DTLexplains - User Guide

Practical guide for analyzing recent Windows logs, understanding important signals and deciding what to do after reading a report.

Version: v1.0-4 Platform: Windows Reports: console, HTML, JSON

Purpose of this Guide

DTLexplains helps answer a simple question quickly: what do this computer's Windows logs say, and which events really deserve attention?

The tool reads recent Windows logs, groups similar events, classifies them by category, assigns an indicative severity and produces a readable report. This user guide explains how to obtain that report, how to read it and what actions to take afterward.

1. RunExecute the analysis on the computer to diagnose.

2. ReadStart with the console and the priority actions.

3. CheckOpen the HTML report to inspect details.

4. ActDocument, fix, monitor or escalate based on findings.

User Benefits

Benefit	What DTLexplains provides
Time savings	Events are grouped into families instead of being read line by line in Event Viewer.
Less noise	Frequent or generally benign events are separated from more important signals.
Educational reading	Each group receives a plain-language explanation and a suggested action.
Prioritization	The priority actions table helps start with the most useful findings.
Easy sharing	The HTML report can be attached to a ticket, sent to support or archived in an intervention folder.
Controlled caution	When an event is not yet documented by the DTLexplains knowledge base, the tool says so explicitly instead of inventing a cause.

Before Running the Analysis

DTLexplains is used directly on the Windows computer whose logs need to be examined. Application and System logs are usually readable by a standard user. The Security log may require a console opened with administrator rights.

Identify the useful period: recent incident, last few days, or broader review.
Close previous reports if you want to avoid confusing two analyses.
Choose a location where the HTML report can be kept if it must be attached to a ticket.
Use an administrator console if the Security log must be included reliably.

Tip. For an initial diagnosis, a short period is often easier to read. A longer period can reveal trends, but it also increases noise.

Quick Start

The standard launch analyzes the main Windows logs over the default period and produces a console summary plus an HTML report.

python -X utf8 DTLexplains.py

On screen, the tool shows a progress indicator while reading logs, then prints a short summary.

Analysis in progress ooooo done.

The console summary includes the machine, analyzed period, number of events read, number of groups detected and the path of the generated HTML report.

Useful Options

Need	Typical command	Effect
Limit the period	`python -X utf8 DTLexplains.py --days 7`	Analyzes only the last seven days.
Choose logs	`python -X utf8 DTLexplains.py --logs System Application`	Restricts the analysis to the specified logs.
Include information events	`python -X utf8 DTLexplains.py --include-info`	Adds Information-level events, which are often more numerous.
Choose the HTML report	`python -X utf8 DTLexplains.py --html reports\report.html`	Writes the HTML report to the requested location.
Create a JSON export	`python -X utf8 DTLexplains.py --json reports\report.json`	Adds a structured output usable by other tools.

The commands above are examples. The choice of period and logs depends on the diagnostic context.

Reading the Console Output

The console is intentionally short. It helps decide quickly whether to open the HTML report and which areas to inspect first.

Important elements

Events read: total volume extracted from the logs.
Groups detected: number of event families after grouping.
Distribution by category: occurrence distribution by technical area.
Priority actions: the first table to read in order to spot the most useful subjects.

A high occurrence count in a category is not automatically serious. It mainly indicates an area to examine. Severity and suggested action help separate what deserves immediate response from what should simply be monitored.

Reading the HTML Report

The HTML report is the complete reading view. It is organized from overview to detail.

Section	How to read it
Event summary	Look at the most populated categories and check whether the volume matches the machine context.
Direct access to details	Jump directly to a category when the summary or priority actions point to a specific area.
Priority actions	Read from top to bottom: severity, category, event, occurrence count and suggested action.
Event cards	Inspect the log, level, frequency, dates, explanation and associated Windows message.
Full text	Use the full-text option when the Windows message is longer than the displayed excerpt.

Important. Log messages remain in their original language. DTLexplains translates its own labels and explanations, but it does not translate text produced by Windows.

Actions After Reading the Report

A DTLexplains report is a diagnostic starting point. It should not lead to random changes on a computer. Follow-up depends on severity, repetition and the user symptom.

Finding	Recommended action
Urgent event	Check the context immediately, back up if a hardware risk is mentioned, then handle or escalate.
Frequent important event	Identify the affected component, look for nearby events and plan a targeted correction.
Isolated warning	Monitor and correlate with symptoms before making any change.
Normal or common event	Keep as a timeline element, with no direct action if no symptom matches.
Event not yet documented by the knowledge base	Do not conclude too quickly. Search for the provider and event ID, then compare with user context.

Possible concrete actions

Attach the HTML report to a support ticket.
Copy the priority actions table into an intervention note.
Compare the last occurrence date with the time of the user symptom.
Check nearby events within five to ten minutes around the incident.
Update a driver or component only when both the report and context clearly point to it.
Monitor for a few days after correction to confirm that occurrences disappear or decrease.

Typical Use Cases

Unstable computer or unexpected restarts

Start with the Hardware / disk / driver and Startup / power categories. Kernel-Power, bugcheck, WHEA or disk events should be compared with the exact time of the symptom.

Network or Wi-Fi problem

Review network, DNS, DHCP, SMB and adapter-driver events. An Intel Wi-Fi driver event, for example, may point to a driver, firmware or BIOS update rather than to a missing Windows setting.

Windows services failing

Read grouped Service Control Manager events. Events 7000 and 7009 can describe the same service startup failure together.

Updates or Microsoft Store

Check whether the error relates to Windows Update, WinREAgent, MSI or Microsoft Store. Some errors simply indicate that an application was open during its update.

Preparing an escalation

The HTML report provides a shareable summary: machine, period, logs analyzed, priority actions, Windows messages and occurrence timeline.

Reading Cautions

A Windows log naturally contains many warnings: not everything is a failure.
An isolated occurrence must be correlated with a symptom or incident time.
A high occurrence count may indicate a real issue, but also a noisy component.
Suggested actions are reasonable leads, not automatic orders.
Reports may contain account names, machine names, service names or local paths: share them carefully.

Good report reading combines three elements: the severity indicated by DTLexplains, the occurrence count and the actual context observed by the user or support team.