This article contains steps on how to use Microsoft Excel to review Profile Management log files. This is useful to identify a specific user session, a specific error type, a log level, and so on.

Requirements

• Microsoft Excel with basic understanding of the formatting tools available in Excel.

• Profile Management Log files.

Background

Profile Management can be configured to record many events relating to file, system and registry handling on logon and logoff of a user session.

This article assumes that logging is enabled for all events and that the Maximum Size of the Log file is enough to capture the issue that occurs in the environment. The maximum log file size can be adjusted via policy (default value is only 1MB).
When the Maximum Log File size is reached, Profile management retains one backup file (for example <Logfilename>.log.bak). To troubleshoot, it is best to retrieve this file too.

Instructions

Complete the following steps:

1. On the affected system, reproduce the behavior if possible and gather the UPM Log Files ( for example  <UPMLogfilename>.log and <UPMLogfilename>.log.bak).
   Note: If the issue cannot be reproduced at will, gather the log files of the recent occurred issue immediately after the issue has been reported.

2. Note details of the approximate time the issue occurred and the affected user. Use the machine with Excel installed for analysis.

3. Copy the Profile management Log file and the Backup file to a folder (for example c:\Temp).

4. From a command prompt, combine the two files into a single file.
   copy /b <UPMLogfilename>.log.bak+<UPMLogfilename>.log Combined<UPMLogfilename>.log
   Where <UPMLogfilename> is the name of your Log file.
   Be sure to have the .BAK file first in the command line, as this will put all the logged events into a single log file that has all events in chronological order.

5. Open the Combined Log file in a text editor, such as Notepad++, copy the entire contents of the Combined Log file.

6. Open Excel and in Cell A2 paste the contents of the file and select the Use Text Import wizard.

7. Select Delimited as the File Type and click Next.

8. Select Semicolon as the Delimiter type and click Next

9. Click Finish.
   The File is now imported and you need to resize the columns and perform some simple formatting to make the information useful.

10. In Row 1 on the Excel Spreadsheet use the following Headings.

    1. Date
    2. Time
    3. Log Level
    4. Domain
    5. User
    6. TID
    7. Notes / Messages

11. In Excel, in the View Menu, select Freeze Panes > Freeze Top Row.

12. Select the entire Column B by right-clicking on the B and select Format Cells. Format the Cells as Time.

13. Select the entire Row 1 by clicking on the Row heading “1”.

14. In the Data menu, select Filter, this will allow you to filter the data in the log file as you see fit.
    Note: You may need to change the column widths and enable Wrap Text in order to view the file correctly depending on your screen resolution.

Some tips for searching the log files.

1. If the issue only affects a specific user: Select the filter option on the User Column and show only information for that username and blanks.
   
   This will show only system information and information relating to that specific user.
   Therefore if the issue occurs during the logon or logoff process any system information will be shown in the ‘blanks’.

2. Quickly Find all Errors or references to ‘xxxx’: Using the Find All in Excel you can search for all references to ‘xxxx’ (for example a specific file name, a folder name, an error or an event).
   

3. How to identify when a Session Logon or Logoff begins: Use the Find all function in Excel and search for ‘Processing’ it will show all the instances of:

• Starting Logon Processing

• Finished Logon Processing (and the time taken to process the Logon)

• Starting Logoff Processing

• Finished Logoff Processing (and the time taken to process the Logoff)

Note: In this example, we can see that the Logon Processing completed in 354.62 seconds (much longer than normal). Clicking on the separate lines in the Search box will jump straight to the line in the log file.

We can also see that there are approximately 14,000 lines between the start of the logon and the completion of the logon. Following the log on process, we could quickly see that the user had a profile with almost 13,000 cookies (each of which was an individual file that needed to be synchronized, or otherwise processed) and when the user cleared out the cookies folder the log on returned to normal speeds/times.