Index Search Options

  • Enable Tag Search—The default is Yes. Allows user to select keywords within log messages and to use the Tag Search feature.
  • Message Encoding—The default is Windows-1252. Allows user to choose different message encoding formats. The options are: Windows-1252, ISO-8859-1, ISO-8859-15, ISO-8859-2, and UTF-8. Select UTF-8 to process logs from Japanese Windows 2008 R2, Windows 2008, or Windows 2003.
    Note: You should not change the encoding to UTF-8 if you wish to parse non-UTF-8 logs.
  • Timeout—The default is 10 minutes (600 seconds), allows user to set the timeout limit to retrieve Index Search results. Traditionally, this value was kept in a configuration file (/loglogic/tomcat/webapps/logapp20/WEB-INF/web.xml), now users can update this value from the GUI from the Admininistation > System Settings page. The value as seen on the GUI takes precedence over the web.xml file. Changing timeout values through the GUI requires no further action by the user, all necessary engines get the new values.
  • Multithreading Parameters— Index search is multithreaded, the behavior of multithreading is governed by the following configuration file; /loglogic/tomcat/webapps/logapp20/WEB-INF/spring/index-search.properties.

    Independent to the number of threads, each thread works on a one-hour data bucket. The bucket size in terms of 60 minutes cannot be changed by the user.

    If any value is changed in the index-search.properties file, restart mtask by running the commands:

    1. mtask stop
    2. mtask start

    To take advantage of multithreading users must specify the search range that is equal or greater than the index.search.parallel.minHours value (the default for this setting is 6 hours).

    Following are the default values:

    • Enable/disable multithreaded index search; possible values: { true | false } 
      index.search.parallel.enabled=true
    • Minimum search time range in hours to trigger a multithreaded search.
      Applicable only when index.search.parallel.enabled=true 
      index.search.parallel.minHours=6
    • Number of threads allocated for counting in a multithreaded search.

      Used in search to quickly navigate to the beginning offset of the page

      Applicable only when index.search.parallel.enabled=true 
      index.search.parallel.numCountThreads=3
    • Number of threads allocated for searching in a multithreaded search.
      Applicable only when index.search.parallel.enabled=true 
      index.search.parallel.numSearchThreads=3
  • Monthly Index Load Divisor— Use this parameter when the monthly index is so large that the memory issues occur when loading the terms during an Advanced Search. When Advanced Search and Monthly Index are both enabled, this parameter controls what fraction of the Monthly Index terms are loaded into memory during an Advanced Search.

    The default value is 1 (load all terms) with a possible range of 1-5, where 5 indicates 1/5th, which means load only 20% of the terms in memory.

    Note: Reducing the fraction of terms loaded into memory help with memory issues. However, it has a performance impact on searches where no memory issues exist, because the frequency of disk access during an Advanced Search increases.