Techniques to search logs that contain a massive number of entries are disclosed. In various embodiments, logs are pre-scanned incrementally to identify logs of interest. A log is identified as a log of interest based at least in part on a determination that the log satisfies a symptom definition associated with a symptom. A symptom pre-scan result is generated for those logs of interest that satisfy the symptom definition. The symptom pre-scan result is stored in a searchable pre-scan result data store.