Correlating log files

Correlation is the process of analyzing and determining a set of related events, based on a set of rules that are used to interpret the data contained in the events. The Log and Trace Analyzer provides several ways of correlating information within a single log file, such as ordering the events in a log (for example, by time stamp) or filtering the events (displaying only those events with a specific thread ID). The Log and Trace Analyzer also provides the ability to analyze and correlate events in multiple logs, using algorithms that are imported and applied as a set of correlation plug-ins. Correlation plug-ins typically provide the ability to relate data in two different logs, using a very specific set of rules to analyze and correlate the data. The data used by the correlation plug-ins to determine relationships is referred to as correlation data.

Most types of correlations can be classified as either sequence correlation or associative correlation. Sequence correlation orders a set of events, using a specific set of values and rules to order those values. Ordering a set of events by time stamp is an example of sequence correlation. Associative correlation groups a set of events that have equivalent or related information, using a specific set of values and rules to interpret those values. Associative correlation can be used to associate two events, group a set of events together, or associate two groups of events. Showing only the events with the same thread ID is an example of associative correlation. Finally, correlation types can be used together to provide a complete picture. For example, when grouping a set of events together you typically also order the events in the group.

The Log and Trace Analyzer provides, as part of the base implementation, several correlation methods for events in a single product log:

Sequential correlation: the ability to sort the events in a log by various fields contained in the events (for example, time stamp) Associative correlation: the ability to filter the events displayed in a log by the values in various fields contained in the events (for example, thread ID)

The Log and Trace Analyzer also provides the ability to combine several log files into a single log for analysis, so these methods can also be used to analyze information in multiple log files, assuming they are combined into a single file for analysis. The Log and Trace Analyzer, as part of the base implementation, enable you to perform the following tasks:

associate events in multiple log files by timestamp
import, display, and analyze multiple log files
display the set of imported log files in a summary view that shows the relationships between events in the logs