Filtering log records in log view
Adding filters to the Log view lets you view only those log records that meet
criteria you set, so that you can focus on a smaller set of log records. You can
create filters that limit the shown log records according to severity or other
Common Base Event property values.
Log record filters apply to any content shown in the Log view, be it a log
file or a correlation with many logs in it. When you select another item in the
Log Navigator, the content of the Log view will change, but the filter will
remain the same until you apply a different filter.
Note: You can also filter log records as you import a log file.
Filters defined in the Log view would be additional filters on what has been
imported. You cannot use the Log view filters to "undo" filters used during
import; if you want more log records that what the import filter allowed, you
must import the log file again with a less restrictive import filter.
Creating a log record filter
To create a filter:
- Click the drop-down menu arrow next to the Filter button in the
tool bar
.
Select Manage filters.
- In the Edit Filters window, click New.
- Select the Log filter and click OK.
- Provide a Filter name. This name will appear in the filter
drop-down list.
- Optionally, set criteria for severity level by clicking the Show events
by severity check box. Click the Errors, Warnings or
Information check boxes as desired to indicate what types of records to
show in the Log view.
- Click the Advanced tab. The advanced filtering feature lets you set
specific filtering criteria for Common Base Events attributes. The
Advanced filtering table shows all the filter criteria defined, if any. Log records that match one or more of the criteria will
be shown in the Log view.
- To add an entry in the table, click Add. Select the attribute you
want to filter on from the list of Common Base Event attributes. Select
the operator (like performs a pattern match). Enter a value that log
records must have for that attribute in order to be shown:
- Use an asterisk (*) to represent any string.
- Use a bar (|) to represent a non-exclusive "or".
- Time values must be in the ISO format of yyyy-mm-dd hh:mm:ss.sTZD, where:
- yyyy is a four-digit year value
- mm is a two digit month value
- dd is a two digit day value
- hh is a two digit hour value on a 24-hour clock
- mm is a two digit minute value
- ss.s is a two digit seconds value, with optional fractional seconds
after the decimal
- TZD is a time zone designator, either an 6-character time relative to
Coordinated Universal Time (UTC) such as +05:00 or -07:00; or a time zone
abbreviation such as EST or GMT. See
http://www.w3.org/TR/NOTE-datetime for information about the format, and
http://www.timeanddate.com/library/abbreviations/timezones/ for a
listing of time zone abbreviations.
Click OK.
- To edit an existing entry, select it, click Edit and modify the
fields.
- To remove an entry, select it and click Remove.
- Select group expression combo box to group entries in table by AND or OR condition. Default selection is AND condition.
- Click OK. The filter will be created, and applied against the
content of the Log view.
Tip: In the Log view, in the Log Records pane, if you right-click on
a log record and select Copy to Clipboard, the message (msg) property
of that log record is copied to the clipboard. This is useful for pasting into
filter and symptom database editors.
Applying a log record filter to a log file or
correlation
To apply a filter to a log file or correlation:
- Select the log file or correlation in the Log Navigator so that it is displayed in the
Log view.
- Click the drop-down menu next to the Filter button in the Log view
tool bar
.
- Select the name of the filter you want to apply.
The filter will remove from the view all log records that do not meet the
filter criteria; they are still present, just not shown in the Log view. If you
select another log file or correlation in the Log Navigator, this filter will
still be applied, until you select a different filter from the drop-down list.
Filters applied here also apply to the Log Interactions view and so are
maintained if you switch views.
Editing or deleting a log record filter
To edit or delete a filter:
- Click the drop-down menu next to the Filter button in the Log view
tool bar
.
- Click Manage filters.
- In the Edit Filters window, select the filter you want to edit or delete.
- Click Edit to edit the filter (see the instructions above for
creating a filter), or Delete to delete the filter.
- Click OK.
The Log view contents that were being filtered by the changed or deleted filter will
now display their log records according to the changes (that is, all log records
in the case of a delete).
Filtering log record properties
To customize which log record properties are displayed in the Properties pane
when you select a log record in the Log view:
-
In Log view, click the Filter Properties
button
in the Log view tool bar. The Filter Properties dialog box opens.
-
Select or clear the properties to be displayed.
-
To control their order, use the Up and Down buttons.
-
Click OK.
The list of records is refreshed and will show the properties specified in
the log record properties filter.
Related concepts
Determining problems in distributed
applications using the Log and Trace Analyzer
Related tasks
Working with log files
Sorting log records
Analyzing a log file
Setting preferences for the Log and Trace Analyzer
Correlating log files
Importing a log file
Related reference
Common Base Event format specification
Log view
(C) Copyright IBM Corporation 2000, 2006. All Rights
Reserved.