Log file correlation

Correlation is the process of analyzing and determining a set of related events, based on a set of rules that are used to interpret the data contained in the events. The Log and Trace Analyzer enables you to correlate information within a log file from a single application or across multiple log files generated by different applications.

The Log and Trace Analyzer provides the following correlation methods:

Sequential correlation: the ability to sort the events in a log by various fields contained in the events (for example, time stamp)
Associative correlation: the ability to filter or group the events displayed in a log by the values in various fields contained in the events (for example, grouping by thread ID)

The correlation types can be used together to provide a complete picture. For example, when grouping a set of events together you typically also order the events in the group.

Display

The Log and Trace Analyzer provides two different views for displaying correlations:

Log interaction diagrams, which display interactions among log records that occur during the execution of an application.
Log thread interaction diagrams, which display interactions among log records that occur on different threads, which participate in the execution of an application.

Here is an example of a log interaction diagram which illustrates the interactions between an access log and an error log:

A column of blue bars and a column of red bars with arrows

The window title displays the view type and the correlation schema used in the format
Sequence Diagram: View name <Correlation schema>
where View name is the Log Interactions view or the Log Thread Interactions view
and the Correlation schema can be a predefined schema format such as Default Time.

Correlations are represented visually by an arrow that points from the source record to the target record. The following are different representations of correlations:

Correlation within a log file in a collapsed node.
Correlations of a selected event in an expanded node.
Correlation of an unselected node in an expanded node .
Correlation between log files
Correlation between logs where the source is outside of the current viewing page
Correlation between logs where the target is outside of the current viewing page.

Time Compression Bar and Scale

The time compression bar along the left edge of the diagram indicates the time elapsed between consecutive events. The time compression scale shows where the time falls between the minimum and maximum delta times. The intensity of the color is used to indicate the length of time, namely, the deeper the intensity, the higher the delta time.