Hi Chris,
- You don't have to use a cyclic buffer (this is configurable per-tab), but Chainsaw launched via Web Start may not have enough memory to load your log file. If you download the 'bundle', you can modify the startup script to allocate more memory to the VM, which may allow you to load a larger file (-Xmx argument, etc) - Expression support for the TIMESTAMP field is a little awkward - you can't use the ~= operator, but you can use relational operators. You must use a specific timestamp format in expressions: yyyy/MM/dd HH:mm:ss - milliseconds are ignored. This expression will allow you to display events that occurred at 7:13:38: TIMESTAMP > '2006/08/21 07:13:37' && TIMESTAMP < '2006/08/21 07:13:39' Notice how I've put the timestamp values in quotes - because there are spaces. - Chainsaw does support search - via the text field in the toolbar. You can use the same expression syntax to search that you can to colorize entries or filter entries. To use search, enter text in the text field and press F3 or click the down arrow next to the text field. Matching lines will be highlighted in black. Move through matches by pressing F3 again or the down arrow, or Shift-F3 and the up arrow in order to reverse-search. To clear the highlight from a search, clear the text box and press F3. Scott Deboy Principal Engineer COMOTIV SYSTEMS 111 SW Columbia Street Ste. 950 Portland, OR 97201 Telephone: 503.224.7496 Cell: 503.997.1367 Fax: 503.222.0185 [EMAIL PROTECTED] www.comotivsystems.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of chris derham Sent: Monday, August 21, 2006 7:14 AM To: log4j-user@logging.apache.org Subject: Filtering long log files and searching I am trying to use chainsaw to view entries in a log file. I have it setup, and working fine. The log file I have is large, so chainsaw is unable to hold all the messages I want to see in its 5000 entry cyclic window. So I would like to know how to set things up so I can view not just the last 5000 entries, but any set. Ideally I would like at 4pm to be able to see the 5000 messages after 9am. I thought that the filterExpression looked the ideal candidate for this. I have tried setting TIMESTAMP ~= '06', and this shows all entries. However if I try any other literal (e.g. '2006' or '08/06'), no rows are returned. So the questions I have are 1) Is this the best (or at least a viable) way to achieve the desire3d functionality? 2) What format should I specifiy the literal for the timestamp field? The actual format in the log file, or the format defined via the timestampFormat field? Also could you add a search feature? e.g. you are showing 5000 entries, and you know you want the one that has a message saying "calling server". I know you can filter the entires to only show matching entries ( e.g. MSG ~= 'calling server'), but what about adding a simple search from current position (or backwards for that matter) for a given string in a given column (or all columns). That would be really useful. Thanks for providing a great tool. It really helps. With the ability to search archives for messages at specific times, would IMHO be a really useful addition. Chris --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
