LogoRRR can combine two or more complete open logs into one chronological text file. Source files are read but never changed. The result is useful when an incident spans several processes or machines and needs one ordered evidence stream.
Before you merge
- Open at least two source logs in the main LogoRRR window.
- Make sure full-file access is active; merge is a LogoRRR Pro capability.
- Configure valid timestamp settings for each source whose events should participate in chronological ordering.
- Know any clock difference between sources when their system clocks were not aligned.
Detached logs must be reattached before they can be selected in Merge Open Logs.
Select sources and clock differences
Right-click an attached log tab and choose Merge Open Logs. In the first step, select at least two logs.
For each source, enter a signed millisecond difference. The minus and plus controls adjust the value by one millisecond. LogoRRR adds this correction to that source’s parsed timestamps before ordering events.
| Situation | Example correction |
|---|---|
| Source clock is 250 ms behind the reference | +250 |
| Source clock is 1.5 seconds ahead | -1500 |
| Clocks already agree | 0 |
Express every correction relative to the same trusted source. Mixed reference points can make a technically valid merge misleading.
Choose the output
Select Browse… and choose a target file in an existing writable directory. The target must differ from every source and every currently open log.
Enable Open in additional tab if the completed result should immediately become another normal LogoRRR tab. The wizard remembers confirmed source choices, offsets, export directory, and this option for the next merge. Cancelling before Go does not change those saved choices.
Review chronological ordering
Before starting, LogoRRR shows the selected source paths and differences, total input size, target path, overwrite state, and output format.
The merge keeps every physical input line:
- A timestamped line begins an event.
- Untimestamped continuation lines stay attached to the timestamped event above them.
- Leading preamble belongs to the first timestamped event in that source.
- A file with no usable timestamps is placed after timestamped events.
- Effective timestamps include the configured per-source difference.
- Deterministic tie-breaking keeps the output stable when effective timestamps match.
The result contains the original lines without adding source prefixes. It is UTF-8 text with LF line endings.
Run, cancel, and recover
Choose Go to start. Scanning, ordering, writing, and final publication run outside the interface thread with visible progress and bounded memory.
LogoRRR writes through merge-owned temporary data. Cancelling or encountering a failure removes that temporary work and leaves an existing destination untouched. A successful result is published atomically, replacing an existing destination only after the complete output is ready.
If a source changes or becomes unavailable during the operation, review the source files and start again. Storage and permission failures should be resolved by choosing a writable destination with sufficient free space.
Verify the result
If you asked LogoRRR to open the output, inspect it like any other log: add search terms, verify event boundaries, and check several known cross-source timestamps. Keep the original files when provenance matters; the merged file deliberately contains no automatic source labels.