Filtering records in Log Interactions view
Adding filters to the Log Interactions view lets you view only those log records that meet
criteria you set, so that you can focus on a smaller set of log records. You can
create filters that limit the shown log records according to severity or other
Common Base Event property values.
Log record filters apply to any content shown in the Log Interactions view,
be it a log file or a correlation with many logs in it. When you select another
item in the Log Navigator, the content of the Log Interactions view will change,
but the filter will remain the same until you apply a different filter.
Note: You can also filter log records as you import a log file.
Filters defined in the Log Interactions view would be additional filters on what has been
imported. You cannot use the Log Interactions view filters to "undo" filters used during
import; if you want more log records that what the import filter allowed, you
must import the log file again with a less restrictive import filter.
Hint: By default, Log Interactions and Log Thread Interactions views show only log records with correlations.
For log files that do not contain any correlations, the interactions views will
be empty. To show all records in these views, clear
the Show correlated log records only check box in the Manage Filters
dialog.
Creating a log record filter
To create a filter:
- Click the drop-down menu arrow next to the Filter button in the
tool bar
.
Select Manage filters.
- In the Edit Filters window, click New.
- Provide a Filter name. This name will appear in the filter
drop-down list.
- Optionally, set criteria for severity level by clicking the Show events
by severity check box. Click the Errors, Warnings or
Information check boxes as desired to indicate what types of records to
show in the Log Interactions view.
- Optionally, enable the Show correlated log records only check box.
With this check box selected, only log records that have correlations (either
internally within the log file, or with records in other log files in a
correlation) will be shown in the Log Interactions view.
- Click the Advanced tab. The advanced filtering feature lets you set
specific filtering criteria for primary Common Base Events attributes. The
Advanced filtering table shows all the filter criteria defined, if any. Log records that match one or more of the criteria will
be shown in the Log Interactions view.
- To add an entry in the table, click Add. Select the attribute you
want to filter on from the list of primary Common Base Event attributes. Select
the operator (like performs a pattern match). Enter a value that log
records must have for that attribute in order to be shown:
- Use an asterisk (*) to represent any string.
- Use a bar (|) to represent a non-exclusive "or".
- Time values must be in the ISO format of yyyy-mm-dd hh:mm:ss.sTZD, where:
- yyyy is a four-digit year value
- mm is a two digit month value
- dd is a two digit day value
- hh is a two digit hour value on a 24-hour clock
- mm is a two digit minute value
- ss.s is a two digit seconds value, with optional fractional seconds
after the decimal
- TZD is a time zone designator, either an 6-character time relative to
Coordinated Universal Time (UTC) such as +05:00 or -07:00; or a time zone
abbreviation such as EST or GMT. See
http://www.w3.org/TR/NOTE-datetime for information about the format, and
http://www.timeanddate.com/library/abbreviations/timezones/ for a
listing of time zone abbreviations.
Click OK.
- To edit an existing entry, select it, click Edit and modify the
fields.
- To remove an entry, select it and click Remove.
- Click OK. The filter will be created, and applied against the
content of the Log Interactions view.
Tip: In the Log Interactions view, in the Log Records pane, if you right-click on
a log record and select Copy to Clipboard, the message (msg) property
of that log record is copied to the clipboard. This is useful for pasting into
filter and symptom database editors.
Applying a log record filter to a log file or
correlation
To apply a filter to a log file or correlation:
- Select the log file or correlation in the Log Navigator so that it is displayed in the
Log Interactions view.
- Click the drop-down menu next to the Filter button in the Log
Interactions view
tool bar
.
- Select the name of the filter you want to apply.
The filter will remove from the view all log records that do not meet the
filter criteria; they are still present, just not shown in the Log Interactions
view. If you select another log file or correlation in the Log Navigator, this
filter will still be applied, until you select a different filter from the
drop-down list.
Filters applied here also apply to the Log view and so are maintained if you
switch views.
Editing or deleting a log record filter
To edit or delete a filter:
- Click the drop-down menu next to the Filter button in the Log
Interactions view
tool bar
.
- Click Manage filters.
- In the Edit Filters window, select the filter you want to edit or delete.
- Click Edit to edit the filter (see the instructions above for
creating a filter), or Delete to delete the filter.
- Click OK.
The Log Interactions view contents that were being filtered by the changed or deleted filter will
now display their log records according to the changes (that is, all log records
in the case of a delete).
Related concepts
Determining problems in distributed
applications using the Log and Trace Analyzer
Related tasks
Working with log files
Analyzing a log file
Setting logging preferences
Correlating log files
Related reference
Log view
Common Base Event format specification
(C) Copyright IBM Corporation 2000, 2006. All Rights
Reserved.