DTLexplains — Reference Manual

Descriptive reference for the NetDTL Suite educational analyzer for Windows event logs.

Type: Windows log analysis Language: Python Version: v1.0-4

Role

DTLexplains turns a large set of recent Windows events into a readable, classified and contextualized summary. The tool does not replace Event Viewer: it adds an educational layer that groups similar events, classifies them by technical area, assigns an indicative severity and provides a plain-language explanation.

Its purpose is to reduce the usual noise of Windows logs. Where raw logs show hundreds of heterogeneous entries, DTLexplains highlights useful signal families: storage, network, services, updates, security, applications, scripts and generally benign events.

Functional Scope

Area	Description
Log reading	Analysis of the main Windows logs, including Application, System, Security, Setup and Windows PowerShell.
Grouping	Aggregation of events by log, provider, identifier, level and specialized cases where several identifiers describe the same symptom.
Explanation	Association of an event with a knowledge rule when the provider / identifier / message combination matches a known case.
Prioritization	Ordering of groups by severity, frequency, Windows level and recency.
Presentation	Production of a console summary, a structured HTML report and, when needed, a JSON export usable by other tools.

Input Model

DTLexplains relies on the structured data exposed by Windows for each event. The following fields form the analysis foundation:

Field	Role in the analysis
Log	Defines the functional context of the event: system, application, security, setup or PowerShell.
Provider	Identifies the Windows or application component that produced the event.
Identifier	Allows recognition of a known case, such as a failed service, disk problem or Windows Update error.
Level	Indicates the severity declared by Windows: critical, error, warning or information.
Timestamp	Allows calculation of the first and last occurrence of a group.
Message	Preserves the native log text. This text is not translated in order to keep the exact information produced by Windows.

Analysis Engine

Normalization

Provider names and messages are normalized to make event-family recognition easier. This normalization is used for robust string comparison without modifying the original messages shown in the report.

Event Grouping

Identical or closely related events are grouped to avoid line-by-line repetition. A group preserves the occurrence count, first occurrence, last occurrence, related identifiers and a representative message.

Logical Merge

Some events are merged when they describe the same incident. Service Control Manager events 7000 and 7009 can therefore be presented as a single service-startup failure analysis, because they often describe two sides of the same symptom.

Knowledge Base

The knowledge base maps providers, identifiers and message fragments to explanations. When no specialized rule is available, DTLexplains uses a cautious wording: the event is known to Windows but not yet documented by the DTLexplains knowledge base, and its severity should not be inferred from that signal alone.

No.	Category	Typical content
1	Hardware / disk / driver	Storage, NTFS, disk controllers, WHEA errors, display, low-level drivers.
2	Startup / power	Unexpected shutdowns, Kernel-Power, bugchecks, startup and shutdown events.
3	Security / authentication	Logon failures, account changes, Security log clearing, traces useful for timelines.
4	Network / DNS / DHCP / SMB	IP configuration, name resolution, DHCP, SMB, network drivers, Schannel and network components.
5	Windows updates	Windows Update, WinRE maintenance, installation, servicing, MSI and update components.
6	Windows services	Service startup, stop, timeout, installation or configuration changes.
7	Applications	Crashes, hangs, Windows Error Reporting, AppX and application events.
8	PowerShell / scripts	Script errors, scheduled tasks, execution traces and PowerShell information.
9	Normal / common / generally benign	Frequent or informational events, mostly useful for reconstructing a timeline.

Prioritization

DTLexplains distinguishes functional severity from frequency. Severity summarizes the attention a group deserves; frequency indicates the observed intensity over the analyzed period.

Element	Values	Role
Severity	Urgent, important, watch, plan, normal.	Classifies events according to their potential impact and diagnostic interest.
Frequency	Very frequent, frequent, occasional, rare.	Qualifies repetition observed in the logs.
Score	Internal numeric value.	Combines severity, Windows level, occurrence count and recency to order groups.
Priority actions	Summary table.	Shows the non-normal groups most useful to review first.

Outputs

Output	Description
Console	Compact summary including the period, number of events read, distribution by category and priority actions.
HTML report	Complete report with summary, direct category access, event cards, explanation, suggested action, message excerpt and full text when needed.
JSON	Structured representation of groups, useful for archiving, integration or automated processing.

The HTML report preserves the original Windows messages. Explanations and labels produced by DTLexplains are kept separate from native log text in order to preserve the evidentiary value of collected events.

Internationalization

DTLexplains includes a bilingual French / English dictionary. The display language is determined automatically from the Windows interface language, with a fallback to the system locale.

Translated elements include titles, labels, categories, severities, frequencies, explanations and suggested actions. Messages coming from Windows logs are not translated because they belong to the diagnostic source.

Security and Privacy

DTLexplains reads local logs and produces local reports. Collected data may nevertheless include machine names, accounts, paths, service names, technical identifiers and excerpts from Windows messages.

The report should therefore be considered a potentially sensitive diagnostic document. The Security log may enrich the analysis, but this log may require elevated rights and may contain authentication or access-timeline information.

Limits

DTLexplains does not fix detected problems; it classifies and explains them.
Explanations are educational hypotheses based on rules, not definitive proof.
An isolated event may be insufficient to conclude the cause of an incident.
Diagnostic quality depends on available logs, their retention period and read permissions.
Specialized rules cover frequent cases and evolve with the knowledge base.
The score orders reading priority; it does not replace human analysis of the context.