6.5 Processing Log Files
You can process a log file, check its status, and view the results using any of the following methods:
- Selecting System Log or Real Time Monitoring runs automatic analysis on a node.
- Clicking Full View manually analyzes a node's system event log and display the results.
- Clicking a Log File name under Other Logs runs manual analysis on the file and displays the results.
When analysis is successfully started, the log file's icon is animated. Once the file is processed, the icon in the toolbar changes to reflect the status of the log file (see Section 6.5.2) and the results of processing are shown in the display frame.
Both automatic and manual analysis results are shown in the display frame. The information is organized under the following tabs:
- Problem Reports—results of analysis
- Summary—description of the contents of the log file (only available with manual analysis)
- Events—translation of the events contained in the log file
If you have configured the User Settings so SEA only performs manual translation, rather than translation and analysis, the Problem Reports tab is empty. See Section 6.8.1 for more information on User Settings.
If the file cannot be processed for any reason, a message similar to the one in Figure 6–18 is shown.
Figure 6–18 Analysis Failed Message
6.5.1 Additional Toolbar Functions
SEA provides additional functionality depending on the type of processing you are performing.
6.5.2 Processing Status
With large log files, translation and analysis operations are not instantaneous. After you have started processing a log file there are several ways to check the operations progress. You can check the processing status from either the navigation tree or the Progress window.
6.5.2.1 Navigation Tree
You can quickly determine the status of automatic or manual analysis by looking at the icons in the navigation tree. Figure 6–20 shows the icons used to indicate analysis results.
Figure 6–20 Status Icons
When automatic analysis generates a problem report, exclamation points are added to the icons for the node, system log, and real time monitoring. The icon remains changed until problem report details are viewed and the tree is refreshed. If another problem report is generated after the tree is refreshed, exclamation points are added to the icons again.
You also can determine the results of manual analysis on a binary event log file by checking the icons. SEA uses a animated yellow icon when a binary log file is being read and an animated green icon during analysis. If processing has completed and problem reports were generated, an exclamation point is added to the icon. Otherwise a check mark is added to the icon. Unlike the icon changes associated with automatic analysis, the manual analysis icon changes remain visible until you close the web interface session.
If you are only performing translation, when processing completes the icon will appear with a dash. See Section 6.8.1 for more information on configuring the web interface to only perform translation.
6.5.2.2 Progress Window
You can open the Progress window by clicking on the Progress Window button in the toolbar (see Figure 6–3).
The Progress window opens in a new browser window (Figure 6–21).
Figure 6–21 Progress Window
The Progress window provides statistics for all the log files that are currently being analyzed by SEA, including one automatic analysis job and multiple manual analysis jobs. The information in the Progress window includes:
- The node where the log file is located
- The name and location of the log file
- The number of events in the file
The position of each file in the queue is displayed, and information is dynamically updated as the processing changes. When a file finishes processing, it is removed from the window.
When monitoring the progress of a file, you can refresh the display manually by clicking the refresh icon in the upper left hand corner. To stop processing an active file, click on the Stop icon.
6.5.3 Working With Results
After processing, the results of analysis are shown on the tabs in the display frame (Figure 6–22).
Figure 6–22 Additional Entries NavigationWhen there are many entries, you can use the navigation options to page through the results.
- Use the Previous and Next buttons to move between entry screens.
- Enter a number in the entry field and click Go to display a specific entry.
You can control the number of entries shown in a tab with the options in the User Settings window. See Section 6.8.1 for more details.
6.5.3.1 Problem Reports
The Problem Reports tab displays a list of the reports that were generated by analysis. An example of the problem report list is shown in Figure 6–23.
Figure 6–23 Problem Report TabThe filters used when generating the problem reports are listed at the top of the screen. However, the display only shows the filters that apply to problem reports and may not list all the filters you selected.
When working with problem reports, these options are available:
- To sort the entries in the report list select the column headers. See Section 6.5.3.4 for more details on sorting.
- To view the contents of a report, click on its entry in the list of available problem reports. See Section 6.5.3.5 for information on viewing reports.
The problem reports generated by the web interface are the same as those generated by the CLI.
6.5.3.2 Summary
The Summary tab is only available when you perform manual analysis. If you select Real Time Monitoring from the Navigation Tree, for example, the Summary tab is not displayed.
When performing manual analysis, the Summary tab describes the event types contained in the binary event log file (Figure 6–24).
Figure 6–24 Summary TabEach event type is listed along with the number of occurrences. The time stamps for the first and last events are listed under the summary information.
The filters that were applied are listed at the top of the screen. Be aware that the screen only shows the filters that apply to the summary report and may not list all the filters you selected.
See Section 7.8 for details on the summary information presented.
6.5.3.3 Events
The Events tab shows a list of the events contained in the binary event log file. Depending on the filtering options that were applied during processing, all the events in the log file may or may not be shown (Figure 6–25).
You can control the fields that are shown on the events tab from the User Settings window. See Section 6.8.1 for more details.
Figure 6–25 Events TabThe filters that affected the output are listed at the top of the screen. Be aware that the screen only shows the filters that apply to events and may not list all the filters you applied.
When working with events, these options are available:
- To sort the events list, use the column headers. See Section 6.5.3.4 for more details on sorting.
- To view the translation of an event, click on its entry in the list. See Section 6.5.3.5 for information on viewing translation details.
The translated events shown by the web interface are the same as those shown by the CLI.
- See Chapter 7 for more information on event translation
- See Appendix A for an example of a translated event.
6.5.3.4 Sorting Results
You can sort the results of analysis using either the column headings on the tabs in the display frame, or by using a filter.
- Sorting with the column headings only impacts the entries currently shown. Therefore, if there are too many entries to be listed on a tab, the column headings will only sort the entries that are displayed rather than all the output produced by processing the log file. In most cases, this limitation only impacts the Events tab.
- You can sort the results shown on any tab using the field names that appear in blue (i.e., as hypertext links). Simply click on the field name to sort based on that field. An arrow appears next to the field to indicate the direction of the sorting. The sorting options are applied to all the tabs, regardless of which tab was used to specify the sorting criteria.
- Entries can be sorted in either ascending or descending order. To change the sort order, click on the field name a second time. The arrow next to the field changes direction to indicate the new sort order. When the arrow is pointing up, it indicates an ascending sort. When the arrow is pointing down, it indicates a descending sort.
- If you are working in multiple windows, sorting only applies to the current window.
- Using a filter to sort entries impacts all the output generated by processing a log file, regardless of how many screens are required to show all the entries.
- For more information on using a filter to sort output, see the information on applying filters in Section 6.7.
6.5.3.5 Displaying Details
The Problem Reports tab lists the reports generated by analysis and the Events tab lists the events in the binary log. You can view the details of a problem report or the translated text of an event by clicking on an entry in the list. Depending on the User Settings selected (see Section 6.8.1), the details will either be shown in the display window or in a new browser window.
In order to make viewing details easier, navigation buttons are available at the top of each detailed entry. The navigation buttons for the Problem Reports tab and Events Tab are shown in Figures 6–26 and 6–27.
Figure 6–26 Navigation Buttons—Problem Reports
Figure 6–27 Navigation Buttons—Events
The buttons are used to move between entries in the list.
- When paging between entries, the column heading sort order always reverts back to the Index column in ascending order. Filter sorts, however, still apply.
- If you select "Put Event Details In A New Window" in your User Settings, the Index button is not available. Clicking the Previous and Next buttons displays all entries in the new window. See Section 6.8.1 for more information on user settings.
- The Event Details tab includes a drop down list that can be used to change the report type. See Chapter 7 for more information on translation report types.