---
title: "Disturbance records and event logs"
---

# Disturbance records and event logs

List an IED's file store, download disturbance records whole into a folder and open them, delete files only when you allow it, read event logs by time, and get told when a relay makes a new record.

**Safety:** use a test relay or a test server on a test network only, never a relay in service.

**State:** verified against libiec61850 1.6.2's `server_example_files` and `server_example_logging` on Linux, with tshark 4.4.9 agreeing with what the client decoded: a file store of 12 COMTRADE files and 1,501 others listed exactly, a folder of 1,500 files read in 2 pages, every record downloaded byte for byte and read by the module's COMTRADE reader, and logged changes read by time. **Not run against any relay**: where real relays keep their records and how they name them is not verified. The new-record notification was tested with a model only; the example servers have no recorder.

## Disturbance records

With an IED connected (see [Connect to an IED](https://neuralinverse.com/docs/modules/energy/connect-online/)), the IED Online tab has a **Disturbance Records** section.

1. Optionally type a folder; leave it empty to list the whole file store. No fixed folder name for records was found in public sources, so nothing is assumed.
2. Press **List Records**. The files are listed page by page and grouped into records: the `.cfg`, `.dat`, `.hdr`, `.inf` and `.cff` files of one name in one folder (any letter case). A record that lacks a file says so, such as "no .dat file". Other files are listed apart.
3. Tick records and press **Download Selected...**, then pick a folder.
4. A progress notification shows each file and its bytes, with **Cancel**. Each file is read whole; a file not read whole is never saved.
5. If a file of that name is already in the folder, you choose **Replace**, **Keep Existing Files** or **Cancel**.
6. **Open** opens a downloaded record in the [COMTRADE](https://neuralinverse.com/docs/modules/energy/comtrade/) editor.

Downloads refuse names Windows treats as devices (`CON`, `COM1`) or changes (a trailing dot or space).

## Delete files on the IED

**Delete...** is not shown by default. Turn on `neuralInverse.energy.records.allowDelete` (**Neural Inverse Energy > Records: Allow Delete** in Settings) to offer it on each row. Each delete still asks first, naming the IED and the files, for example "Delete COMTRADE/feeder-fault from IED ...?". Cancel deletes nothing. Turn the setting off again when you are done.

## Event logs

The **Event Log** section reads the IED's logs (MMS journals):

1. Press **Read Logs**. The log control blocks are listed with their values (LogEna, LogRef, DatSet and others), and the logs to pick from.
2. Pick a log. Optionally give **From** and **To** times in UTC, such as `2026-10-12T19:38:21Z`.
3. Press **Read Entries**. The entries show as a table of time, entry ID, data reference, value and reason (such as `data-change`), read page by page.

A time that cannot be read is refused with the reason.

## New records

When a report this window enabled carries `RDRE.RcdMade` turning true, a notification says "<IED>: <LD>/RDRE1 made a new disturbance record (fault number n)." with **List Records**. Enable a report control block whose data set holds `RDRE.RcdMade` to receive it (see [Report control blocks](https://neuralinverse.com/docs/modules/energy/rcb/)).

## Size

On Linux, an IED file store of 1,000 records was measured: interactions under 100 ms and first renders under 300 ms.

## Limits

- Compressed records (`.zip`) are listed as other files.
- Vendor event report commands outside IEC 61850 are not used.

## Not verified

- Any relay or vendor server; record retrieval over TLS against a relay.
- A log that pages on a real server, and event and annotation entries.
- Windows paths for downloads (tested with Windows rules on Linux only).