Culprit module detection and signature back trace generation

• US 10,338,990 B2
• Filed: 01/25/2017
• Issued: 07/02/2019
• Est. Priority Date: 06/23/2016
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Khan, Ayoob, Gadi, Sowgandh Sunil
• Primary Examiner(s): Contino, Paul
• Application Number:
  US15/415,089
• Publication Number:
  US 20170371731A1
• Time in Patent Office: 888 Days
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/36 Preventing errors by testing or debugging software
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence
• CPC Class Codes: G06F 11/3664 Environments for testing or debugging software

Abstract

In a crash analysis system, a method for analyzing a core dump corresponding to a crash of a computer system is disclosed. A core dump is received wherein the core dump corresponds to a crash of a computer system. A culprit module responsible for the crash of the computer system is determined. A signature back trace, which pertains to a symptom of the crash of the computer system is generated.

Claims

1. A computer-implemented method for identifying a culprit module and for generating a signature back trace corresponding to a symptom of a crash of a computer system, said method comprising:

receiving a core dump at a crash analyzer, wherein said core dump corresponds to said crash of said computer system;

generating, at said crash analyzer, an essential stack of functions corresponding to said crash of said computer system;

determining a tag sequence and a tag depth corresponding to said essential stack of functions, at said crash analyzer;

deriving a list of permissible tag permutations corresponding to said computer system;

utilizing said tag sequence and said tag depth in combination with said list of permissible tag permutations, by said crash analyzer, to identify a culprit module responsible for said computer crash; and

generating a signature back trace from said essential stack of functions including at least one function corresponding to said culprit module, and providing said signature back trace as an output from said crash analyzer, wherein said signature back trace pertains to a symptom of said crash of said computer system.

2. The computer-implemented method as recited in claim 1, wherein said generating, at said crash analyzer, an essential stack of functions corresponding to said symptom of said crash of said computer system comprises:

generating a list of functions and corresponding tags pertaining to a culprit thread determined to be responsible for said crash of said computer system; and

redacting said list of functions to generate said essential stack of functions, wherein said essential stack of functions contains functions pertaining to said symptom of said crash of said computer system.

3. The computer-implemented method as recited in claim 1, wherein said deriving a list of permissible tag permutations corresponding to said computer system comprises:

analyzing said computer system to determine said permissible tag permutations associated with said computer system.

4. The computer-implemented method as recited in claim 1, wherein said generating a signature back trace from said essential stack of functions including said at least one function corresponding to said culprit module comprises:

compiling a list of functions selected from said essential stack to comprise said signature back trace, said list of functions including said at least one function corresponding to said culprit module, and at least one function not corresponding to said culprit module.

5. The computer-implemented method as recited in claim 1, wherein said generating a signature back trace from said essential stack of functions including said at least one function corresponding to said culprit module comprises:

including an offset of said at least one function corresponding to said culprit module in said signature back trace.

6. The computer-implemented method as recited in claim 1, wherein said generating a signature back trace from said essential stack of functions including said at least one function corresponding to said culprit module comprises:

including a size of said at least one function corresponding to said culprit module in said signature back trace.

7. The computer-implemented method as recited in claim 1, further comprising:

outputting the identity of said culprit module and said signature back trace, from said crash analyzer, to a repository accessible to support personnel.

8. In a crash analysis system which includes a crash report collector, a core dump generator, and a crash analyzer, a method for analyzing, at said crash analyzer, a core dump corresponding to a crash of a computer system, said method comprising:

receiving said core dump, wherein said core dump corresponds to said crash of said computer system;

determining a culprit module responsible for said crash of said computer system said determining said culprit module responsible for said crash of said computer system further comprises;

generating, at said crash analyzer, an essential stack of functions corresponding to said crash of said computer system;

determining a tag sequence and a tag depth corresponding to said essential stack of functions, at said crash analyzer;

deriving a list of permissible tag permutations corresponding to said computer system; and

utilizing said tag sequence and said tag depth in combination with said list of permissible tag permutations, by said crash analyzer, to identify a culprit module responsible for said computer crash; and

generating a signature back trace, wherein said signature back trace pertains to a symptom of said crash of said computer system.

9. The method of claim 8, wherein said generating said signature back trace further comprises:

accessing an essential stack of functions corresponding to said crash of said computer system;

including at least one function corresponding to said culprit module as part of said signature back trace; and

providing said signature back trace as an output from said crash analyzer, wherein said signature back trace pertains to said symptom of said crash of said computer system.

10. The method of claim 8, wherein said generating, at said crash analyzer, an essential stack of functions corresponding to said symptom of said crash of said computer system comprises:

generating a list of functions and corresponding tags pertaining to a culprit thread determined to be responsible for said crash of said computer system; and

redacting said list of functions to generate said essential stack of functions, wherein said essential stack of functions contains functions pertaining to said symptom of said crash of said computer system.

11. The method of claim 8, wherein said deriving said list of permissible tag permutations corresponding to said computer system comprises:

analyzing said computer system to determine said permissible tag permutations associated with said computer system.

12. The method of claim 9, wherein said generating a signature back trace comprises:

compiling a list of functions selected from said essential stack of functions to comprise said signature back trace, said list of functions including said at least one function corresponding to said culprit module, and at least one function not corresponding to said culprit module.

13. The method of claim 9, wherein said generating a signature back trace comprises:

including an offset of said at least one function corresponding to said culprit module in said signature back trace.

14. The method of claim 9, wherein said generating a signature back trace comprises:

including a size of said at least one function corresponding to said culprit module in said signature back trace.

15. The method of claim 8, further comprising:

outputting the identity of said culprit module and said signature back trace, from said crash analyzer, to a repository accessible to support personnel.