Sonar User Guide

Web Log Correlation

When a marker is targeted at a web service (web server, .NET Remoting, etc.) we get an additional benefit of the trace marker appearing in the web log.  Sonar (formerly known as Trace Marker) can generate markers that appear in a network trace and in the access log of a web server.  In the following video Matthew York shows how the marker tool can be used to mark a network trace and a Microsoft IIS log.

Above we see the Sonar log entries, the corresponding network trace entries and the matching log entries that appear in the IIS log.  Note how the Sonar and network trace timestamps are based on British Summer Time (BST) but the IIS log entries are based on GMT; something always worth remembering when analysing web logs.

The ability to have markers that appear on the client, in a network trace and in a web log is very useful as it means that we can:

  • Use the marker as a reference point to overcome time sync issues
  • Match SSL network traffic with web log data by using the marker as a reference point

The unique string in the marker (in the case above the string "a7") makes it easy to search for markers in the web logs.