---Confidential Copyright William Softky 2002---

Forensic troubleshooting with the LogJammer

How long does it take to find and understand a software glitch in a live, deployed system? How much time, money, and customer good-will is at stake?

Glitches matter to customers, and responding quickly matters to everyone. But problems can't always be reproduced, so they must often be resconstructed by hand, using the "log files" recorded by the running software. That process is slow and labor-intensive, losing technical resources and precious customer good-will. A more efficient way of investigating those log files would solve more problems with less frustration and delay.

What are the problems?

Many software processes keep a running record of what they do. Web servers, for example, "log" every incoming request--who requested whihc page, when, with what results--into a long, ever-growing list stored in the file system. Many computers, on boot-up, keep similar lists of their internal checks, services, who logs in, and so forth. A typical server has dozens of such files, each recording the ongoing behavior of a different process.

The good news is that those log-files are a treasure-trove of information with which to identify and reconstruct past problems. The bad news is that the information is scattered among many files and in different formats... so it's hard to even find where to look.

Furthermore, it's hard for a technician to find what he wants. The typical tool for exploring a file is a text editor (like "emacs" or "vi"). But text editors were designed for editing text, not for easy multidimensional searches of vast data-streams. These editors must slowly load the file into a display window, they allow only very simple "find" searches (locating one instance at a time, with no clear display format), and they have no tools for "marking your place" during subsequent searches. Searching a log file with a text editor is like looking for a needle in a haystack using tweezers.

Typical situtations benefitting from the LogJammer

What is the solution?

The solution is simple: put all the log information in one place, and make it easy to search. The LogJammer achieves this by using a monolithic database and an extremely intuitive graphical search interface designed just for log-files. With a LogJammer installed, any administrator can use a web page to instantly search any log file --or many files at once!--by a number of criteria, and can pinpoint problems very quickly. Anyone can search anything from anywhere.

Home