Contents
What is MultiLog?
Can I download and use MultiLog?
Which logging applications work with MultiLog?
Do you have an example of the output from MultiLog?
How do I add a logger to MultiLog using the wizard interface?
How do I suspend or remove a logger from MultiLog?
How do I configure Deployment Mode in MultiLog?
What is MultiLog?
MultiLog is a logging tool that simultaneously controls, gathers, and combines the output from multiple existing research and commercial logging applications. Loggers automatically record a specific set of user actions, helping researchers to better understand interactions, guiding the design of new or improved interfaces and applications. MultiLog reduces the researcher’s required implementation effort by simplifying the setup of multiple loggers and seamlessly combining their output. This in turn increases the availability of logging systems to non-technical experimenters for both short-term and longitudinal observation studies.
Can I download and use MultiLog?
Yes. The MultiLog software is available from the Download page.
Which logging applications work with MultiLog?
Below is a table detailing the logging applications we have tested with MultiLog.
| Logger | ? | URL | Details |
| Google Chrome |  |
Here | |
| Mozilla Firefox | |
Here | |
| Mozilla Thunderbird | |
Here | |
| Microsoft Problem Steps Recorder (PSR) | |
Here | |
| Drag (developed by MultiLog authors) | |
Here | |
| Drag-and-Drop (developed by MultiLog authors) | |
Here | |
| Window Switch (developed by MultiLog authors) | |
Here | |
| Clipboard (developed by MultiLog authors) | |
Here | |
| Process Start Monitor (developed by MultiLog authors) | |
Here | |
| WEKA Data Mining | |
Here | |
| AppMonitor | |
Here | |
| Windows Update Log Files | |
Here | |
| VMWare Log Files | |
Here | |
| Microsoft Outlook Logging | |
Here | |
| Adobe ARM Log Files | |
Here | |
| Internet Explorer Maintenance (brndlog) Log Files | |
Here | |
| Windows DTC Log Files | |
Here | |
| User Log | |
Here | |
| JEdit | |
Here | |
| TeamViewer | |
Here | |
| Ubuntu Log Files (alternatives.log, auth.log, dpkg.log, kern.log, syslog) | |
Here | |
| Tobii Eye Tracker | |
Here | |
| Arduino Sensor | |
Here | |
| Microsoft Visual Studio |  |
Here | When this logger runs, the log file is locked. As a result, MultiLog can only process it when the logger is stopped and the file is unlocked. |
| Inputlog | |
Here | The timestamp in the logger is a measure of the time since the logger was started not a general measure of time. As a result, MultiLog cannot determine chronological order unless the user/researcher specifies to use the last modified date from the file as the timestamp. Data is created across multiple log files. Only the file listed as the log file when the logger is added will be included initially. In order to include subsequent files, new loggers would have to be added via the Add Logger wizard. |
| Translog | |
Here | The timestamp in the logger is a measure of the time since the logger was started not a general measure of time. As a result, MultiLog cannot determine chronological order unless the user/researcher specifies to use the last modified date from the file as the timestamp. Data is created across multiple log files. Only the file listed as the log file when the logger is added will be included initially. In order to include subsequent files, new loggers would have to be added via the Add Logger wizard. |
| Mendeley Desktop log files | |
Here | Data is created across multiple log files. Only the file listed as the log file when the logger is added will be included initially. In order to include subsequent files, new loggers would have to be added via the Add Logger wizard. |
| Kidlogger | |
Here | Data is shown every minute for a period of one day. After this time, Kidlogger creates a new file and another logger would have to be added to MultiLog through the Add Logger wizard to reflect this. |
| WebQuilt | |
Here | The timestamp in the logger is a measure of the time since the logger was started not a general measure of time. As a result, MultiLog cannot determine chronological order unless the user/researcher specifies to use the last modified date from the file as the timestamp. |
| Skype log files |  |
Here | Data is hashed/encrypted and MultiLog is unable to un-hash/decrypt it. |
| PersonalVibe | |
Here | Data is held in a database and MultiLog does not handle databases. |
| SoftActivity Keylogger | |
Here | Data is hashed/encrypted and MultiLog is unable to un-hash/decrypt it. |
| Revealer Keylogger | |
Here | Data is hashed/encrypted and MultiLog is unable to un-hash/decrypt it. |
Do you have an example of the output from MultiLog?
Yes. Please see the image below for sample output:
How do I add a logger to MultiLog using the wizard interface?
MultiLog allows researchers to add any pre-existing research or commercial logging application to its list of active loggers. Loggers are added through a wizard interface. The process takes the user through the following steps: (1) Logging information: the user is asked for the logger’s name, its corresponding log file location (or port number if the logger sends data on a TCP/UDP socket), the executable name, and any start and stop commands. (2) Date stamp identification: MultiLog extracts the first line from the log file (or uses the first received TCP/UDP data line) and displays this to the user. The user is asked to highlight the timestamp (or asked enter the attribute or element name of where the timestamp is located if the log file is in XML format). If the first line does not contain a timestamp, the researcher can continually press ‘Get New Line’ which will read subsequent lines of the file (or received further TCP/UDP data on the open socket), then highlight when a line that contains a timestamp is loaded. This allows MultiLog to parse and identify the timestamp (there are numerous standard and non-standard date/timestamp representations) to allow chronological ordering of the logged events. (3) Filter setup: The researcher can optionally set up any log filtering (based on include or exclude rules) to reduce unnecessary processing of irrelevant events. (4) Hashing/privacy setup: The researcher can choose to hash lines containing certain text and/or can choose to turn URL hashing on or off. Once complete, setup is finished, MultiLog can now monitor events from the new logging system once the user selects it from the ‘Loggers’ dropdown menu or saves the configuration for deployment. An image of MultiLog's wizard interface is below:
How do I suspend or remove a logger from MultiLog?
Suspending a logger stops MultiLog from monitoring the logger’s log file (or TCP/UDP stream) and, where possible, MultiLog will stop the logging application (if an application re-start is required, the user is first warned). This is achieved by un-ticking the logger in the ‘Loggers’ drop down menu. The logger can be re-started by re-ticking the option which resumes monitoring the relevant log file (or TCP/UDP stream). To remove a logger completely from MultiLog, the user selects the ‘Remove Logger’ button on the interface. That logger is removed from MultiLog completely and has to be re-added if needed again in the future. An image of active and non-active loggers in MultiLog is below:
How do I configure Deployment Mode in MultiLog?
Deployment mode is configured via a file named ‘config.txt’ that is located in the same directory as the MultiLog executable file. Typically, a researcher would configure all required loggers, automatically generate this file through MultiLog’s user interface, and then copy this file to the machines hosting a MultiLog deployment. However, the configuration is a plain-text file that can also be manually edited. An annotated is shown example below:
The first line of the configuration file should read either 0 or 1. This dictates whether the contents of the file will be read by MultiLog and loaded as a configuration for deployment. Each logger has logger-specific details that appear between the ‘start’ and ‘end’ lines (lines 2 and 18 in Figure 3). The following are required: the full name (line 3), executable name (line 5), normal start command (line 6), stop command (line 7), clean start command - different if flags are required for logging but not for normal operation (line 8), the log file location (line 9) or TCP/UDP socket data (lines 14-17), whether the logger is active (if data is to be collected from this logger immediately) (line 10), a list of text separated by commas of lines to include via the filter system (line 11) and a list of text, separated by commas, of lines to exclude via the filter system (line 12). These lines are replicated for each logging application added. Data relevant to all loggers or MultiLog in general (such as the polling interval and web server login details) are set after all logger-specific data has been input, for example, lines 19 to 23.
