Intella Connect: Troubleshooting

In order for Intella Connect to work properly, any popup blocking mechanisms should be disabled. You can find the instructions on how to do this by visiting the support site for your web browser:

There are also known compatibility issues with the Chrome Ask Toolbar extension so it is recommended to disable it when using Intella Connect.

Each Intella Connect case has its own log files: case-main-[date].log and case-warnings-[date].log. The main file contains all of Intella’s case-specific log messages. The warnings file only contains those messages that have a WARN or ERROR message level. This will typically be a much shorter file and is therefore easier to handle, but it may miss critical contextual information needed for the proper diagnosis of errors.

Besides case logs Intella Connect/Node will produce additional pair of log files with similar names, but starting with 'connect-' or 'node-' prefix. Those logs contain messages generated by the server and thus are not strictly related to a particular case (however they might contain traces leading to shared cases). Those logs can be used to inspect the state of the entire Intella Connect/Node server.

Your case log files are always stored in the logs subfolder of the case folder. Server log files are stored in C:\Users\<USERNAME>\AppData\Roaming\Intella Connect\logs. By searching your own log files for common error messages, you can often troubleshoot these common errors without need of contacting our support department.

To open very large log files, we suggest free tools such as Large Text File Viewer. This tool is optimized for viewing very large (> 1 GB) text files.

The following is a list of known error messages and their explanation and solution. Most of these errors have causes that are external to Intella Connect.

java.lang.OutOfMemoryError

Explanation: Intella Connect/Node has run out of memory while processing a file or index. This error can also happen on machines with lots of RAM, as each of Intella’s processes has a maximum amount of memory it is allowed to use.

Solution: increase memory settings for Intella Connect/Node.

Caveat: some out of memory errors are caused by corrupt documents and Intella may safely recover from this, so that the integrity of the case is not harmed. When in doubt, please send the error message and the 50 lines surrounding it to our support department.

java.io.IOException: The device is not ready

Explanation: the USB disk or network drive is not available to Intella.

Solution: process the case on an internal disk to see if this solves the issue. The network/external disk or the connection to it may not be reliable.

"Exception while processing stream of …​"

Explanation: the file being indexed may be corrupt.

Solution: check the file in its native application. java.io.IOException: An unexpected network error occurred

Explanation: your network is dropping connections.

Solution: move the case and evidence data to an internal drive and retry.

java.io.IOException: Access is denied

Explanation: you do not have the correct file or folder permissions.

Solution: ensure all permissions on the case files and evidence data are correct.

java.io.FileNotFoundException: X:FILE_NAME_AND_PATH (Access is denied)

Explanation: the file or folder is missing. Perhaps you have moved the case or evidence folder?

Solution: verify that the original data is where it should be.

java.io.IOException: There is not enough space on the disk

Explanation: Please check if you have sufficient drive space to continue. Note that heavily fragmented files can also cause such errors

Log files are useful in diagnosing problems or errors that may arise while using Intella Connect/Node. Intella Connect/Node records log files during all normal program operation, including indexing and exporting. In the default logging mode, Intella Connect/Node records basic operational messages and errors. The log files are stored in the “logs” folder inside the case folder.

When using the default suggested case folder, the log files are typically stored here:

C:\Users\<USERNAME>\AppData\Roaming\Intella\cases\<CASE NAME>\logs

Server log files are stored in:

C:\Users\<USERNAME>\AppData\Roaming\Intella Connect\logs.

The log files are case-main-[date].log, case-warnings-[date].log and any other *.log files located in mentioned directories. Note that the Intella Connect/Node tray icon has Server Logs and Case Logs options that takes you straight to the right folder, regardless of where it is located.

When an issue arises and the log files do not contain sufficient information to resolve the issue, you may wish to increase the logging level from basic (INFO) to a more detailed level (typically DEBUG). Intella Connect will then log actions and operations in more detail. Note that this will considerably increase the size of the resulting log files.

To increase the logging level for a particular case. please do the following:

Now share your Intella Connect case again. Logging will from now on report more detailed information.

Both Intella Connect and Intella Node use the same file name and location for logging configuration. To modify levels of server logs (Intella Connect and Intella Node), you can apply similar procedure to logback.xml file stored in:

C:\Users\<USERNAME>\AppData\Roaming\Intella Connect\conf

When changing the log level of server (Intella Connect and Intella Node), it is required to restart the server for the change to take effect.

Intella Connect can be configured to log HTTP header by using log headers filter:

<logger name="com.forensicsmatter.intella.server.icase.filters.LogHeadersFilter" level="DEBUG">

Note that the log header filter is logging on DEBUG level, so to see the HTTP headers, either root logger level needs to be set to DEBUG or log headers filter set to INFO. The latter can be done by adding logger mentioned above into logback.xml while changing level="DEBUG" to level="INFO".

Log files "roll over" every day at midnight. When a case is opened for the first time on a specific day, two new log files are made for that day. When you open the case another time on the same day, all log messages are appended to these files. When Intella still has the case open at midnight, it starts creating two new log files for the next day. When you keep track of when you indexed or exported information in the case, this split up will ease looking up the relevant log messages. This split up also prevents the log files from becoming too large to handle.

You can also choose a different log policy for Case and Server log files. For example, you could decide to split large log files into smaller (ex. 100mb) chunks, or clean them up automatically after they become older than provided. Since {product-name} delegates logging to the Logback library (https://logback.qos.ch), you have the option to take all the advantage of what it has to offer.

As an example, in order to limit the size of the log files which are produced, you could do the following:

This example will have an effect that any logs older than 30 days are deleted. You could also make use of other interesting options to better organize your logs:

You can find more information about them here: https://logback.qos.ch/manual/appenders.html

For administrators convenience, a Scan and Download Logs tool is included which scans case log files for common errors (see the "List of known errors" above). With this tool, it is possible to make a quick overview of possible problems with a case, the core server or Intella Node server. The log files can also be downloaded for further analysis without the need to manually access them on the server.

To use the Scan and Download Logs tool, navigate to System tab and Logs sub-tab.

To scan the logs, choose which location should get scanned: a particular case, the core server and/or Intella Node server. At least one location needs to be selected. A date rage can optionally be chosen, which limits the scanning to log events that fall in that date range. It is recommended to choose a date range, as the combined size of all log files can be substantial. Clicking the Scan button will start the scan in the background, and will show the progress of the scan.

Clicking the Download button will start packaging the files in the background. The results will be downloaded as a zip file containing the scanned log files.

If errors are found, then they will be shown below. Click on the "More information" button to see explanation and solution for each error.

When known errors were not found and you are still having errors which are not known, then you can download the log files below and send them to support@vound-software.com along with steps to replicate this error.

Added in version 2.7, administrators can now view the log files directly in the user interface. With this tool, administrators can look for possible problems with a case, the core server or Intella Node server. The log files can also be downloaded for further analysis without the need to manually access them on the server.

To use the Logs Viewing tool, navigate to System tab and View Logs sub-tab.

By default, latest logs from core server are shown. This can be changed by choosing which location should get scanned: a particular case, the core server and/or Intella Node server. Each location can have multiple log files. This is shown by a list of logs files. Selecting one of the log files will show its content.

The separator between logs list and content of the selected log can be moved, resizing the logs list and content panels.

The log files can be downloaded by checking the checkboxes for one or more log files from the list and then clicking on download button. Clicking the Download button at the bottom will start packaging the files in the background. The results will be downloaded as a zip file containing the selected log files.