AUTOMATIC SOFTWARE FAULT DIAGNOSIS BY EXPLOITING APPLICATION SIGNATURES

• US 20100100774A1
• Filed: 10/22/2008
• Published: 04/22/2010
• Est. Priority Date: 10/22/2008
• Status: Active Grant

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Shaikh, Anees A., Sahu, Sambit, Huang, Hai, Jennings, Raymond B. III, Roan, Yaoping, Ding, Xiangdong
• Granted Patent: US 7,877,642 B2
• Time in Patent Office: Days
• US Class Current: 714/45
• CPC Class Codes: G06F 11/3636 by tracing the execution of the program
• CPC Class Codes: G06F 16/23 Updating

Abstract

A method monitors non-faulty application traces of a computer application with the runtime environment during fault-free activities to create non-faulty runtime signatures for the computer application. Once obtained, the method stores the non-faulty runtime signatures. The method then detects a faulty application trace of the computer application and compares the faulty application trace with the non-faulty runtime signatures by comparing a call graph of the faulty application trace with call graphs of non-faulty application traces of the application signatures to identify differences between the two (e.g., fault attributes). Then the invention outputs the fault attributes to allow the user to identify a fault cause.

Claims

1. A method of automating runtime failure analysis for a computer application:

operating within a runtime environment, the method comprising;

monitoring non-faulty application traces of said computer application with said runtime environment during fault-free activities to create non-faulty runtime signatures for said computer application;

storing said non-faulty runtime signatures;

detecting a faulty application trace of said computer application,

comparing said faulty application trace with said non-faulty runtime signatures to identify fault attributes; and

outputting said fault attributes.

2. The method according to claim 1, said monitoring of said non-faulty application traces provides non-faulty attributes of said computer application, said method further comprising:

sorting said non-faulty attributes into groups of attributes;

merging said groups of attributes to form said application signatures; and

removing runtime variants from said application signatures.

3. The method according to claim 1, said monitoring of said non-faulty application traces provides information regarding system calls, including system call number, parameters, return value and error number;

signal numbers;

environment names and values;

resource limits;

access control attributes including user and group identification values; and

a call graph of system calls.

4. The method according to claim 1, said monitoring of said non-faulty application traces comprises generating a call graph of system calls in a process comprising:

adding a node to said call graph for each system call based on a system call memory context indicating from where within said computer application each system call was invoked;

adding an arc from a parent node to each newly added node; and

merging nodes of the same system call type having the same parent node.

5. The method according to claim 1, said comparing comprising comparing a call graph of said faulty application trace with call graphs of non-faulty application traces of said application signatures.

6. The method according to claim 1, further comprising ranking said fault attributes found by assigning a higher weight to fault attributes found earlier relative to fault attributes found later.

7. A method of automating runtime failure analysis for a computer application operating within a runtime environment, the method comprising:

monitoring non-faulty application traces of said computer application with said runtime environment during fault-free activities to create non-faulty runtime signatures for said computer application, said non-faulty application traces comprising interactions between said computer application and said runtime environment, said non-faulty application traces being gathered during multiple runs of said computer application;

storing said non-faulty runtime signatures;

detecting a faulty application trace of said computer application, said faulty application trace comprising interactions between said computer application and said runtime environment;

comparing said faulty application trace with said non-faulty runtime signatures to identify fault attributes; and

outputting said fault attributes.

8. The method according to claim 7, said monitoring of said non-faulty application traces provides non-faulty attributes of said computer application, said method further comprising:

sorting said non-faulty attributes into groups of attributes;

merging said groups of attributes to form said application signatures; and

removing runtime variants from said application signatures.

9. The method according to claim 7, said monitoring of said non-faulty application traces provides information regarding system calls, including system call number, parameters, return value and error number;

signal numbers;

environment names and values;

resource limits;

access control attributes including user and group identification values; and

a call graph of system calls.

10. The method according to claim 7, said monitoring of said non-faulty application traces comprises generating a call graph of system calls in a process comprising:

adding a node to said call graph for each system call based on a system call memory context indicating from where within said computer application each system call was invoked;

adding an arc from a parent node to each newly added node; and

merging nodes of the same system call type having the same parent node.

11. The method according to claim 7, said comparing comprising comparing a call graph of said faulty application trace with call graphs of non-faulty application traces of said application signatures.

12. The method according to claim 7, further comprising ranking said fault attributes found by assigning a higher weight to fault attributes found earlier relative to fault attributes found later.

13. A method of automating runtime failure analysis for a computer application operating within a runtime environment, the method comprising:

monitoring non-faulty application traces of said computer application with said runtime environment during fault-free activities to create non-faulty runtime signatures for said computer application, said non-faulty application traces comprising interactions between said computer application and said runtime environment, said non-faulty application traces being gathered during multiple runs of said computer application;

storing said non-faulty runtime signatures;

detecting a faulty application trace of said computer application, said faulty application trace comprising interactions between said computer application and said runtime environment;

comparing said faulty application trace with said non-faulty runtime signatures by comparing a call graph of said faulty application trace with call graphs of non-faulty application traces of said application signatures to identify fault attributes;

ranking said fault attributes based on;

giving more weight to fault attributes that are invariants and comprise fault attributes with a constant value; and

giving more weight to fault attributes located closer to a head of said call graph of said faulty application trace; and

outputting said fault attributes.

14. The method according to claim 13, said monitoring of said non-faulty application traces provides non-faulty attributes of said computer application, said method further comprising:

sorting said non-faulty attributes into groups of attributes;

merging said groups of attributes to form said application signatures; and

removing runtime variants from said application signatures.

15. The method according to claim 13, said monitoring of said non-faulty application traces provides information regarding system calls, including system call number, parameters, return value and error number;

signal numbers;

environment names and values;

resource limits;

access control attributes including user and group identification values; and

a call graph of system calls.

16. The method according to claim 13, said monitoring of said non-faulty application traces comprises generating a call graph of system calls in a process comprising:

adding a node to said call graph for each system call based on a system call memory context indicating from where within said computer application each system call was invoked;

adding an arc from a parent node to each newly added node; and

merging nodes of the same system call type having the same parent node.

17. A computer program storage device comprising a computer storage medium readable by computer, storing instructions executable by said computer to perform a method of automating runtime failure analysis for a computer application operating within a runtime environment, said method comprising:

monitoring non-faulty application traces of said computer application with said runtime environment during fault-free activities to create non-faulty runtime signatures for said computer application;

storing said non-faulty runtime signatures;

detecting a faulty application trace of said computer application,

comparing said faulty application trace with said non-faulty runtime signatures to identify fault attributes; and

outputting said fault attributes.

18. The computer program storage device according to claim 17, said monitoring of said non-faulty application traces provides non-faulty attributes of said computer application, said method further comprising:

sorting said non-faulty attributes into groups of attributes;

merging said groups of attributes to form said application signatures; and

removing runtime variants from said application signatures.

19. The computer program storage device according to claim 17, said monitoring of said non-faulty application traces provides information regarding system calls, including system call number, parameters, return value and error number;

signal numbers;

environment names and values;

resource limits;

access control attributes including user and group identification values; and

a call graph of system calls.

20. The computer program storage device according to claim 17, said monitoring of said non-faulty application traces comprises generating a call graph of system calls in a process comprising:

adding a node to said call graph for each system call based on a system call memory context indicating from where within said computer application each system call was invoked;

adding an arc from a parent node to each newly added node; and

merging nodes of the same system call type having the same parent node.