While researching a mail server blacklisting issue for a client – I found myself struggling with the amount of info strewn about inside an exchange smtp log file. I turned to the web to locate something that would be more amenable to slicing and dicing the info to get a clearer picture of the problem. I’d come across Sawmill for another task but noted that it was up for reading the logs in the format Microsoft produce.
The product is presented as a web server – into which you import the log file and then you use the interface to flip the data around – based on the fields of data it holds to get a view that allows you to see the data you are after. In this case the ability to filter the time period of interest was the most useful.
As a tool its not exactly the most interesting but as anyone who wades through this kind of information on a regular basis and who has had to resort to developing their own solutions – this is something you should definitely take a look at before spending any time working on log files.