Auto Log Rotation

[Coldblackice]

Would it be possible to get an auto log-rotation function, which saves logs to CSV in intervals? I can see in the log output folder that the ability is already there, albeit in non-CSV format.

This would be helpful as there are times when I look back in the log and investigate something anomalous, it's helpful to be able to see what other system actions/launches/terminations happened around that same time.

[edkiefer]

Would it be possible to get an auto log-rotation function, which saves logs to CSV in intervals? I can see in the log output folder that the ability is already there, albeit in non-CSV format.

This would be helpful as there are times when I look back in the log and investigate something anomalous, it's helpful to be able to see what other system actions/launches/terminations happened around that same time.

Did you know all those log entries are now in CSV format (processlasso.log.0 - processlasso.log.9).

Also, there is a new sampling log data that can run at X intervals (options>log settings>configure sampling), but it is more of a process list info than action log data (no action data).

[Jeremy Collake]

As of v10 (now in beta), the logs are all CSV.

There are also some new registry settings to control the rotation rate and depth, which I'll document soon.

This should allow for what you want.

I invite you to try it if you feel adventurous. I always appreciate your feedback.

Currently, the v10 release is scheduled for a couple weeks.

[Coldblackice]

As of v10 (now in beta), the logs are all CSV.

There are also some new registry settings to control the rotation rate and depth, which I'll document soon.

This should allow for what you want.

I invite you to try it if you feel adventurous. I always appreciate your feedback.

Currently, the v10 release is scheduled for a couple weeks.

I totally spaced seeing these responses. Awesome, thank you. And yes, I've been enjoying using the betas, and would be happy to experiment with those additional registry options if possible. Are those documented somewhere?

[Jeremy Collake]

Only one ended up making it to the release build:

Path: HKLM\Software\ProcessLasso
Value: MaxLogFileSize
Type: DWORD
Desc: Max log file size in bytes before rotation occurs.

[Coldblackice]

Awesome, thanks. Please let us know if/when you add more!

[rd25994]

Is there an update to this?

Some log file handling settings are in the registry, while others are in the prolasso.ini file?

And, what are some guidelines about how big the files should be, to avoid bogging Process Lasso down.

And how it relates to what "Insights" shows.
Maybe Insights could show how far back it is looking, to know if we should hit "Clear All".

(Stating this another way, suppose the Insights screen should show both how far back it has looked, vs. how far back the current log files are for.)

Is there one place where all this info is in the main documentation?

[Jeremy Collake]

Is there an update to this?

The logs auto-rotate and the depth can be set with the aforementioned registry value. Combined with the "Options / Log / Set Max Log Size" menu item, also registry backed, you can fully control the max total log size.

Some log file handling settings are in the registry, while others are in the prolasso.ini file?

Yes, since config profiles can be switched dynamically and share the same log, it makes sense for global log settings to be stored in the registry, and per-config settings such as which events are logged to be stored in the INI file(s).

And, what are some guidelines about how big the files should be, to avoid bogging Process Lasso down.

The defaults are well tested, so I recommend staying somewhere close to them. However, the consequence of an excessively large max log size would not be catastrophic. Other limits are in place to prevent it from becoming a problem. The largest effect would be seen in the load time of the GUI and LogViewer, with the latter being more impacted.

And how it relates to what "Insights" shows.
Maybe Insights could show how far back it is looking, to know if we should hit "Clear All".

Insights doesn't use the logs. It reads counter style data stored in the registry. Once you hit the "Reset all" button once, it should show you a "Since xxxx" text at the bottom.

Is there one place where all this info is in the main documentation?

We'll work to improve the docs surrounding this!

[rd25994]

The existing documentation doesn't seem to show how far back the "Actions log" panel at the bottom of the screen looks, or the "View log " button in relation to that.

In other words, does "Actions log" look at just the current 'processlasso.log' and into 'processlasso.log.0' too, but not further back into 'processlasso.log.1' and beyond (thru 9)?

Stating it yet another way, how would the user know where the native Process Lasso log viewing tools leave off, and that we have to use our own tools to look further back?

I see the "Process Lasso Log Viewer" does have a "Load Log File" menu item, but would that only load one of the ten?

As opposed the user concatenating all the log files into one big one, and using their own tool (e.g., Excel) to view the entire saved history?

I'm wondering about temporarily turning on the "Include Command Lines" option, for looking into all those many Chrome sub-processes with very long command lines.

My (apparently default) 262,144 bytes max size gives me about three weeks of history, and wonder how much shorter I'd get with "Include Command Lines" on.

This forums seems to be the only place that gets into nitpick details like that.

[Jeremy Collake]

The GUI's actions pane will load up to 512 rows from the current log file (no rotated logs). The LogViewer will show up to 4096 rows from the current and most recently rotated log file. Older rotated log files must be loaded individually with the "Load Log File" menu item you mentioned.

Enabling the inclusion of command lines will substantially increase the average row size, reducing the number of rows that can be stored in the same size log file (256KB by default). The removal of that field was not for size savings though, it was a concern about theoretical data leakage since some command lines can include sensitive information.

How would the user know where the native Process Lasso log viewing tools leave off, and that we have to use our own tools to look further back?

Presently, that's something you'd have to infer from the oldest entry in the log view, but there's no visibility into how far back Process Lasso's oldest rotated log file goes. We'll consider how this can be improved going forward. Probably if the rotated logs were more easily navigable in their entirety with the LogViewer then their range would be apparent.

Hope this helps!

[Trever Willms]

The auto-rotate function still works normally and can detect specific errors.