Macrium Support Forum

Colorization of Log files to easily identify failures at the top log listings level

https://forum.macrium.com/Topic42547.aspx

By postfive - 4 January 2021 6:49 PM

I keep 26 weeks worth of logs; in that time I have had a few failures (most recently I had a failure after having updated my VMware Player to the latest version, but I did not
actually realize that the failure was triggered by that upgrade till several days later).

Each day could potentially have several backups that were performed; only some of those might fail.  The Macrium Reflect "Log" tab displays at the top level what I will call here a "macro view"
list of days where logs were generated; you click the plus sign next to a day to drill down to that day's logs.  This "macro view" does not however colorize or differentiate in any
way whether a particular day's log(s) had any errors or not.  You do not actually see whether a specific log for a particular day indicated errors or not until you drill down to that day,
 then if a log showed errors it will show up in red.  Note that in some cases Macrium will automatically try automated methods to try to circumvent the issue that caused the orignial
error and it might be successful on the following attempt.  But as far as the color of the log file goes, it currently always shows up red regardless of eventual backup success or failure.

The problem with this is that for the few logs that did show failures, if I want to go review their specifics after some time has passed, I must first access the "macro view", then
drill down to each day in the list to see if it contains any red items.

I suggest that the colorization scheme be brought up one level to the "macro view" total list level.  That way after accessing the "Log" function, it is very easy to visually spot a
particular day that contained one or more logs with errors.  Expanding on this, I suggest that Orange or Purple be used to indicate a backup that initially failed but subsequently
did complete successfully after automated adjustments, while red would indicate total failures.

I suggested this in a ticket for another problem.  I got two separate responses from Macrium; the first was that they are working on improvements to the "Log" function and will take
my suggestion into consideration.  The second response suggested I post it here in the forum for discussion.  If this has already been discussed elsewhere then I apologize in advance
for the duplication.

By jphughan - 4 January 2021 8:40 PM

I like the idea, but just in case you missed it, in the meantime working with what's available today, Reflect already supports filtering the Log list to show only those with a specific outcome (see screenshot below), and when you filter by Failed Logs, for example, any days that don't have any logs with failure events are completely removed from the view.  So anything left is worth drilling down into if that's what you want to see.


By postfive - 5 January 2021 1:45 AM

jphughan - 4 January 2021 8:40 PM
I like the idea, but just in case you missed it, in the meantime working with what's available today, Reflect already supports filtering the Log list to show only those with a specific outcome (see screenshot below), and when you filter by Failed Logs, for example, any days that don't have any logs with failure events are completely removed from the view.  So anything left is worth drilling down into if that's what you want to see.




By postfive - 5 January 2021 2:07 AM

Thanks for the info; I do see the error events/warning events/info events search functionality in the latest Macrium version.  At the time I sent this post, I was actually a couple versions behind the latest, and this capability was not showing up.  That was an issue in itself - I had set Macrium to automatically check for the latest version and notify me when a new one was available (and ideally upgrade itself automatically) - and it had not been doing that.  I discovered that issue by accident when I manually did an update, and sent Macrium a tech support call ticket about that.

But the above search capability as implemented unfortunately simply does a broad search of issues using Event Viewer and comes up with many results that are not pertinent to Macrium at all, thus not very useful IMHO.  I would like a view within Macrium that focuses on Macrium issues specifically as opposed to other common errors/failures like COM/Kernel/Defrag/etc. that have no relevance to whether a backup failed or not.

So the suggested revision still stands - please provide a colorized method of highlighting Macrium full/differential/incremental backups that have failed or otherwise noted issues.  Colorized by severity, so a totally failed backup attempt would be red, a backup attempt that failed initially but was subsequently fixed via an automatic software workaround would be maybe orange or purple, and a backup that eventually succeeded but with warnings (is there such a thing?) could be yellow.  I like the capability they've added to allow searching by a date range with a calendar function.  But please keep the data it finds pertinent to the application.  What they've implemented is a good start in the right direction but not as helpful as it could be due to reporting of extraneous info. 


By jphughan - 5 January 2021 2:29 AM

Why are you talking about Event Viewer?  The capability I showed you is in Reflect, and it allows you to filter Reflect's Log view -- which only contains logs of Reflect jobs -- based on outcome.  It has nothing at all to do with Event Viewer. I admit that colorizing the Log view would give at-a-glance viewing of multiple outcomes simultaneously by virtue of using different colors, which the existing dropdown filtering capability wouldn't.  But if you just want to see days where a backup job failed, set that dropdown to Failed Logs and that's what you'll be looking at.  If you want to see warnings, change the dropdown to that instead.  What is this "extraneous info" you're referring to that's being reported?  And the scenario of a job that failed initially but was subsequently fixed would show up as multiple job failures followed by a success, not a single job.  Reflect doesn't automatically reattempt failed jobs.  If the job fails, then it fails, and it won't run again until invoked again manually or by a schedule.  There are no "automatic software workarounds".  Reflect isn't an AI that tries to fix itself.  But yes, a job can finish with warnings.  See this article.

Based on your reply, it sounds like you either didn't actually try the capability I showed you before writing your reply, or else you're looking at something completely different from what I showed you.
By postfive - 5 January 2021 3:51 AM

jphughan - 5 January 2021 2:29 AM
Why are you talking about Event Viewer?  The capability I showed you is in Reflect, and it allows you to filter Reflect's Log view -- which only contains logs of Reflect jobs -- based on outcome.  It has nothing at all to do with Event Viewer. I admit that colorizing the Log view would give at-a-glance viewing of multiple outcomes simultaneously by virtue of using different colors, which the existing dropdown filtering capability wouldn't.  But if you just want to see days where a backup job failed, set that dropdown to Failed Logs and that's what you'll be looking at.  If you want to see warnings, change the dropdown to that instead.  What is this "extraneous info" you're referring to that's being reported?  And the scenario of a job that failed initially but was subsequently fixed would show up as multiple job failures followed by a success, not a single job.  Reflect doesn't automatically reattempt failed jobs.  If the job fails, then it fails, and it won't run again until invoked again manually or by a schedule.  There are no "automatic software workarounds".  Reflect isn't an AI that tries to fix itself.  But yes, a job can finish with warnings.  See this article.

Based on your reply, it sounds like you either didn't actually try the capability I showed you before writing your reply, or else you're looking at something completely different from what I showed you.

By jphughan - 5 January 2021 4:16 AM

Once again you posted a reply that contains only a quote of my post rather than anything new. If you want to quote and reply, press Reply in the post you want to quote in order to quote it, then write your reply below, and THEN click the Post Reply button.
By postfive - 5 January 2021 4:20 AM

Let's make sure we're talking apples and apples here...  I'm using Macrium Reflect Home Edition 64-bit (UEFI) Version 7.3, Build 5365, which was the latest version available as of yesterday.

When I access the Log tab, it displays the logs lists with 3 icons above; Reload Logs, Delete Old Logs, and View Windows VSS Events for the Selected Log file.  I'm using that third option.  It
pops up Windows Event Viewer with selectable ranges for VSS Events or All Events. 

If I choose VSS Events and set a range of the last 30 days, I get numerous Volume Shadow Copy Service errors reported.  However, when I drill down into the daily Macrium logs list, there are
only a couple logs that show red indicating actual failure.  So most of the VSS errors as reported in Event Viewer are misleading to me; do they actually relate to what Macrium is doing,  and
why are they listed if the Macrium logs listings indicate mostly successful backups?  I have daily email notification set up and I know for a fact that I have had only two backup failures in the last
month, both related to a recent upgrade of VMware Player which apparently triggers Macrium VSS issues; there is a function built into the application to fix VSS problems and then a reboot is
required).

When I use the other option for All Events, I then of course get all the other events I mentioned earlier - totally worthless for what I'm trying to do and not applicable.

So back to square one here, unless I'm massively doing something wrong.  The functionality they provide with the Event Viewer option is not that useful.  Again, colorizing the logs lists for total
failures versus errors versus successful backups seems to me to be much more intuitive.  I'm not seeing a way to filter Reflect's log view the way you describe - what "dropdown" are you talking
about?

Ah, the light dawns after putzing around some more!  I now see what you are referring to - the very small check mark on the right side next to "All Logs".  Very intuitive, Macrium - very obvious - NOT.
That allows listing of All, Warning, Cancelled, and Failed logs.  Totally solves my issue; no additional colorization needed!  I've been using the product for almost a year and never saw that before. 
Live and learn...  Thanks for putting me straight.





By jphughan - 5 January 2021 4:30 AM

The item next to "All Logs" isn't a checkmark.  It's the icon that indicates a dropdown menu.  That's the standard presentation of a dropdown menu within Windows, so I'm not sure it's reasonable to call that unintuitive.

But the disconnect here is that you're clicking that third option to open the VSS events.  Are you specifically trying to troubleshoot a Reflect job failure caused by a Windows VSS issue?  If not, then I'm not sure why you're even looking at that.  Windows VSS is a Windows component used by all sorts of applications, and I'm not even sure it would be possible to filter logs to include only VSS events related to the snapshot that Reflect requested.  And in any case, Reflect job logs are not the same as VSS logs at all, and Reflect jobs can fail for reasons other than VSS issues.  So the type of filtering you're suggesting wouldn't really make sense to apply to Windows VSS log events, nor would it include non-VSS failures.

In terms of not seeing the dropdown, are you not able to see the screenshot I included in my original post and specifically mentioned in that post, which clearly shows a dropdown in the Log tab, which allows you to filter the job logs immediately below?  If not, then I'm not sure you'll be able to see the two screenshots I'm including in this post either, but I'll include them anyway.  If you can't the ones below either, then maybe your browser has an issue of some kind.

What you WANT to be looking at is the actual job log, not VSS logs in Event Viewer.  Here is an example of how to find and select a job log in order to view it on the right.  In the screenshot below, notice that I did NOT click that "View VSS events" button.  I just expanded the tree node item for a particular day and clicked the timestamp underneath, which displayed the job log on the right.  Also notice that my filtering is set to All Logs, which is why there are several date entries underneath.



Now, in this second screenshot, I have changed that filtering option to Failed Logs, which as you can see resulted in my list of available logs below being cut down to just one day, the only day for which I have a log of a failed job.


By postfive - 5 January 2021 11:05 AM

jphughan - 5 January 2021 4:30 AM
The item next to "All Logs" isn't a checkmark.  It's the icon that indicates a dropdown menu.  That's the standard presentation of a dropdown menu within Windows, so I'm not sure it's reasonable to call that unintuitive.

But the disconnect here is that you're clicking that third option to open the VSS events.  Are you specifically trying to troubleshoot a Reflect job failure caused by a Windows VSS issue?  If not, then I'm not sure why you're even looking at that.  Windows VSS is a Windows component used by all sorts of applications, and I'm not even sure it would be possible to filter logs to include only VSS events related to the snapshot that Reflect requested.  And in any case, Reflect job logs are not the same as VSS logs at all, and Reflect jobs can fail for reasons other than VSS issues.  So the type of filtering you're suggesting wouldn't really make sense to apply to Windows VSS log events, nor would it include non-VSS failures.

In terms of not seeing the dropdown, are you not able to see the screenshot I included in my original post and specifically mentioned in that post, which clearly shows a dropdown in the Log tab, which allows you to filter the job logs immediately below?  If not, then I'm not sure you'll be able to see the two screenshots I'm including in this post either, but I'll include them anyway.  If you can't the ones below either, then maybe your browser has an issue of some kind.

What you WANT to be looking at is the actual job log, not VSS logs in Event Viewer.  Here is an example of how to find and select a job log in order to view it on the right.  In the screenshot below, notice that I did NOT click that "View VSS events" button.  I just expanded the tree node item for a particular day and clicked the timestamp underneath, which displayed the job log on the right.  Also notice that my filtering is set to All Logs, which is why there are several date entries underneath.



Now, in this second screenshot, I have changed that filtering option to Failed Logs, which as you can see resulted in my list of available logs below being cut down to just one day, the only day for which I have a log of a failed job.



Exactly, as I explained above.  As silly as it might sound, I did not even focus on that arrow, and did not realize that the arrow was indicating a dropdown menu which presented the choices I was asking for.  I come from a non-GUI Unix background so believe it or not, even after having to work with Windows systems for years, it is not very intuitive to me and I sometimes miss simple things like that.  Windows can be and is often very frustrating for me.  In any case, the enhancement I was asking for is essentially provided already via this additional view into the logs.  The difference here is that what I asked for was a top-down view that would colorize the master logs list rather than having to filter down, but that method works and is acceptable.  We can close this thread and thank you for gently steering me in the right direction.