Disturbance records and event logs

Safety: use a test relay or a test server on a test network only, never a relay in service.

State: verified against libiec61850 1.6.2's server_example_files and server_example_logging on Linux, with tshark 4.4.9 agreeing with what the client decoded: a file store of 12 COMTRADE files and 1,501 others listed exactly, a folder of 1,500 files read in 2 pages, every record downloaded byte for byte and read by the module's COMTRADE reader, and logged changes read by time. Not run against any relay: where real relays keep their records and how they name them is not verified. The new-record notification was tested with a model only; the example servers have no recorder.

Disturbance records

With an IED connected (see Connect to an IED), the IED Online tab has a Disturbance Records section.

1. Optionally type a folder; leave it empty to list the whole file store. No fixed folder name for records was found in public sources, so nothing is assumed.
2. Press List Records. The files are listed page by page and grouped into records: the .cfg, .dat, .hdr, .inf and .cff files of one name in one folder (any letter case). A record that lacks a file says so, such as "no .dat file". Other files are listed apart.
3. Tick records and press Download Selected..., then pick a folder.
4. A progress notification shows each file and its bytes, with Cancel. Each file is read whole; a file not read whole is never saved.
5. If a file of that name is already in the folder, you choose Replace, Keep Existing Files or Cancel.
6. Open opens a downloaded record in the COMTRADE editor.

Downloads refuse names Windows treats as devices (CON, COM1) or changes (a trailing dot or space).

Delete files on the IED

Delete... is not shown by default. Turn on neuralInverse.energy.records.allowDelete (Neural Inverse Energy > Records: Allow Delete in Settings) to offer it on each row. Each delete still asks first, naming the IED and the files, for example "Delete COMTRADE/feeder-fault from IED ...?". Cancel deletes nothing. Turn the setting off again when you are done.

Event logs

The Event Log section reads the IED's logs (MMS journals):

1. Press Read Logs. The log control blocks are listed with their values (LogEna, LogRef, DatSet and others), and the logs to pick from.
2. Pick a log. Optionally give From and To times in UTC, such as 2026-10-12T19:38:21Z.
3. Press Read Entries. The entries show as a table of time, entry ID, data reference, value and reason (such as data-change), read page by page.

A time that cannot be read is refused with the reason.

New records

When a report this window enabled carries RDRE.RcdMade turning true, a notification says "<IED>: <LD>/RDRE1 made a new disturbance record (fault number n)." with List Records. Enable a report control block whose data set holds RDRE.RcdMade to receive it (see Report control blocks).

Size

On Linux, an IED file store of 1,000 records was measured: interactions under 100 ms and first renders under 300 ms.

Limits

• Compressed records (.zip) are listed as other files.
• Vendor event report commands outside IEC 61850 are not used.

Not verified

• Any relay or vendor server; record retrieval over TLS against a relay.
• A log that pages on a real server, and event and annotation entries.
• Windows paths for downloads (tested with Windows rules on Linux only).