Hi Jim, Thanks for the pointers. Bill -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Saturday, December 03, 2005 10:02 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: ISA Server Logging http://www.ISAserver.org Correction to the usage text: <!-- You must call this script with two cmd-line params; database name and save path EX: cscript bcp.wsf /db:ISALOG_20051203_FWS_000 /path:<savepath> --> -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Saturday, December 03, 2005 7:00 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: ISA Server Logging http://www.ISAserver.org Yes, you can. All current databases are active, even if they're not "today's" files. In order to copy or move them, you have to use T-SQL or script SQLDMO. I've pasted a scriptlet that I use for this purpose. It exports the specified db to a tab-delimited text file that you can use to import into your analysis QL or run logparser against. If you don't like jscript or wsf, then I'm sure Joseph, Tim or some more T-SQL-literate soul would have a suggestion. --------- start of script - save as "dbcopy.wsf" ---------------- <?xml version="1.0"?> <package> <!-- You must call this script with two cmd-line params; database name and log type EX: cscript bcp.wsf /db:ISALOG_20051203_FWS_000 /path:<savepath> --> <job id="BCP"> <object id="oSqlServer" progid="SQLDMO.SQLServer"/> <reference object="SQLDMO.SQLServer"/> <object id="oBulkCopy" progid="SQLDMO.BulkCopy"/> <reference object="SQLDMO.BulkCopy"/> <script language="JScript"> <![CDATA[ var szDbName = WScript.Arguments.Named( "db" ); var szSavePath = WScript.Arguments.Named( "path" ) + "\\"; var szLogType = "FireWallLog"; if( szDbName.match( /web/i ) ) { szLogType = "WebProxyLog"; } oSqlServer.EnableBcp = true; oSqlServer.LoginSecure = true; oSqlServer.Connect( "(local)\\msfw" ); oSqlServer.EnableBcp = true; var oDb = oSqlServer.Databases( szDbName ); var oTable = oDb.Tables( szLogType ); oBulkCopy.DataFileType = SQLDMODataFile_TabDelimitedChar; oBulkCopy.UseBulkCopyOption = true; oBulkCopy.UseExistingConnection = true; oBulkCopy.DataFilePath = szSavePath + szDbName + ".bcp"; var iRtn = oTable.ExportData( oBulkCopy ); WScript.Echo( "Exported " + iRtn + " rows from " + szDbName + "." + szLogType + " to " + oBulkCopy.DataFilePath ); ]]> </script> </job> </package> ----------------- end of script ------------------------------ You'll either get a success msg or a complete script failure. There is no real error handling here, so if the script fails, it'll do so with gusto. -----Original Message----- From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx] Sent: Friday, December 02, 2005 5:48 AM To: [ISAserver.org Discussion List] Subject: [isalist] RE: ISA Server Logging http://www.ISAserver.org Hi Jim, Can you connect to in on Box? Actually ISA creates a new database file every day. Can the old ones be copied to another server and mounted on another instance of sql? They previous .mdf & .ldf files seem to be locked by ISA even though they are not currently the active files. Thanks Bill -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Thursday, December 01, 2005 4:56 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: ISA Server Logging http://www.ISAserver.org ISA includes MSDE. You cannot connect to the ISA instance from off-box - by design. ------------------------------------------------------- Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ------------------------------------------------------- -----Original Message----- From: William Holmes [mailto:wtholmes@xxxxxxxxxxxxxx] Sent: Thursday, December 01, 2005 12:13 To: [ISAserver.org Discussion List] Subject: [isalist] ISA Server Logging http://www.ISAserver.org Hello, When using MSDE database logging on ISA server: Is there actually a local MSDE SQL server running on the ISA Server or is the ISA server simply writing the data to the MDF/LDF files all on its own. What I am curious about is accessing the MSDE databases via an ODBC connection which is possible to do through MSDE. Thanks Bill ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: wtholmes@xxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Visit TechGenix.com for more information about our other sites: http://www.techgenix.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: wtholmes@xxxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx