7.4 Manual Analysis
You can open a binary event log file and request that the events be translated and analyzed. This activity is known as manual analysis. Unlike automatic analysis, manual analysis relies on the time stamp information included with each event to determine when an event occurred.
Manual analysis can be performed from all the interfaces. See the following chapters for information on manual analysis:
Regardless of the platform where it is installed, SEA can read and analyze binary event logs produced by any of the supported operating systems.
7.4.1 Resource Usage During Analysis
Whenever SEA starts, and when you run manual analysis, the program appears to use a lot of system resources and processor cycles. However, SEA uses only the capacity that is not being asked for by other programs.
SEA always relinquishes processor cycles to other programs whenever they need them. In other words, the program uses whatever resources are available.
At startup SEA needs the available capacity for the scavenge process. Depending on the system, and the size and content of the log, the initial startup pass can take many minutes or even hours to complete. After completing the scavenge process, SEA drops into idle mode, where resource usage hovers at only a few percent.
If you run SEA in manual mode, large amounts of system resources and processor cycles also might get used. As in the case of startup in automatic mode, the condition is directly related to the size and content of the log being processed. Once again by design, SEA uses as many resources as are available until processing is completed.
You can speed processing by managing the system error log so that it does not grow indefinitely. One way to accomplish this is to periodically archive and reset the current error log by following the guidelines in the WEBES Installation Guide. When you are using manual analysis, it may be beneficial to filter large log files in order to improve processing times.