Reading a crash or a log

Something failed overnight, and all you have is a log file of thousands of lines and a stack trace pasted into a ticket. These tools cut that down to the part that matters. Logs often hold names, addresses and tokens, and here they stay in your browser.

1. Narrow the log

Drop the log on the Log Viewer. It recognises levels such as ERROR and WARN, and times from ISO dates, Apache and nginx logs, syslog and JSON logs. Choose the error level’s box, set From and To around the time it failed, and type a word in Contains: a request ID, a user, a server name. Entries that run over several lines, such as stack traces, fold open. Show each entry’s time in my time zone helps when the server runs on UTC.

2. Read the stack trace

Paste the trace into the Stack Trace Formatter. JavaScript, Java, .NET, Python, Go, PHP and Ruby traces are laid out with each cause under its message, and Fold library and runtime frames hides the framework’s own lines. The message names the first frame in your own code, which is usually where to look. For minified JavaScript, add the .map files to see the original file and line.

3. Make sense of the times

A log line or an error body may give a time as 1767225600 or 1767225600000. The Timestamp Converter works out which from the length and gives it in UTC and your local time, with how long ago it was. It also reads Windows FILETIME, Excel dates and the times inside ULIDs and MongoDB ObjectIds.

Some numbers need to be told what they are, under Read as. A very long number from a .NET app, such as 638000000000000000, is .NET ticks; a 17-digit one in a Chrome or Edge history or cookies export is Chrome / WebKit time; and the 20-character key Firebase gives each entry hides the time it was made as Firebase push ID. If you’re unsure which, try them in turn and see which gives a believable date. For a column of them pulled from a log, Many timestamps at once converts one per line and copies the result as CSV.

4. Pull out what you need

To find every request ID, IP address or error code in the lines you’ve kept, write a pattern in the Regex Tester and paste the lines as the text. Every match is listed with its groups, and the pattern is explained part by part. The same pattern, written /pattern/flags, works in the Log Viewer’s Contains box.

5. What changed?

If it worked yesterday, compare yesterday’s config with today’s in the Diff Checker. Set Compare as to JSON or YAML and reformatting and key order are ignored, so only real changes show.