Log Parser 2.2 is used by IIS, Platforms and Exchange engineers, but the cool thing about Log Parser 2.2 is the fact it’s not related to a specific product/technology. In this post, I'll give an example about how to extract information from text files, in this case .MIF files, since a lot of customers need to do this on a day to day basis.

This could be accomplished by using FINDSTR as well, but again, I’ll focus on Log Parser 2.2 here.

All that said, here is the common scenario:

• Customer wants to extract NETBIOS names from the .MIF files (BADMIF folder) to better understand issues they may have with the SCCM clients trying to forward hardware inventory information to the SCCM site server.

This is a common scenario, sometimes we have an unique machine sending lots of HINV deltas to the SCCM site server, but not getting processed for some reason.

You may end up having an unique machine or maybe only a few machines with more than hundreds BADMIFs, and the number of files can be huge.

Let’s go through this three step process:

1. Download Log Parser 2.2 from https://www.microsoft.com/en-us/download/details.aspx?id=24659 and install it;
2. Open CMD as Administrator and navigate to Log Parser 2.2 installation path which by default is: C:\Program Files (x86)\Log Parser 2.2
3. Here is the query that we need to run:
   1. LogParser.exe -o:CSV "select replace_chr(extract_token(Text,1,'><'),'>','') into BadMif_Computer_Name.csv from D:\SMS\Inboxes\auth\dataldr.box\BadMifs\*.mif where text like '//KeyAttribute<NetBIOS Name>%'" -q -headers:off

What the Log parser query does:

• Basically it scans for all .MIF files under a specific directory, on this case "D:\SMS\Inboxes\auth\dataldr.box\BadMifs\", and it extracts the NETBIOS names from it.

Let’s break down this Log Parser query:

• –o: It means how the output looks like, we have more options here, such as, XML, TEXTLINE, DATAGRID and so on;
• Into *.csv file: This is going to generate the .CSV file under Log Parser installation path which again, by default is C:\Program Files (x86)\Log Parser 2.2;
• replace_chr: Replaces each occurrence of a character in a given set of characters with a string;
• extract_token(Text,1,'><'),'>',''): Splits the string into substrings at each point where the separator occurs, and returns the substring with the specified index. Here is where I remove all the unneeded characters from my string (//KeyAttribute<NetBIOS Name>%), since I’m only interested on the NETBIOS name itself;
• from D:\SMS\Inboxes\auth\dataldr.box\BadMifs\*.mif: This is just the path I’m using for extracting the information, you can change it for the path where your BADMIFs are located in your environment (this could be wherever location you have your .MIF files);
• where text like '//KeyAttribute<NetBIOS Name>%': This is exactly the string I’m looking to manipulate, since it is where the NETBIOS name is located under the MIF files, you can also use wildcards here;
• -q: This for quiet mode;
• -headers:off: I used this to remove the header information, as I’m using replace_chr and extract token parameters. If you don’t use this parameter, you will be able to see the header information as soon as the query runs and creates the .CSV file, which I prefer removing it.

We could simplify this query by running like this: LogParser.exe -o:CSV "select * into BadMif_Computer_Name.csv from D:\SMS\Inboxes\auth\dataldr.box\BadMifs\*.mif where text like '//KeyAttribute<NetBIOS Name>%'" but the problem is, we still need to spend some time by using a text editor such as PSPAD or others to remove those unneeded characters until we have what really matters, in this case, the NETBIOS name.

This is only one example of using Log Parser 2.2 with SCCM, we could use it in different scenarios, for example when we need to extract some specific information from SCCM component logs, DDRs, CCRs, etc… we have a lot of possibilities here!

I hope this helps!

Andre Della Monica
ConfigMgr Senior Premier Field Engineer – U.S Central Region

Scenario: You need to upgrade a ConfigMgr 2007 Distribution Point to ConfigMgr 2012 Distribution Point and the goal is to avoid redistributing content throughout the network.

That said, our focus on this post is to talk about this specific "behind the scenes process", the main idea here is to provide additional information for those who need to troubleshoot this process. 

Here is what happens when you click on "Reassign Distribution Point" on ConfigMgr 2012 R2:

1.       Deletes DP role in the source site
2.       Deletes site system record in the source site
3.       Deletes shared DP role in the destination site
4.       Deletes shared DP site system record in the destination site
5.       Installs a new site system in the destination site
6.       Installs a new DP role in the destination site
7.       Runs a store procedure "sp_MIG_UpgradeDistributionPoint" to fix NALPath to point to new Distribution Point (created in the step 6) in the following Distribution Point related tables:

• PkgServers
• PkgStatus
• ContentDPMap
• DPUpgradeStatus

This is important so all packages prior to DP upgrade can continue to work with new DP without redistributing the content again.

8.       Drop a notification (.dpu file with the DP ID number under of distmgr.box) that wakes Distribution Manager to convert the old SMSPkg folder to new content library. You can see the process through the distmgr.log on site server side and the smsdpprov.log on the DP side. As soon as the Distribution Manager component gets the DP upgrade notification, it does the following:

•  It goes through each migrated package on that Distribution Point, it gets the Distribution Point package location on the DP for this package from the ContentDPMap table for each such package.
•  It connects to this DP and imports all the package files to the SIS (Single Instance Store) Content Library in the upgraded DP.
•  Once all the files have been successfully copied to the Content Library, it removes the package files from the DP package location, depending upon whether or not the package is marked to copy content to the package share (This is enabled to migrated packages if there is an associated advertisement which requires package to be run directly from Distribution Point).

9.       When the conversion is done, Distribution Manager marks the "Distribution Point upgrade job" to completed, with the ContentLib folder containing three folders:

• DataLib
• FileLib
• PkgLib

Troubleshooting Tip:

If you cannot see all three folders above, you have an issue. Review the logs: distmgr.log on the site server side and smsdpprov.log on the Distribution Point side to more information.

I've seen a common error and you may see that too: "Failed to convert content". If you open the distmgr.log you'll be able to see a WMI error as well which it is not the issue.

The solution here is straight forward, you just need to follow few steps:

1. Run the following query against your site server by using SQL Management Studio:

• Select * from DistributionPoints where ServerName = '<DP Server name>'

2. Get the DP ID number, then create an empty .dpu file, in my lab as my DP is ID 4, the file was: 4.dpu

3. Drop this file in \distmgr.box, wait few seconds

You're basically enforcing the content conversion process, so you're be able to see your DP upgraded/migrated through the console with the status Completed reassign Distribution Point.

Final considerations here, I do recommend you to enable SQL tracing and verbose logging to see further information through the distmgr.log, in case you want to go deep in this process, it's really good stuff.

Special thanks to ConfigMgr Product Team for helping me out with the details on this process.

Hope this help!

Cheers,

Andre Della Monica

SMS/SCCM Senior Premier Field Engineer

The hardware inventory files don't go directly to the site server, there are other components (actually a bunch of them) working behind the scenes until the client creates the .XML with the hardware inventory information (which is also hidden on the client side by default) and sent to the Management Point that converts it to a .MIF file which gets processed by Data Loader component on the site server. We know that each client requires approximately 3 MB of space in the database but that will depends on the number of HINV customizations you have in your environment.

There is an known trick for SMS 2003/SCCM 2007 to gather the Full/Delta HINV file size that it can be applied in the client side, which is still applicable to ConfigMgr 2012:

1. To save off inventory reports in a client that is not a Management Point, create the following folder:

      %systemroot%\windows\ccm\inventory\temp\archive_reports.sms

2. To save off inventory reports in a client that is not an Management Point, create the following folder:

     <x>:\sms_ccm\inventory\temp\archive_reports.sms

The hardware inventory XML file is saved in the inventory\temp folder, which means a copy is archived before sending it to the Management Point itself. After going through the process of archiving the XML file, you just need to see the file size (I'd recommend doing this for a few clients) then you will have the HINV file size baseline by calculating the file size X number of clients in your environment.

Also you can open the .XML file, to see the information gathered from the WMI by viewing it with notepad or other .xml viewer.
This is really useful when is necessary to troubleshoot HINV, and also to check if the client is sending other information such as:

      1. Software Inventory
      2. Discovery Data (Heartbeat)
      3. Software Metering usage reports

The folder: "archive_reports.sms" can be deleted after you gather the HINV sizing information.

I hope this helps!

Cheers,

Andre Della Monica (SMS/SCCM Senior Premier Field Engineer)

Let's organize the build/versions available to ConfigMgr 2012 so far. (I'm not going to show how you could get it, assuming you know it already):

• ConfigMgr 2012 RTM - 5.00.7711.0000
• ConfigMgr 2012 RTM CU1 - 5.00.7711.0200
• ConfigMgr 2012 RTM CU2 - 5.00.7711.0301
• ConfigMgr 2012 SP1 - 5.00.7804.1000
• ConfigMgr 2012 SP1 CU1 - 5.00.7804.1202
• ConfigMgr 2012 SP1 CU2 - 5.00.7804.1300
• ConfigMgr 2012 SP1 CU3 - 5.00.7804.1400
• ConfigMgr 2012 R2 - 5.00.7958.1000

I hope this helps,

Andre Della Monica

SMS/ConfigMgr U.S Central Senior Premier Field Engineer