System Log Parser - How does it work?

Question

Hi there,

Does anybody know any information to read about ArcGIS Server logs and how System Log Parser manipulate these to generate the statistics, etc?

Our company use an observability platform where the server logs are already ingested, and it has a query language to create statistics and dashboard capabilities from this data, etc.

Instead of using another tool, etc. how does System Log Parser group the data together for its calculations.

Any help in the area would be greatly appreciated (eg. group by request id, look at certain codes, find min/max datetime per request, etc) Thanks

George Thompson · Answer

Thanks for the reply, unfortunately I do not have that level of experience or information with parsing out the logs.

Hopefully someone else may be able to chime in.

AnthonyRyanEQL · Answer

George,

I'm looking for detailed information relating to how the log entries are grouped together for analysis, etc.

We use Dynatrace as our observability platform and the logs are being ingested in their raw form. I need to analyse the logs in a similar way to the System Log Parser (eg. what logic is used in log parser to group the entries, what text is extracted from the XML to know which service the entry relates to, etc)

This is the detailed info I need.

Thanks

Here is an example from our map server site for a service

Level Time Message Source Machine Code Time Elapsed User Name Process Thread Method Name Request ID
INFO Mar. 31, 2026, 2:13:10 pm Request for the service 'BYDA/BYDA.MapServer' processed successfully. Response sent to the user '0123456789ABCDEF::integration.dynatrace'. Soap SAWSWGM01.SERVICES.LOCAL 9526 6484 19 14295a98-536f-4e1c-b97b-d545ad602077
FINE Mar. 31, 2026, 2:13:10 pm Binary request successfully processed. Response size is 24541 bytes. BYDA/BYDA.MapServer SAWSWGM01.SERVICES.LOCAL 100004 0.84820 0123456789ABCDEF::integration.dynatrace 45820 51264 WMSServer.get_Data 14295a98-536f-4e1c-b97b-d545ad602077
FINE Mar. 31, 2026, 2:13:09 pm String request received. Request size is 72 characters. BYDA/BYDA.MapServer SAWSWGM01.SERVICES.LOCAL 100001 0123456789ABCDEF::integration.dynatrace 45820 51264 WMSServer.get_Data 14295a98-536f-4e1c-b97b-d545ad602077
FINE Mar. 31, 2026, 2:13:09 pm String request successfully processed. Response size is 72 characters. BYDA/BYDA.MapServer SAWSWGM01.SERVICES.LOCAL 100002 0.00010 0123456789ABCDEF::integration.dynatrace 45820 51264 WMSServer.GetToPost 14295a98-536f-4e1c-b97b-d545ad602077
FINE Mar. 31, 2026, 2:13:09 pm String request received. Request size is 49 characters. BYDA/BYDA.MapServer SAWSWGM01.SERVICES.LOCAL 100001 0123456789ABCDEF::integration.dynatrace 45820 51264 WMSServer.GetToPost 14295a98-536f-4e1c-b97b-d545ad602077
FINE Mar. 31, 2026, 2:13:09 pm Wait time for 'BYDA.BYDA.MapServer' service request is 0 milliseconds. Server SAWSWGM01.SERVICES.LOCAL 7615 6484 31 14295a98-536f-4e1c-b97b-d545ad602077
INFO Mar. 31, 2026, 2:13:09 pm Request received from the user '0123456789ABCDEF::integration.dynatrace' for the service 'BYDA/BYDA.MapServer'. Soap SAWSWGM01.SERVICES.LOCAL 9502 0123456789ABCDEF::integration.dynatrace 6484 19 14295a98-536f-4e1c-b97b-d545ad602077

I used the 'Request ID' to group the log entries. Is that correct?

Do I filter 'Level' first or at all? eg. just only 'FINE' entries

What to filter next if anything? eg. Code=7615 Is this what I use to determine if any user needed to wait for the service to become free? Where are the list of codes and there meaning?

Do you extract the service name from the message or do you filter the codes to a certain value grouped by request id to determine the name of the service as the 'Source' is set to 'Server'

George Thompson · Answer

@AaronLopez did a blog on this topic, https://community.esri.com/t5/implementing-arcgis-blog/arcgis-enterprise-analysis-with-system-log-parser/ba-p/1413851

Here is another post that may be relevant: https://community.esri.com/t5/arcgis-enterprise-questions/help-understanding-system-log-parser-output/td-p/1185052

Here is a blog space that has other similar topics: https://community.esri.com/t5/implementing-arcgis-blog/bg-p/implementing-arcgis-blog

Hope this helps!