Operating system event tracker having separate storage for interrupt and non-interrupt events and flushing the third memory when timeout and memory full occur

• US 6,785,893 B2
• Filed: 11/30/2000
• Issued: 08/31/2004
• Est. Priority Date: 11/30/2000
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Thomson, Michael J., Tanner, Jonathan M., Sauntry, David M., Morris, Larry A., Shepard, Marc, Eldridge, John R., Dey, Susan A.
• Primary Examiner(s): An, Meng-Al T.
• Assistant Examiner(s): ANYA, CHARLES E
• Application Number:
  US09/726,907
• Publication Number:
  US 20020065948A1
• Time in Patent Office: 1,370 Days
• Field of Search: 709/100-108, 709/318-32, 710/1-74, 714/1-57, 717/124-133, 719/318
• US Class Current: 719/318
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/348 Circuit details, i.e. tracer hardware
• CPC Class Codes: G06F 2201/86 Event-based monitoring

Abstract

A system and method for logging events processed by an operating system is provided. The events logged can include interrupt and non-interrupt events, and can include user-defined events. Information concerning the interrupt events is initially written, during event handling time, into a first buffer while information concerning non-interrupt events is initially written, during event handling time, into a second buffer. Information from the two buffers is then written to a third buffer not during event handling time. Separating the interrupt event buffer from the non-interrupt event buffer rather than having one buffer, and writing relatively small amounts of data during event handling time to memory, rather than transporting data to slower non-memory mapped devices allows the event logger to be less intrusive and facilitates greater accuracy in event logging. Data stored in the third buffer can be accessed by a viewing component, which facilitates displaying data in a manner useful to diagnose operating systems.

Claims

1. A system for logging operating system events, comprising:

a first memory for storing first data associated with an interrupt event;

a second memory for storing second data associated with a non-interrupt event;

one or more components for storing data in the first memory and the second memory;

one or more components for moving the first data from the first memory to a third memory and the second data from the second memory to the third memory; and

a first flushing component for flushing data from the third memory upon at least one of the third memory becoming substantially full and a timeout condition occurring.

2. The system of claim 1, wherein the one or more components for moving the first data from the first memory to the third memory move the first data upon execution of an event handler associated with handling the event being completed.

3. The system of claim 1, wherein the one or more components for moving the second data from the second memory to the third memory move the second data upon at least one of execution of an event handler associated with handling the event being completed and the second memory becoming substantially full.

4. The system of claim 1, wherein the one or more components for moving the first data and the second data are software processes.

5. The system of claim 1, wherein the first memory, the second memory and the third memory are located in a physical machine running an operating system being monitored.

6. The system of claim 5, wherein the third memory is a ring buffer stored in random access memory (RAM).

7. The system of claim 1, wherein the one or more components for moving the first data from the first memory and the second data from to second memory are hardware devices.

8. The system of claim 1, wherein the first memory, the second memory and the third memory are located in a physical machine not running an operating system being monitored.

9. The system of claim 1, further including a transporting component for transporting the data from the third memory, to facilitate display thereof, upon at least one of the third memory becoming full and/or a process timeout occurring.

10. The system of claim 1, wherein data stored in the third memory is moved from the third memory to one or more data communications devices.

11. The system of claim 1, wherein the data stored into third memory is arranged so that the first data associated with interrupt events and that the second data associated with non-interrupt events are in chronological order according to when the events were handled by the operating system.

12. The system of claim 1, further comprising a timer component operable to associate a time stamp with at least one of an interrupt event and a non-interrupt event.

13. The system of claim 1, wherein at least one of the first data in the first memory and to second data in the second memory includes a time stamp associated with when the event occurred.

14. The system of claim 1, wherein the non-interrupt events include user-defined events.

15. The system of claim 1, further comprising a user interface, the user interface operable to facilitate selecting one or more events to be logged.

16. The system of claim 1, further comprising an application programming interface (API) operable to facilitate selecting one or more events to be logged.

17. The system of claim 1, wherein the one or more components for moving the second data from the second memory to the third memory are further operable to determine that moving the second data from the second memory to the third memory did not complete successfully.

18. The system of claim 17, the one or more components for moving the second data from the second memory to the third memory further operable to retry moving the second data from the second memory to the third memory upon a determination that moving the second data from the second memory to the third memory did not complete successfully.

19. The system of claim 1, further comprising a viewing component for viewing data associated with one or more interrupt and non-interrupt events.

20. The system of claim 19, the viewing component operable to facilitate diagnosing problems associated with at least one of, an operating system, a device driver, and an application program.

21. The system of claim 19, the viewing component operable to run in at least one of a real time mode and a file displaying mode.

22. The system of claim 19, the viewing component operable to run in a limited buffer mode.

23. The system of claim 19, the viewing component operable to facilitate visualization of one or more time based thread interactions.

24. The system of claim 23, the viewing component thither operable to facilitate visualization of events associated with the one or more time based thread interactions.

25. The system of claim 19, the viewing component operable to facilitate selectively displaying N event types, N being an integer, from an available M event types, M being an integer greater than or equal to N.

26. The system of claim 19, the viewing component operable to facilitate searching for one or more events from the interrupt and non-interrupt events.

27. The system of claim 1, wherein the operating system being monitored runs on one or more embedded devices.

28. The system of claim 1, wherein the operating system being monitored is Windows CE.

29. A method for logging operating system kernel events, comprising:

storing interrupt data associated with interrupt events in an interrupt buffer;

storing non-interrupt data associated with non-interrupt events in a non-interrupt buffer;

flushing the interrupt data to a secondary buffer; and

flushing the non-interrupt data to the secondary buffer, wherein the non-interrupt data is flushed to the secondary buffer upon at least one of the non-interrupt buffer becoming substantially full and event handling associated with the non-interrupt event completing, the flushing not occurring during interrupt handling time.

30. The method of claim 29, wherein the interrupt data is flushed to the secondary buffer alter the interrupt processing completes and not during interrupt handling time.

31. The method of claim 29, further comprising flushing the secondary buffer upon at least one of the secondary buffer becoming substantially full and the occurrence of a time out condition, the flushing not occurring during interrupt handling time.

32. The method of claim 29, further comprising associating a Urns stamp with at least one of the interrupt data and the non-interrupt data.

33. The method of claim 29, wherein at least one of the interrupt events and the non-interrupt events are selectively logged.

34. The method of claim 33, wherein the interrupt and non-interrupt events to log are determined by at least one of choices made in response to a User Interface (UI) and one or more calls made to an Application Programming Interface (API).

35. The method of claim 29, further comprising, storing non-interrupt data associated with user-defined non-interrupt events in the non-interrupt buffer.

36. The method of claim 29, wherein flushing the non-interrupt data to the secondary buffer further comprises determining whether the flushing completes without interruption.

37. The method of claim 29, wherein flushing the non-interrupt data to the secondary buffer further comprises re-flushing the non-interrupt data to the secondary buffer upon a determination that the flushing did not complete without interruption.

38. The method of claim 29, further comprising controlling the a flow of events to an operating system.

40. The method of claim 29, further comprising displaying data associated with interrupt and non-interrupt events.

41. The method of claim 40, the data being displayed in at least one of a real time mode and a file displaying mode.

42. The method of claim 40, the data to be displayed being stored in a buffer of a ps-determined size, the size determinable by a user of the method.

43. The method of claim 29, wherein the operating system being monitored bans on one or more embedded devices.

44. The method of claim 29, wherein the operating system being monitored is Windows CE.

39. The method of 38, further comprising generating an interrupt when the secondary buffer is substantially full.

45. A computer readable medium storing computer executable components of a system for triple buffering information associated with events handled by an operating system kernel, comprising:

one or more computer executable components for storing first data associated with interrupt events in a first memory;

one or more computer executable components for storing second data associated with non-interrupt events in a second memory;

one or more components for moving the first data from the first memory to the third memory and the second data from the second memory to a third memory; and

a flushing component for flushing data from the third memory upon at least one of the third memory becoming substantially full and a timeout condition occurring, the flushing not occurring during interrupt handling time.

46. A computer readable medium storing computer executable instructions operable to execute a method for logging operating system kernel events, the method comprising:

storing interrupt data associated with interrupt events in an interrupt buffer;

storing non-interrupt data associated with non-interrupt events in a non-interrupt buffer;

flushing the interrupt data to a secondary buffer, the flushing not occurring during interrupt handling time; and

flushing the non-interrupt data to the secondary buffer, the flushing not occurring during interrupt handling time, and transporting data in the secondary buffer to facilitate display thereof, upon at least one of the secondary buffer becoming full and/or a process timeout occuring.

47. A data packet for logging operating system events adapted to be transmitted from a first system to a second system comprising:

at least one of interrupt data associated with interrupt events, the interrupt data being stored in a first memory; and

at least one of non-interrupt data associated with non-interrupt events, the non-interrupt data being stored in a second memory, and a component for transporting data in the first memory and the second memory to facilitate display thereof, upon at least one of the first memory and the second memory becoming full and/or a process timeout occurring.

48. A system for logging operating system kernel events, comprising:

means for logging interrupt events to an interrupt buffer;

means for logging non-interrupt events to a non-interrupt buffer;

means for copying data in the interrupt buffer to a secondary buffer; and

means for copying data in the non-interrupt buffer to the secondary buffer, and a means for transporting data in the first memory and the second memory to facilitate display thereof, upon at least one of the first memory and the second memory becoming full and/or a process timeout occurring.

49. The system of claim 48, further comprising means for viewing the contents of the secondary buffer.

50. The system of claim 48, further comprising means for choosing at least one of interrupt events and non-interrupt events to be logged.

51. The system of claim 48, further comprising means for time stamping events that are logged.