26. June. 2012 by Urs
Log files contain a lot of information which is often crucial in maintaining your systems high availability or necessary to troubleshoot some problem. Before we put this information to good use we have to find it, which isn’t always the easiest job... Even if we have the best search engine in the world and we precisely define search parameters, it all comes down to how the results are presented to the human using the software as recognising the answers to our questions in rather large log entries can be harder than you think.
Once again, Retrospective with its column splitting features comes to the rescue and it does it in a quick and efficient manner. Taking advantage of column splitting is as easy as 2+2. You either press [Ctrl]+[U] or click the icon to open the Source tab, select desired log file (press and hold [Ctrl] to select more than one log file) and click the [Configure source...] button to open the simple three-step split-strategy wizard.
The first step determines the log entry separation, allowing the user to define either where entries begin or end. The Auto-find button is always there to help you.
The Second step concerns date and time recognition and it supports automatic pattern recognition but also allows to define the date format if needed. Again, Auto-find is there to help.
And last but certainly not least, we have the third step which pretty much is what this post is all about - the column splitting.
We have three options here:
No split, if we decide we don’t need to further split the log entries
Character split, if there is a certain character separating different information within the same log entry
Conversion pattern, where we can provide commonly used denominators
But there is also a simpler solution which hides under the [Auto-find] button. It recognizes the log file’s structure and automatically configures column splitting for a wide range of industry standard logging solutions: log4j (most common cases), Tibco Businessworks, Apache2, Apache Common Format, Apache Tomcat/JBoss, EMS/JMS, Hawk and Agorum. If the Auto-find doesn’t find your unique log4j pattern, then you can manually enter the pattern yourself either using the hints provided by the information button or by copy/pasting the pattern layout from your log4j Config file. The last thing to do is setting the log level column which enables filtering results depending on the severity and clicking the [Finish] button.
Now, whenever you search the particular log file you will have the results nicely split into columns for much clearer presentation. Didn’t I tell you it would be easy!