a real case of using evidence to do log analysis, still need clean code later