1.5.0.1397a writing of journal entries to a log file doesn't work

[stef]

After upgrading to 1.5.0.1397a writing of journal entries doesn't work correctly.
(In addition exporting them to a .txt-file doesn't work)

I'm using the following settings:

Code: Select all

journal=1
journal_max_size=33554432
journal_add_all=0
journal_log=1
journal_log_directory=
journal_log_format=#id: #date: #action:<-9> #split:"#filename:"

With 1.5.0.1396a it is logging correctly to a file and for example it looks like this:

Code: Select all

1898528 2025-09-05 00:03:12 Modify    "C:\Program Files\NoVirusThanks\ProcLoggerSvc\Logs\Logs\09.05.2025.log"
1910920 2025-09-05 11:52:59 Modify    "C:\Windows\System32\LogFiles\WMI\Wifi.etl"

and with 1.5.0.1397a it looks like this:

Code: Select all

1912637  6<-9> "
1912638  8<-9> "
1912638  8<-9> "
1912639  10<-9> "
1912640  6<-9> "
1912641  6<-9> "
1912642  7<-9> "

After changing it to journal_log_format=

Code: Select all

133982837760193517	1924523	2025-09-05 19:05:25	File Modify	"C:\ProgramData\Microsoft\Network\Downloader\edb.log"	""
133982837760193517	1924192	2025-09-05 19:05:25	File Modify	"C:\Program Files\NoVirusThanks\ProcLoggerSvc\Logs\Logs\09.05.2025.log"	""

the biggest difference is the big number at the beginning.
But it has simply stopped logging after a second.

After modifying journal_log_directory= to journal_log_directory=r:\temp
the file R:\TEMP\index-journal-2025-09-05-1.5a.txt has been created but it stays empty and nothing is logged anymore.

The Index Journal in Everything (Index - Index Journal...) is displaying all entries correctly.
Exporting it to a .csv-file works (40 mb, everything looks correct)
BUT exporting it to a .txt-file doesn't work.
There is no correct entry in the exported file (more than 4 MB). Example:

Code: Select all

1927300  10<-9> "
1927299  10<-9> "
1927298  6<-9> "
1927297  7<-9> "
1927296  8<-9> "

So it seems the writing of journal entries to a file with journal_log=1 and exporting of journal entries to a txt-file are broken.

[void]

Thank you for the issue report stef,

Everything 1.5.0.1397a changes the index journal log format.

Everything 1397a will now use the preprocessor to format journal logs for more control.

the biggest difference is the big number at the beginning.

This is the Journal ID which is now logged by default.
The Journal ID and Change ID refer to a unique change.



Please change your journal_log_format to:

Code: Select all

$split:$id: <format-filetime:$date:,"yyyy-MM-dd HH:mm:ss"> <RPAD:<SWITCH:$action:,1,"Create",2,"Delete",3,"Rename",4,"Move",5,"Modify",6,"Create",7,"Delete",8,"Rename",9,"Move",10,"Modify",""><IF:$is-split:," "<IF:$is-from:,"From","To">>,9> "$filename:"

Sorry for the inconvenience.

[stef]

I was about to ask how to add "From" and "To" to the logfile but you have updated your post in the meantime.
Now logging of journal entries looks like before and everything is working.

Thanks for your help.

[stef]

Everything 1.5.0.1397a changes the index journal log format.

Please change your journal_log_format to:

Code: Select all

$split:$id: <format-filetime:$date:,"yyyy-MM-dd HH:mm:ss"> <RPAD:<SWITCH:$action:,1,"Create",2,"Delete",3,"Rename",4,"Move",5,"Modify",6,"Create",7,"Delete",8,"Rename",9,"Move",10,"Modify",""><IF:$is-split:," "<IF:$is-from:,"From","To">>,9> "$filename:"

To have the file size in the logfile I have appended $size: but Everything is crashing directly after launching.

Does the variable $size: needs to be formatted in a special way? Because simply adding it seems to cause issues.

[void]

Thanks for the bug report stef,

Everything is trying to reference the size information for deleted files, which doesn't exist.
I will post a fix soon.

For now, please avoid $size:

[void]

Everything 1.5.0.1399a fixes a crash when using $size:, $date-modified:, $date-created:, $date-accessed: or $attributes: in a custom journal log format.

[stef]

With 1.5.0.1399a it doesn't crash anymore.
Thanks for fixing it.

I will do some more testing and optimizing.
If i encounter issues or crashes i will report back.


1.5.0.1396a

Code: Select all

journal_log_format=#id: #date: #action:<-9> #split:"#filename:"

1498873 2025-08-28 00:01:00 Rename    "C:\Windows\System32\sru\SRU.log"
1498873 2025-08-28 00:01:00 Rename To "C:\Windows\System32\sru\SRU2616F.log"
1898528 2025-09-05 00:03:12 Modify    "C:\Program Files\NoVirusThanks\ProcLoggerSvc\Logs\Logs\09.05.2025.log"

1.5.0.1399a
$size: + $attributes: added

Code: Select all

journal_log_format=$split:$id: <format-filetime:$date:,"yyyy-MM-dd HH:mm:ss"> <RPAD:<SWITCH:$action:,1,"Folder Create",2,"Folder Delete",3,"Folder Rename",4,"Folder Move",5,"Folder Modify",6,"File Create",7,"File Delete",8,"File Rename",9,"File Move",10,"File Modify",""><IF:$is-split:," "<IF:$is-from:,"From","To">>,18> "$filename:" <lpad:<format-size:$size:,1>,13> <format-file-attributes:$attributes:>

2020843 2025-09-08 18:28:31 File Rename From   "C:\Program Files\Microsoft Update Health Tools\Logs\UpdateHealthTools.164.etl"       131.072 AI
2020844 2025-09-08 18:28:31 File Rename To     "C:\Program Files\Microsoft Update Health Tools\Logs\UpdateHealthTools.164.etl"       131.072 AI
2021250 2025-09-08 18:29:18 File Modify        "C:\Program Files\NoVirusThanks\ProcLoggerSvc\Logs\Logs\09.08.2025.log"     4.636.588 A
2022761 2025-09-08 18:50:59 Folder Modify      "C:\ProgramData\Microsoft\Windows\WER\Temp"               DI

[stef]

After comparing of the Index Journal in the Everything GUI with Everything logfiles i noticed that entries are missing from the logfile.

For example i have turned my PC off, the last entry in the logfile is 2038303. The next entry should be 2038304 but it continues at 2038425 (see below).
And it continues in the middle of a line instead of a new line.

It begins to log activity after i have turned my PC on and have launched Everything, but activity before launching of Everything is missing.

The Index Journal in the Everything GUI shows all entries continously. Not a single one is missing.

I'm using this format for logging:

Code: Select all

journal_log_format=$split:$id: <format-filetime:$date:,"yyyy-MM-dd HH:mm:ss"> <RPAD:<SWITCH:$action:,1,"Folder Create",2,"Folder Delete",3,"Folder Rename",4,"Folder Move",5,"Folder Modify",6,"File Create",7,"File Delete",8,"File Rename",9,"File Move",10,"File Modify",""><IF:$is-split:," "<IF:$is-from:,"From","To">>,18> "$filename:" <lpad:<format-size:$size:,1>,13> <format-file-attributes:$attributes:>

Code: Select all

2038303 2025-09-09 04:44:31 File Rename From   "C:\Users\****\AppData\Lo2038425 2025-09-09 12:02:05 File Create        "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db.tmp"    64.501.929 A
2038426 2025-09-09 12:02:05 File Delete        "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db"               
2038427 2025-09-09 12:02:05 File Rename From   "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db.tmp"    64.501.929 A
2038427 2025-09-09 12:02:05 File Rename To     "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db"    64.501.929 A
2038428 2025-09-09 12:02:05 File Modify        "C:\Users\****\AppData\Local\Everything\Logs\index-journal-2025-09-09-1.5a.txt"       786.432 A

Code: Select all

2060901 2025-09-09 16:35:23 File Modify        "C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000271.log"        94.824 A
2060902 2025-09-09 16:35:23 Fil2061152 2025-09-09 18:36:46 File Delete        "C:\Users\****\AppData\Local\Everything\Everything-1.5a.backup.db"               
2061153 2025-09-09 18:36:46 File Rename From   "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db"    64.501.929 A
2061153 2025-09-09 18:36:46 File Rename To     "C:\Users\****\AppData\Local\Everything\Everything-1.5a.backup.db"    64.501.929 A
2061154 2025-09-09 18:36:46 File Create        "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db.tmp"    64.564.763 A
2061155 2025-09-09 18:36:46 File Rename From   "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db.tmp"    64.564.763 A
2061155 2025-09-09 18:36:46 File Rename To     "C:\Users\****\AppData\Local\Everything\Everything-1.5a.db"    64.564.763 A
2061156 2025-09-09 18:36:46 File Modify        "C:\Users\****\AppData\Local\Everything\Logs\index-journal-2025-09-09-1.5a.txt"     5.308.416 A

This issue seems to be introduced with the new format which i have been using since a few days.
To verify this i will revert back to an old format which i have been using for years and after a reboot and launching Everything i will see what happens.
Edit: I can't revert back to an old format because with 1.5.0.1397a the index journal log format has been changed.
Then i will remove $size: and $attributes: and i will see how it goes after a reboot.

[void]

Thank you for testing 1397a-1399a stef,

Everything is not flushing the journal log file to disk on shutdown/restart.
This has been an issue since 1366.

I will post a fix soon.

[stef]

This has been an issue since 1366.

Exactly.

I haven't noticed it before.
After 1366 has been mentioned i looked into old logfiles and yes, it has been the case since i have installed 1.5.0.1366a on the 9th of January 2024 (on the same day it was released).
I only need to search for Everything-1.5a.db.tmp in the logfiles then i can see that lines are missing (up to a few hundreds) before that.
And the logfile always resumes in the middle of a line.

All previous logfiles look fine.
Edit: A reboot isn't needed to see this in the logfile. Simply exiting of Everything and launching it after a few minutes is enough to see missing entries.

[void]

Everything 1.5.0.1400a fixes an issue with the journal log file not being saved to disk on exit.

[stef]

I have exported journal entries (Index - Index Journal... - Export...) and compared it to the log file and no line is missing.
So yes, Everything 1.5.0.1400a writes journal entries correctly now.
Thanks for fixing it.

[void]

Thanks for testing 1.5.0.1400a.