update evidence; add busy actions analysis; parse out syslog continue lines