Reading and interpreting log files

    Reading Your Case Log Files
    Each Intella, Connect and W4 case has its own log files: case-main[date].log and case-warnings-[date].log. The case-main file contains all of the product's case-specific log messages. The case-warnings file only contains those messages that have WARN or ERROR level messages.
     
    Log files "roll over" every day at midnight. When a case is opened for the first time on a specific day, two new log files are made for that day. When you open the case another time on the same day, all log messages are appended to these files. When your product still has the case open at midnight, it starts creating two new log files for the next day. This split up prevents the log files from becoming too large to handle, and helps to pinpoint which log files would contain the information for a specific issue. 
     
    Your log files are always stored in the logs folder of the case folder. You can access the location of the log files directly from within the application. For Intella and W4 click on Help then the Open log folder option when you are in the case.
     



    Because Connect is a server/client platform, the case logs will be located on the server, not the end user's computer. In this case the Connect administrator can find the location of the logs folder in the Cases tab.


    By searching your own log files for common error messages you can often troubleshoot these types of errors without the need for contacting our support department. There are two ways to review your logs for errors. 
    • Use Intella's log scanning tool - This is the easiest way to check your logs. This is a built-in tool which will automatically scan the case logs for errors for the case that you have open. It will report those errors and provide some suggestions to resolve the errors. In the example below you can see a large number of Out of Memory errors. There are also some network errors that occurred. In this example the memory for the case will need to be adjusted in Intella. In addition, the network errors are likely because the user is indexing to/from a network drive. In this instance they should move the case folder and the evidence locally onto the Intella system to eliminate the network error.
       

      You can also scan the case logs for a case that you can no longer access.  To do this, open any case and start the log scanning tool. Now click on the Browse button and path to the log for the case that you can not access.


    • Search the log file manually - This was the only way to check the logs up until we developed the log scanning tool. You would basically open the log in a text editor and search the log for common errors (listed below). Note that some logs can be very large so we suggest using tools designed to open the large text files. You can run a web search for 'large text file viewer' or large text file editor' and you should be able to find a suitable cheap or free application.
     
    List of Known Errors
    The following is a list of known error messages and their explanation and solution. Most of these have causes that are external to the product which you are using.
     
    java.lang.OutOfMemoryError
    Explanation: Your product has run out of memory while processing a file or index. This error can also happen on machines with ample RAM because each of the tool's processes has a maximum amount of memory they are allowed to use.
    Solution: Adjust your products memory settings. See the "Memory setting" section in of your product's user manual for more details.
    Caveat: Note that some out of memory errors are caused by corrupt documents and your product may safely recover from this, so that the integrity of the case is not harmed. When in doubt, please send the error message and the 50 lines surrounding it to Support.
     
    We have written a post on optimizing memory settings in Intella.
     
    java.io.IOException: The device is not ready
    Explanation: The USB disk or network drive is not available to the application.
    Solution: Process the case on an internal disk to see if this solves the issue. In most cases this error is shown because the network/external disk or the connection to it is not reliable.
     
    "Exception while processing stream of ..."
    Explanation: The file being indexed may be corrupt.
    Solution: Check the file in its native application. Note that sometimes the file will work in its native application. This does not mean that the file is ok though. E.g. we have seen a number of PST mail files created by 3rd parties that don't work with or products.  Further inspection shows that the PST files are malformed as the 3rd parties have not complied to the standards for PST format. Yet, the file may still open fine in Outlook. 
     
    java.io.IOException: An unexpected network error occurred
    Explanation: Your network is dropping connections.
    Solution: Move the case and evidence data to an internal drive and retry.
     
    java.io.IOException: Access is denied
    Explanation: You do not have the correct file or folder permissions. 
    Solution: Ensure all permissions on the case files and evidence data are correct. A common scenario for this error is when someone different logs onto the system running your product, and they don't have access to the case folder or evidence folder. This is actually a Windows error which is echoed through the application.  
     
    java.io.FileNotFoundException: X:\FILE_NAME_AND_PATH (Access is denied)
    Explanation: The file or folder is missing. Perhaps you have moved the case or evidence folder?
    Solution: Verify that the original data is where it should be and that the logged on user has full permissions to these files and folders. 
     
    java.io.IOException: There is not enough space on the disk
    Explanation:  Self-explanatory, there is not enough space on the disk.  
    Solution: Check if you have sufficient drive space> If not this will need to be addressed before continuing.
     
    com.vound.intella.export.PdfReportException: Unsupported image format or image is not available

    Explanation: This error can occur when rendering items to PDF or image format during exporting. Either the item being rendered is unsupported and will be skipped, or the source files for the items being exported are no longer available (e.g. they have been moved/deleted, they were not cached when indexed and the case has now been moved etc.).

    Solution:

    • Not all files can be printed or rendered to PDF or image formats during an export. If this message is shown and the source data is available, then the items you are exporting are unsupported, and the printing/rendering process will be skipped for those file. Examples of unsupported files which we have seen are: configuration files, technical drawing files, certain system files and unsupported graphic files. You should ensure that the correct file types are included in your production. 
    • If the source files cannot be accessed by the case, you can link them back to the case by editing the evidence paths. See the user manual for your product on how to do this. 

     

    System Log Files

    Log files are useful in diagnosing problems or errors that may arise while using your product. Above we spoke about the case logs, which relate to what is happening in each case. Your product also records log files during all normal program operations. For example, you start your product but the application instantly closes before you can open your case. In this case you can review the system logs to troubleshoot why your product will not run. 
     
    The system logs are located here: 
    C:\Users\[the_account_which_started_the_application]\AppData\Roaming
        ...\Intella\logs for Intella
        ...\Intella Connect\logs for Intella Connect
        ...\W4\logs for W4

    The system log files for Intella and Intella Connect are intella-main-[date].log and intella- warnings-[date].log. For W4 these are w4-main-[date].log and w4-warnings-[date].log. During an issue the support team may ask specifically for the system logs to troubleshoot your issue.


    Log Levels
    When an issue arises and the log files do not contain sufficient information to resolve the issue, you may wish to increase the logging level from basic (INFO) to a more detailed level (typically DEBUG). Your product will then log actions and operations in more detail. Note that this will considerably increase the size of the resulting log files.
     

    You can increase the logging level for your case by doing the following:

    1. Shut down your product, remembering the case name and the location of the case folder.
    2. Open the conf folder in Windows Explorer. For an Intella case this would be in the case folder, e.g. D:\my case\conf
       If you want to increase the logging level for the system logs, then you would go here C:\Users\[the_account_which_started_the_application]\AppData\Roaming\Intella\conf
    3. Once in the conf folder, use a text editor (e.g. Notepad) to open the logback.xml file.
    4. Locate the line containing
      <level value="INFO" />
      Change it into
      <level value="DEBUG" />
    5. Once the changes are made, save the file and close the text editor.

    Now open your Intella case again. Logging will from now on be set to a more detailed level.


    Updated May 2022

    Published