Analyzing messages from application server logs

You can use the add-on Log Analysis Tool to analyze log messages from any number of TrueSight Server Automation Application Servers. The Log Analysis Tool enables you to

View log messages from multiple log files that originate from multiple Application Servers, and control the display by sorting or filtering.
View a graphical presentation of memory usage statistics over time, based on log messages that contain information about the usage of various types of memory.
Search through the list of log messages for messages that contain a certain textual string.
Extract information from the display of messages by copying messages to the clipboard.
Export all displayed messages to a new, merged log file.

This page contains the following sections:

Before you begin

Obtain the latest version of the Log Analysis Tool from BMC Communities, and unzip it locally. Note that a JRE is included with the Log Analysis tool.

To prepare log files for display through the Log Analysis Tool

Copy the various Application Server log files that you want to display through the Log Analysis Tool into one directory.
For more information about Application Server logs, where to find them and how to control them, see Overview of TrueSight Server Automation log files and Controlling Application Server logging.

(Optional) If you plan to display logs from multiple Application Servers, you can modify the names of individual log files to include the following additional information:

Added element	Description	Instructions
Application Server or host name	Identification of the Application Server that generated the log messages.	Add a double underscore to the original log file name, followed by the name of the Application Server or host. For example: appserver__server1.log
Time skew	Number of milliseconds to add to the timestamps of messages from this log. This time skew enables you to adjust the time from this Application Server relative to some other Application Server, so that the messages from the various Application Servers are displayed in the correct chronological order.	Add another double underscore to the log file name, followed by the number of milliseconds. For example: appserver__server1__300.log appserver____300.log

To analyze logs through the Log Analysis Tool

To launch the Log Analysis Tool, run the logtool.bat or logtool.sh file.
To select log files for display, select File > Open. Then browse to the directory in which you prepared your log files and select any number of log files.
Note

The Log Analysis Tool support log files from TrueSight Server Automation version 8.0 or later.

The log messages from all selected log files are parsed and displayed in a table. This table includes (by default) the following columns:
- Timestamp
- Thread
- Log level
- Session info
- Action type
- Message
- Application Server
  (populated only if you included the name of the Application Server in the log file name, as described inTo prepare log files for display through the Log Analysis Tool)
To change the display of messages, perform any of the following actions:
- To hide a specific column, select Tools > Column Visibility and then clear the selection of the specific column.
  To display a hidden column, repeat this selection step.
- To sort the messages by any specific column, click the column header. Click once for ascending order, click once more for descending order.
- To filter the messages based on column values:
  1. Select Tools > Row Filtering.
  2. In the Legal Value Filtering dialog box, expand any column branch to display its legal values.
  3. Deselect the values that you do not want included in the list of messages, or select the values that you do want included in the list of messages.
  4. Repeat the previous step to deselect or select other values under any other column branches.
    If you want to select or deselect a whole branch, first collapse the branch and then select or deselect it.
  5. To filter based on timestamp, select the Enable Timestamp Filter check box and specify a time range.
- To switch from multiple columns to a single column (that contains the information from all columns), select Tools > Table Display > Single Column.
  To switch back to multiple columns, select Tools > Table Display > Multiple Column.
To view a graphical presentation of memory usage statistics over time, based on log messages that contain information about the usage of various types of memory:
1. Select Tools > Memory Graph Enabled.
2. Click the Memory Information tab.
Note

For more information about the display of memory usage statistics in the log, see Reviewing the Application Server log file for diagnostic information.
To find messages that contain a specific string:
1. Select Edit > Find.
2. Enter the string to search for.
3. Optionally select the columns in which to search.
4. Click Find.
To extract information from the display of messages, perform any of the following actions:
- To copy log messages to the clipboard, select any number of rows (or select Edit > Select All), and then select Edit > Copy.
- To export the current display of log messages to a new text file, select File > Export Current View. Then specify a name for the new file (optionally including an extension such as .log or .txt), and click Save.
  This export action is especially useful if you want to merge the contents of multiple log files into a single log file.

Frequently Asked Questions (FAQ)

Use the following FAQ to troubleshoot problems in the use of the Log Analysis Tool.

Appserver column does not contain any data

The values displayed in the Appserver column are extracted from the name of the log file, as described in To prepare log files for display through the Log Analysis Tool. Modify the names of the relevant log files and then open the log files again in the Log Analysis Tool.

Out of memory error when opening multiple log files

If you receive an out of memory error when you try to open multiple (typically 5 or more) log files, you can increase the heap size. To increase the heap size, open the logtool.sh or logtool.bat file and change the value of Xmx to a larger number. For example, -Xmx1024m changes the maximum heap size to 1 gigabyte.

After changing the heap size, restart the Log Analysis Tool.

Memory information not displayed

To view a graphical presentation of memory usage statistics extracted from log messages on the Memory Information tab, you must first enable the memory graph. Select Tools > Memory Graph Enabled and only then click the Memory Information tab.

Selection of whole branches for filtering

To select or deselect a whole branch of column values in the Legal Value Filtering dialog box (described in filtering instructions), first collapse the branch and then select or deselect it.