I am running Blueprint 5.2 R2. What logfile does the Blueprint Event Browser pull from? Where is is? Can I make the file size larger? Can I export the contents of the logfile?
The Blueprint Event Browser data comes from a SQLite Database located in the directory "C:\ProgramData\PharosSystems\Blueprint\EventLogService". It holds 600,000 events by default and we don't normally recommend changing this. You would have to use a 3rd party tool to open the database and save the data to a text file.
What is the reason behind increasing the number of events it holds?
When reviewing the Blueprint Event Browser, the error that a user reported is no longer listed due to the end of the list has been reached. The current size of the list will not contain all of the events for a 6 hour day. By the time I get notification and start researching the error, the error will have been removed from the list.
I see. In the GlobalConfig.xml file located in "C:\ProgramData\PharosSystems\Blueprint" there are 3 lines below that control the Event Browser. Changing those could have an impact on performance of the system if it is now trying to search through more than 10,000 events during prime printing hours.
<MaxEventsReturned>1000</MaxEventsReturned> <MaxEventsToSearch>10000</MaxEventsToSearch> </EventLogConfig>
I would recommend instead of modifying those to use a scheduled task to copy the database file to a different location every hour or two hours then use a free program like the one below to browse/search the database.
What Jeff says is true. The Event Log Service storage and behavior is controlled by values found in the server's GlobalConfig.xml (stored in \ProgramData\PharosSystems\Blueprint. An example (the default, actually) is shown below:
The <MaxEvents…> key pairs control storage. By default, the Event Log Service maintains 600,000 records in its SQLite database, and manages in a FIFO manner. It will return, when queried by either the Event Browser console application or the Print Center "Event Log" page, the top 1,000 rows on launch, and a maximum of 10,000 events when using the "Search" function in either interface.
As Jeff recommended, increasing the MaxEventsStored property to any value beyond 600,000 is not recommended. It can lead to reduced system performance and can cause the service itself to "fail" start because the Windows Service Control Manager has a limit to how long it will wait for a service to start (part of its startup sequence is to enumerate the rows in its database; on a resource-constrained server, this can exceed the SCM 1 minute timer).
If you wish to maintain data longer than that, I would suggest using a data-mining package that can read the SQLite database structure (like Splunk or others) for longer-term historical data storage/research. The SQLite database includes one table (events) and that table maintains one row of data that is of interest (xml). From there, it's just a matter of querying against that XML structure (which is non-typed).
I hope this helps!
"The <MaxEvents…> key pairs control storage. By default, the Event Log Service maintains 600,000 records in its SQLite database, and manages in a FIFO manner. It will return, when queried by either the Event Browser console application or the Print Center "Event Log" page, the top 1,000 rows on launch, and a maximum of 10,000 events when using the "Search" function in either interface."
Could the maximum of 10,000 events be increased to 20,000 events? I would think that larger organizations might have a need if they service 1,000 users or more with 200 devices or more.
You can always test it out. My hypothesis is that the change will do what you want, but the processing of the extra XML will add time in either of the Pharos-provided means to look at that data. Since all servers have different hardware specs, that extra time may or may not impact you.
Retrieving data ...