Common base event model

The Log Analyzer maps the currently supported proprietary log formats into a common event model called Common Base Event. This allows the analyzer to use a common format for any log records from any supported proprietary log files. The parsers provided with the Log Analyzer map the log records from their current output format to this common model.

For example it will take this message from trace.log file

[7/10/09 19:46:19:007 EDT] 00000014 WSChannelFram A CHFW0019I: The Transport Channel Service has started chain chain_0.


and convert it into

<?xml version="1.0" encoding="UTF-8"?>
<CommonBaseEvents xmlns="http://www.ibm.com/AC/commonbaseevent1_0_1" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.ibm.com/AC/commonbaseevent1_0_1 commonbaseevent1_0_1.xsd">
<CommonBaseEvent creationTime="2009-07-10T16:46:19.007000-07:00" extensionName="CBECommonBaseEvent" globalInstanceId="CEA1DE700FE6279E34CF32E43733313566" msg="CHFW0019I: The Transport Channel Service has started chain chain_0." elapsedTime="0" priority="0" repeatCount="0" sequenceNumber="0" severity="10" version="1.0.1">
<extendedDataElements name="category" type="string">
<values>AUDIT</values>
</extendedDataElements>
<sourceComponentId component="IBM WebSphere Application Server Platform 6.0 [ND 6.0.2.25 cf250801.02] [XD 6.0.2.1 cf10726.21183]" componentIdType="ProductName" location="10.21.127.197" locationType="IPV4" processId="13381" subComponent="WSChannelFram" threadId="00000014" componentType="WebSphereApplicationServer"/>
<msgDataElement msgLocale="en-US">
<msgId>CHFW0019I</msgId>
<msgIdType>IBM4.4.1</msgIdType>
</msgDataElement>
<situation categoryName="ReportSituation">
<situationType xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ReportSituation" reasoningScope="INTERNAL" reportCategory="LOG"/>
</situation>
</CommonBaseEvent>
</CommonBaseEvents>


What is Log Analyzer

Determining the root cause of a problem in a system that consists of a collection of products can be difficult. All products produce problem determination data, such as trace records, log records and messages. However, the problem determination data cannot be easily correlated across different products and products on different servers. Each product's problem determination data can only provide a view through a small window into the overall system problem. Timestamps are not sufficient: they are not granular enough and often clocks are not often sufficiently synchronized between servers. All of these problems make the job of problem isolation (that is, determining which server, which product, and what the root cause of the problem was) very difficult, and this complexity increases with the complexity and size of a system.

The Log Analyzer, which enables you to import various log files as well as symptom catalogs against which log files can be analyzed, decreases this complexity. The core issue in problem isolation in today's solutions is that problem determination data between products is not correlated, that is, you cannot easily determine the relationship of events captured by one product with the events captured by another. The Log Analyzer addresses this problem by now allowing you to import and analyze log files from multiple products, as well as to determine the relationship between the events captured by these products (correlation).

You have two different options for Log Analyzer
1) WebSphere Application Server Toolkit: You can switch to Profiling and Monitoring view in WebSphere Application Server Toolkit to access the Log Analyzer



2) The IBM Support Assistance also has Log Analyzer.

View JVM Logs using Log Analyzer

You can view JVM Logs in Log Analyzer tool, which is part of WebSphere Application Server Toolkit. The Log analyzer will format and display the log in easy to read format.

• Start the WebSphere Application Server Toolkit. And once it is started switch to Logging and Performance perspective.


• Right in the Log Navigator perspective and click on Import. In the Import dialog select Profiling and Logging -< Log Files
  
  


• Click Next, on the next Import Log Files dialog click on Add button to get Add Log File dialog like this
  
  


• On this dialog select type of log as IBM -< WebSphere Application Server -< IBM WebSphere Application Server System Out. In the details section select location of the SystemOut.log file as well as the rules that you want to apply


• The Log analyzer tool will take couple of minutes to parse the log file and finally it will show a screen like this. As you can see it marked the error messages in red and warning messages in yellow
  
  


• You can get more information about each of the message by right clicking on message and executing Analyze -> Run. It will take the message identifier for the message and try and find more information in the Symptomps database. And display that information about detail message, possible recommendation,.. on the next screen.