
3
4
5
6
7
10.202.1.8 :5900 vnc4:VULNERABLE
10.202.2.7 :5900 vnc4:VULNERABLE
Statistics:
-----------
Elements processed: 6565
Elements output: 2
Execution time: 0.36 seconds
Example 2: Find Apache 2.0.58 banners
Code1 line
1
LogParser.exe -i:textline "select text from c:\scans\web.log where text like '%2.0.58%'" -o:CSV
LogParser.exe -i:textline "select text from c:\scans\ban.log where text like '%Imail%'" -o:CSV
Output:
Code8 lines
1
2
3
4
5
6
7
8
10.20.121.73:143 * OK IMAP4 Server (IMail 9.04)
10.20.121.74:143 * OK IMAP4 Server (IMail 9.04)
Statistics:
-----------
Elements processed: 7390
Elements output: 2
Execution time: 0.66 seconds
These examples use only text files. Log Parser lets you use SQL statements to analyze scan logs, such as searching entire directories for host banners or ports associated with vulnerabilities. Hosts go up and down, but the log files can still be used months after a scan.
Before using Log Parser, I analyzed logs with Excel spreadsheets and filters. I also used grep on Linux many times. Now I would not want to be without this tool.
Hi Ivan1980, nice post and very handy ;-)