pull mode from kernel log for re-analysis