Geeks With Blogs
Michel Klomp Monitoring and Scripting

Here is a small vbscript that uses logparser to get the most used ISA rules. This can be useful if you have multiple allow or deny rules and the order of this rules is not important. In this situation you want to place the most used rule on top.


There are some requirements for this script. You need to install logparser on a client or server. And you need to use the w3c logfile format on ISA server.



Set objLogParser = CreateObject("MSUtil.LogQuery")

Set objInputFormat = CreateObject("MSUtil.LogQuery.W3CInputFormat")


strQuery = "SELECT DISTINCT rule, count(rule) as Hits FROM '"

strQuery = strQuery & "\\stisa01\D$\log\isa\ISALOG_20061219_WEB_000.w3c"

strQuery = strQuery & "' GROUP BY rule ORDER BY Hits DESC"


Set objRecordSet = objLogParser.Execute(strQuery, objInputFormat)

Do While Not objRecordSet.AtEnd

          Set objRecord = objRecordSet.GetRecord

         WScript.echo objRecord.GetValue("rule") & vbTab & objRecord.GetValue("Hits")



Posted on Thursday, February 15, 2007 8:49 PM | Back to top

Comments on this post: Get the most used ISA rules

No comments posted yet.
Your comment:
 (will show your gravatar)

Copyright © Michel Klomp | Powered by: