System and method for troubleshooting runtime software problems using application learning

• US 8,032,866 B1
• Filed: 03/25/2004
• Issued: 10/04/2011
• Est. Priority Date: 03/27/2003
• Status: Active Grant

• Current Assignee: BMC Software Israel Ltd. (KKR & Co., Inc.)
• Original Assignee: Identify Software Limited (KKR & Co., Inc.)
• Inventors: Gusev, Vladislav, Golender, Valery
• Primary Examiner(s): Dam; Tuan Q
• Assistant Examiner(s): Smith; Cheneca
• Application Number:
  US10/808,760
• Time in Patent Office: 2,749 Days
• Field of Search: None
• US Class Current: 717/128
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/323 Visualisation of programs or trace data
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

Analysis of execution traces to identify execution problems is described. Analysis of the execution trace allows the user to detect application execution patterns. Each pattern represents a sequence of operations performed by the application. Some patterns correspond to normal execution of the application. Some patterns correspond to typical operations such as file opening, file saving, site browsing, mail sending. Diagnostic classes include patterns associated with certain malfunctions. In one embodiment, the system includes a learning mode wherein the system accumulates patterns belonging to different classes and stores them in a pattern database. In one embodiment, the system also includes a recognition mode where the system matches the trace against the pattern database and assigns trace regions to specific classes such as normal, abnormal, classes of specific problems or user activities, etc.

Claims

1. A method for analyzing execution traces of a computer program, comprising:

receiving a set of identifiers of situation classes as parameters;

accumulating execution patterns during execution of the computer program, the computer program being executed in accordance with the set of identifiers of situation classes;

associating at least some of the execution patterns with corresponding situation classes of the set of identifiers of situation classes to produce classified execution patterns;

storing the classified execution patterns in a database;

identifying a diagnostic-mode execution pattern while executing the computer program in a diagnostic mode;

identifying, using a computer processor, a classified execution pattern that matches the identified diagnostic-mode execution pattern to identify a situation class corresponding to the execution of the program in the diagnostic mode; and

providing an indication of the corresponding situation class, whereby the indication allows a user to assess abnormalities in the execution of the program in the diagnostic mode.

2. The method of claim 1, wherein associating at least some of the execution patterns with corresponding situation classes comprises classifying the execution patterns into normal and abnormal execution patterns, the abnormal execution patterns comprising a relatively high number of unknown patterns.

3. The method of claim 1, wherein one of the set of identifiers of situation classes is a file saving operation situation class, and wherein associating at least some of the execution patterns with corresponding situation classes of the arbitrary number of situation classes to produce classified execution patterns comprises associating at least one of the execution patterns with the file saving operation situation class.

4. The method of claim 1, wherein one of the set of identifiers of situation classes is a file opening operation situation class, and wherein associating at least some of the execution patterns with corresponding situation classes of the arbitrary number of situation classes to produce classified execution patterns comprises associating at least one of the execution patterns with the file opening operation situation class.

5. The method of claim 1, wherein one of the set of identifiers of situation classes is a site browsing operation situation class, and wherein associating at least some of the execution patterns with corresponding situation classes of the arbitrary number of situation classes to produce classified execution patterns comprises associating at least one of the execution patterns with the site browsing operation situation class.

6. The method of claim 1, wherein one of the set of identifiers of situation classes is a mail sending operation situation class, and wherein associating at least some of the execution patterns with corresponding situation classes of the arbitrary number of situation classes to produce classified execution patterns comprises associating at least one of the execution patterns with the mail sending operation situation class.

7. A method of analyzing execution traces of a computer program, comprising:

receiving a set of identifiers of situation classes as parameters;

accumulating execution patterns for an application during execution of the computer program in accordance with the set of identifiers of situation classes;

classifying the execution patterns by the set of identifiers of situation classes to produce classified execution patterns;

tracing execution patterns of a copy of said program being diagnosed;

comparing, using a computer processor, the traced execution patterns to the classified execution patterns to produce matching traced execution patterns and matching classified execution patterns;

identifying trace regions corresponding to the matching traced execution patterns; and

displaying trace regions according to a likelihood that said trace regions indicate improper execution of said copy of said program, wherein the likelihood is determined based at least in part on situation classes associated with the matching classified execution patterns.

8. The method of claim 7, wherein displaying trace regions according to a likelihood that said trace regions indicate improper execution of said copy of said program comprises determining which of said trace regions contain unknown patterns.

9. A system for analyzing execution trace data of a computer program, comprising:

a processor configured to operate in a learning mode wherein the processor maintains a user-defined number of execution classes as parameters, accumulates patterns of operations during execution of the computer program in accordance with the user-defined number of execution classes, and associates one of the user-defined number of execution classes with each of said patterns, said patterns stored in a pattern database; and

wherein said processor is further configured to operate in a recognition mode wherein the processor matches execution trace information against said patterns to identify one or more trace regions, the trace information being collected while executing a copy of the computer program during the recognition mode, the processor further associating each of said trace regions with an execution class corresponding to an execution class associated with a pattern.

10. The system of claim 9, wherein said learning mode comprises automatic learning.

11. The system of claim 9, wherein said learning mode comprises user-guided learning.

12. The system of claim 9, wherein a first trace region of said one or more trace regions is attributed to an abnormal execution class.

13. The system of claim 9, wherein a first trace region of said one or more trace regions is attributed to an abnormal execution class if said first trace region contains a relatively high density of unknown execution patterns.

14. The system of claim 9, wherein said system is configured to allow a user to delete patterns from said pattern database.

15. The system of claim 9, wherein said system is configured to allow a user to add patterns to said pattern database.

16. A method for application learning, comprising:

storing one or more user-defined execution categories as parameters;

collecting, using a computer processor, a learning mode trace log of an application, during execution of the application according to the execution classes, to produce trace data;

separating said trace data into logical streams;

generating patterns from said logical streams; and

storing said patterns in a pattern database, wherein each of the user-defined execution categories is associated with at least one of the stored patterns in the pattern database,

wherein the pattern database is configured to provide information sufficient to enable a processor to identify a pattern in a diagnostic mode trace log of the application being diagnosed that matches a pattern stored in the pattern database, and determine an execution category associated with the pattern in the pattern database.

17. The method of claim 16, further comprising:

displaying at least a portion of said learning mode trace log on a classified trace view for user evaluation;

selecting a region of said learning mode trace log as a user-selected region;

assigning said user-selected region to a first execution category; and

adding a pattern of said user-selected region and an indicator of said first execution category to said pattern database.

18. The method of claim 16, wherein said logical streams are separated at least according to application.

19. The method of claim 16, wherein said logical streams are separated at least according to thread.

20. The method of claim 16, wherein said logical streams are separated at least according to application users.

21. A computer-implemented method for evaluating execution trace data, comprising:

separating trace data into one or more logical streams;

receiving a set of user-defined situation class identifiers that identify situation classes in which a computer program may be executed;

filling a stream history array from at least a portion of data in a first logical stream to define a pattern, the data in the first logical stream being generated based on execution of the computer program in accordance with one of the situation classes;

adding said pattern to a pattern database as a new pattern if said pattern does not already not exist in said pattern database; and

associating with said new pattern the user-defined situation class identifier corresponding to the situation class in accordance with which the computer program was executed,

wherein the pattern database is configured to provide information sufficient to enable a processor to identify a pattern in a trace log of a copy of the computer program being diagnosed that matches a pattern stored in the pattern database, and determine a user-defined situation class identifier associated with the pattern in the pattern database.

22. The method of claim 21, wherein said streams are separated according to different threads.

23. The method of claim 21, wherein said streams are separated according to different processes.

24. The method of claim 21, wherein said streams are separated according to different applications.

25. The method of claim 21, wherein said streams are separated according to different software components.

26. The method of claim 21, wherein at least one of said situation class identifiers corresponds to a normal execution class.

27. The method of claim 21, wherein at least one of said situation class identifiers corresponds to an abnormal execution class.

28. A method for analyzing execution trace information of a computer program being diagnosed, comprising:

maintaining a pattern database comprising stored patterns gathered during execution of the computer program during a learning mode in accordance with an arbitrary number of situation classes, the situation classes being user-defined and passed as a parameter, wherein the stored patterns are associated with corresponding situation classes based on the execution of the computer program;

separating trace data gathered from the computer program being diagnosed into one or more logical streams;

identifying a match between at least a portion of data in a first logical stream and a stored pattern in the pattern database; and

displaying a situation class associated in the pattern database with said stored pattern in connection with said at least a portion of data.

29. The method of claim 28, wherein said streams are separated according to different threads.

30. The method of claim 28, wherein said streams are separated according to different processes.

31. The method of claim 28, wherein said streams are separated according to different applications.

32. The method of claim 28, wherein said streams are separated according to different software components.

33. The method of claim 28, wherein said situation class corresponds to a normal execution class.

34. The method of claim 28, wherein said situation class corresponds to an abnormal execution class.

35. The method of claim 28, wherein said displaying includes color-coding to indicate a situation class of said at least a portion of data.

36. The method of claim 28, wherein said displaying includes displaying said at least a portion of data in a trace tree.

37. The method of claim 36, wherein said displaying includes labeling of nodes assigned to the same situation class.

38. The method of claim 36, wherein said displaying includes displaying event sequence zones.