Analyzing Problem Signatures

• US 20080301501A1
• Filed: 05/29/2007
• Published: 12/04/2008
• Est. Priority Date: 05/29/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Grant, David, Kommineni, Vamshidhar Radha
• Granted Patent: US 7,823,006 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

A method of analyzing problem data from a computer application is disclosed. The method evaluates a memory dump, identifying call stacks within the memory dump that are related to application failures, creates a hash of the identified call stack and adds the hash to a database. The database may then be evaluated to look for trends in the error data such as whether the same call stack is causing problems.

Claims

1. A method of analyzing problem data from a computer application comprising:

evaluating a memory dump;

identifying call stacks within the memory dump that are related to application failures;

creating a hash of the identified call stack; and

adding the hash to a database.

2. The method of claim 1, wherein creating a hash further comprises concatenating an application module name and function name for each frame as an input to the hash function.

3. The method of claim 2, wherein the hash classifies callstacks where symbols are available for all frames.

4. The method of claim 1, wherein creating a hash further comprises concatenating a module name and a function name along with a function offset in the module and using the result as an input to the hash function.

5. The method of claim 4, wherein the hash classifies callstacks where symbols are not available for all frames.

6. The method of claim 1, wherein creating a hash further comprises concatenating an application module name, function name and function'"'"'s offset in the module for each frame group wherein the frame group comprises a contiguous set of functions within the same module.

7. The method of claim 6, wherein the hash classifies frame group signatures.

8. The method of claim 7, wherein the frame group signatures are used to analyze mid-stack groups responsible for a crash or hang across multiple dumps.

9. The method of claim 1, further comprising performing data mining on the database to further analyze the problem data.

10. The method of claim 9, further comprising analyzing the database to identify problems that are most prevalent.

11. The method of claim 4, further comprising using the database of hashes to classify unique callstacks and probable code defects across a large number of memory dumps for issues for which valid symbols are not available.

12. The method of claim 6, further comprising using the hashes to classify mid-level functions across a range of memory dumps to identify common code paths that may be responsible for all of the crashes even it symbols are not available for all modules.

13. A computer storage medium storing computer executable code for analyzing problem data from a computer application, the computer executable code comprising:

evaluating a memory dump;

identifying call stacks within the memory dump that are related to application failures;

creating a hash of the identified call stack wherein creating a hash further comprises concatenating an application module name and function name for each frame as an input to the hash function; and

adding the hash to a database.

14. The computer storage medium of claim 13, wherein creating a hash further comprises concatenating a module name and a function name along with a function offset in the module and using the result as an input to the hash function.

15. The computer storage medium of claim 13, wherein creating a hash further comprises concatenating an application module name, function name and function'"'"'s offset in the module for each frame group wherein the frame group comprises a contiguous set of functions within the same module.

16. The computer storage medium of claim 13, further comprising performing data mining on the database to further analyze the problem data.

17. The computer storage medium of claim 14, further comprising using the database of hashes to classify unique callstacks and probable code defects across a large number of memory dumps for issues for which valid symbols are not available.

18. The computer storage medium of claim 15, further comprising using the hashes to classify mid-level functions across a range of memory dumps to identify common code paths that may be responsible for all of the crashes even if symbols are not available for all modules.

19. A computer system comprising a processor for executing computer executable instructions, a memory for storing computer executable instructions and an input output circuit, the processor being physically configured to execute computer executable code for analyzing problem data from a computer application, the computer executable code comprising code for:

evaluating a memory dump;

identifying call stacks within the memory dump that are related to application failures;

creating a hash of the identified call stack wherein creating a hash further comprises concatenating an application module name and function name for each frame as an input to the hash function;

adding the hash to a database; and

performing data mining analysis on the database to further analyze the problem data.

20. The computer system of claim 19, wherein creating a hash further comprises concatenating a module name and a function name along with a function offset in the module and using the result as an input to the hash function.