TABLE OF CONTENTS Complex data, as discussed here, is data that is interwoven. It is not cleanly presented as a single field, but buried within a single field with no clean delimiters, or spread across many fields or even files. To obtain the information it holds, the weavings must be undone and inspected. The intent of this chapter is to explain how Log Parser can unravel and inspect the complex data for you, making it more comprehensible.
Some good examples of embedded data include the event logs from a Windows system. These next queries will use some of the entries for Microsoft s Exchange Server from their Small Business Server 2003. The specific entries sought are those related to the maintenance tasks for permanent removal of deleted items. If you are not familiar with administering a Microsoft Windows Exchange Server, here is a bit of background information that will help the example make more sense. An Exchange Server is often configured for its mail users to store their messages on the server rather than a local hard drive and, if enabled, also provides a second chance to undelete messages even after they have been emptied from your Outlook Deleted Items folder. This Exchange Server is set up to give its users two days to recover deleted mail messages after which the deleted messages are purged from the server as part of the Exchange Server s regular maintenance. To keep track of how many messages and how much space in the...
