Tools to analyze logs.Part2

Let’s go with other tools which are not so common with this product, but which I have found particularly useful.

1.TextAnalysisTool.
You can download it from https://textanalysistool.github.io/

This tool allows the opening of exceptionally large logs (very good for IIS logs, Data Protection Manager, and other large logs).
The best part is that this tool allows filtering/highlighting oh words/sentences in different colors (not just a word/sentence like CMTrace, this one has many colors, which facilitates reading and filtering the data)

And best of all, has a filter based on this highlighted, allowing playing with logs and to see only what we have filtered (GUID application thread, server, …) With CTRL + H, which in these huge logs is great.
What it lacks is the merge of several files, but otherwise this is very useful.

Example:
1. We open one log, such WindowsUpdate.log

2. We may create the filter with right button at the bottom of the white panel.

3. Select the color you want to highlight

4. The result gives us the number of matches and the total number of lines file.

5. When you press Control + H only shows the filtrated result

2. Notepad++This tool is well known, but has a search option that I have found particularly useful on sefveral situations, especially with Windows Updates analysis where the log WindowsUpdate.log is not accepted in the merge in CMTrace / Trace32, and we need to review information coming from different services that do not fit the format required by CMTrace.

   Notepad++ allow to search on several files at the same time, we may not have a clear timeline, but this will allow us to relate the data and check all the coincidences on all the files, allowing to jump to the line located to review the events Nearby / Related.

 

• Open a file, on this case all the related with Windows Update Services on the client.

• With Ctrl+F we open the find section, we should push on the Find in all opened documents

• We will see the results of the search on all the opened documents, with a click on the line of the result you will jump to the line on the file, so you can review the events around to understand the situation.

I hope that this will be informational for you.

See you on the next post.