C#, ICF Firewall, and Microsoft Log Parser

C#, ICF Firewall, and Microsoft Log Parser

C#, ICF Firewall, and Microsoft Log Parser
The Microsoft Log Parser is a very cool tool for mining data contained in your text based log files (CSV, XML, etc). Log Parser allows you to use SQL syntax to query and filter the contents of log files in many different formats, including the IIS logs. It will even create chart graphics and HTML reports based on your queries. Log Parser provides a command line executable as well as a set of COM objects for programmatic access. For more information and download link, see the Log Parser site over at microsoft.com:
http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx
I decided to try and create a simple tool based on the Log Parser in WinForms/C# using Visual Studio.NET 2003. The Internet Connection Firewall (ICF) ships with Windows XP and Windows Server 2003 (http://www.microsoft.com/technet/prodtechnol/winxppro/plan/icf.mspx). ICF can be configured to create a log file containing details of TCP/IP traffic on your system, including dropped packets. The log file, named pfirewall.log by default, can be useful if you want to see who is attempting to connect to your system or if you are trying to diagnose network connectivity issues. The ICF log file conforms to the W3C format standards, so Log Parser will be able to process it. I was able to quickly create a simple .NET app that used Log Parser to view in real time all TCP and UDP traffic logged on my system by ICF. I simply added a reference to the COM component named "MS Utility 1.0 Type Library - LogParser Interfaces Collection" and my interop DLL was created automagically by VS.NET. I used the .NET framework FileSystemWatcher class to monitor changes in file size to pfirewall.log and re-query the log file for fresh events. Since ICF only logs IP addresses, I added background processing using ThreadPool to resolve IP addresses to host names.
The Visual Studio.NET 2003 project, C# sample code and executable are available for download. Do not forget to get Log Parser and install it first, as it does not ship with Windows.
This little demo app barely scratches the surface of what you can do with Log Parser using C#/.NET.