Time scale
The radio buttons in the Time scale group govern which of the log message’s three time fields, Source time, Local time, or GMT, the validation criteria specified in the Time span group apply to. Validation criteria can only be applied to one time field for any given selector.
Time span
The fields in the Time span group are used to restrict the selector to matching only those log messages whose timestamp (the one indicated in the Time scale group) satisfies the specified validation criteria. To match the selector a log message must fall within the specified time range and occur on one of the indicated days of the week. Range testing and day of week testing work together to allow for very restricted filtering when messages of interest have narrowly defined occurrence characteristics. For instance, to diagnose a problem that occurs only when doing weekly server maintenance the validation criteria can be set to select only those log messages generated on Sunday nights between 3:00 AM and 4:00 AM during the month of October. Four selectors similarly configured can just as easily locate those same messages historically over all Sundays occurring in the last month of each of the previous four quarters. Additionally, the special value TODAY can be entered in either of the date fields to select messages occurring on the same date as the selector is evaluated.
In general, there are two types of time ranges, as indicated by the radio buttons at the top of the group, Linear and Bracket. Linear range matching allows specification of a beginning date and time and an ending date and time. Bracket range matching allows specification of a beginning and ending date and a beginning and ending time. Linear ranges are used to locate messages between two fully specified points in time. (E.g. 10/10/98 10:00:00 to 11/11/99 14:00:00.) Bracket ranges are used to locate messages between two dates and between two times. (E.g. 10/10/98 to 11/11/99 but only 10:00:00 to 14:00:00 on any given day.)
When the log message’s timestamp is evaluated against the date and time validation criteria there are potentially four comparisons made; two dates and two times. Any of the four fields may be omitted with the effect of either skipping a comparison or using a default value to carry out that comparison. For example, if two times are entered with no dates in Bracket mode then the two date comparisons will simply be ignored. In Linear mode the dates will both be defaulted to the current date and all four comparisons evaluated. There are four rules that govern the comparison operations with respect to omitted fields. These rules simply allow some keystroke savings and while somewhat cryptic sounding become intuitively apparent with use. They are as follows:
1)If all four fields are blank then no date/time comparisons are done. (Day of week is still evaluated, however.)
2)In Bracket mode, if a field is not supplied the comparison is simply skipped; there are no defaulted values.
3)In Linear mode, if only one date is supplied and the opposing endpoint’s time is also supplied then that date is used for both endpoints. This is true whether one or both times are specified.
4)In Linear mode, if neither date is provided then both date fields default to TODAY.
Note that the comparisons defined in the Time span group apply only to the one time field indicated by the radio button selection in the Time scale group. Sometimes it is desired to simultaneously work with two time fields. This could happen, for instance, when viewing logging from both sides of a client/server conversation in two time zones and trying to find messages occurring between say 4:00 – 5:00 Local time or 5:00 - 6:00 Source time. In that case a single selector could be defined in terms of GMT where the single time range might then be 10:00 – 11:00 or, alternatively, two selectors could be used to allow specification of time ranges using mixed time fields.
Lastly, day of the week matching is done as a separate step from range checking. Once the message has passed the time range criteria, whether linear, bracket, or blank, it is then checked for subsequent matching on the day of the week. The allowed days of the week are indicated by the checkboxes at the bottom of the Time span group. If the message’s timestamp corresponds to a day of the week that is unchecked then it will not be matched. If all days are checked then the comparison is unnecessary and is skipped for performance.