LogoRRR 26.9.0: live logs, merged timelines, and precise search

LogoRRR 26.9.0 turns the large-file foundation from 26.8.0 into a more complete investigation workflow. It can follow files that are still growing, build one chronology from several logs, help configure missing timestamps, and move between exact matches in both text and Regex searches.

Live Tail moves only when you ask

Follow mode watches a growing file while keeping incoming data separate from your reading position. Pause freezes the view without stopping observation. Resume accepts pending lines without forcing the view to the end, and Jump to Live returns deliberately to the newest entry. If you scroll away from the end, LogoRRR keeps that position anchored.

Clear From Here establishes a new baseline inside the same session: earlier lines leave the projection, while later data continues to arrive. Each detached or open source can be followed, paused, resumed, or returned to live independently or together. Append, truncate, replace, rotate, delete, and recreate events keep file generations separate, so old and new content are not silently mixed.

Live Tail states

Follow, pause, and jump to live

Several logs become one chronology

Merge Open Logs orders two or more sources by time in a separate investigation. Every row retains its source and original line number, and the result says clearly whether it is complete or partial. A per-source millisecond offset can compensate for clocks that disagree without changing the source files.

Text or Regex filters narrow the merged timeline without disturbing searches in the source tabs. Double-click or Enter returns to the exact original row. The visible investigation can also be exported as CSV with source identity and original line number.

Timestamp suggestions remain reviewable

When a log has no valid time configuration, the timestamp assistant examines up to 200 non-empty lines in the background. It never delays the first view or changes settings automatically. A strong match produces a reviewable suggestion with columns, Java time pattern, confidence, and examples. Manual settings always win.

Detection is local and deterministic. No log data is uploaded, no AI model is called, and ambiguous samples produce no suggestion instead of a confident-looking guess.

Text and Regex use one reliable search path

Search cards now switch between Text and Regex. Text remains case-insensitive by default; Regex is case-sensitive and uses an engine with linear-time guarantees. Both modes share counts, filters, highlights, heatmap, minimap, timeline, Live Tail, and export behavior.

Invalid or excessively costly expressions are explained beside the field. The draft remains editable while the last valid result stays on screen. Previous Match and Next Match move to the exact character range, including several matches on one row, while respecting active filters.

Large files have published evidence

The 26.9.0 qualification used a 9,999,220,736-byte fixture with a 256 MiB Java heap on macOS ARM64, Windows x64, and Linux ARM64. Exact first, middle, and tail navigation, search, timeline, cancellation, and complete full-file merge checks passed under the published protocol. See the public evidence overview for the scope and limits of that evidence.

LogoRRR also makes loading and failure states more explicit. Missing, moved, unreadable, unsupported, or inaccessible paths produce understandable messages, while saved searches wait for the selected file engine to be ready.

The result is a calmer investigation workflow: live data does not move the view without permission, several sources can be traced as one auditable timeline, timestamp help remains under your control, and search navigation lands on the exact evidence you need.