Dynamic rule-based automatic crash dump analyzer

• US 9,529,662 B1
• Filed: 07/31/2015
• Issued: 12/27/2016
• Est. Priority Date: 07/31/2015
• Status: Active Grant

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Wangkhem, Karnajit, Ghetiya, Rupin, Jaiswal, Ghisiawan Prasad
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US14/815,094
• Time in Patent Office: 515 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0748 in a remote unit communicating with a single-box computer node experiencing an error/fault remote testing G06F11/2294
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

A method and system for dynamic rule-based automatic crash dump analysis are described. In an example, a dynamic rule-based crash dump analysis system retrieves debug symbol data, rules, and commands from a server over a network. The actions are executed based on the retrieved rules in order to automatically analyze a crash dump using a debugger and the debug symbol data. During the process of analyzing the crash dump, the system parses output from the debugger for further rule processing and creates a human-readable analysis file from the parsed output.

Claims

1. A method of crash dump analysis, the method being implemented by one or more processors and comprising:

retrieving debug symbol data, rules, and actions from a server over a network;

based on the retrieved rules, executing corresponding actions to automatically analyze a crash dump from a computer system which experienced a software or hardware fault, the analysis using a debugger and the debug symbol data;

in response to analyzing the crash dump, parsing output from the debugger for further rule processing; and

creating a human-readable analysis file based on the analyzed crash dump from the parsed output.

2. The method of claim 1, wherein the actions are generic and not specific to the debugger.

3. The method of claim 2, further comprising adapting the actions into a format compatible with the debugger.

4. The method of claim 1, wherein the retrieved rules and actions are contained in an XML decision tree.

5. The method of claim 4, further comprising:

parsing the rules and actions from the XML decision tree; and

retrieving objects associated with the rules and actions from a database.

6. The method of claim 1, wherein parsing output from the debugger for further rule processing uses forward-chaining approach until all solvable rules are solved.

7. The method of claim 1, wherein the debugger creates a symbol table using the retrieved debug symbol data.

8. The method of claim 1, wherein the retrieved debug symbol data is insufficient to create a symbol table and the debugger requests further debug symbol data from the server over the network as needed during the crash dump analysis.

9. A crash dump analysis system comprising:

a memory resource to store instructions;

one or more processors using the instructions stored in the memory resource to;

retrieve debug symbol data, rules, and actions from a server over a network;

based on the retrieved rules, execute corresponding actions to automatically analyze a crash dump from a computer system which experienced a software or hardware fault, the analysis using a debugger and the debug symbol data;

in response to analyzing the crash dump, parse output from the debugger for further rule processing; and

create a human-readable analysis file based on the analyzed crash dump from the parsed output.

10. The system of claim 9, wherein the actions are generic and not specific to the debugger.

11. The system of claim 10, further comprising instructions to adapt the actions into a format compatible with the debugger.

12. The system of claim 9, wherein the retrieved rules and actions are contained in an XML decision tree.

13. The system of claim 12, further comprising instructions to:

parse the rules and actions from the XML decision tree; and

retrieve objects associated with the rules and actions from a database.

14. The system of claim 9, wherein parsing output from the debugger for further rule processing uses forward-chaining approach until no more matching rules remain.

15. The system of claim 9, wherein the debugger creates a symbol table using the retrieved debug symbol data.

16. The system of claim 9, wherein the retrieved debug symbol data is insufficient to create a symbol table and the debugger requests further debug symbol data from the server over the network as needed during the crash dump analysis.

17. A non-transitory computer-readable medium that stores instructions, executable by one or more processors, to cause the one or more processors to perform operations that comprise:

retrieving debug symbol data, rules, and actions from a server over a network;

based on the retrieved rules, executing corresponding actions to automatically analyze a crash dump from a computer system which experienced a software or hardware fault, the analysis using a debugger and the debug symbol data;

in response to analyzing the crash dump, parsing output from the debugger for further rule processing; and

creating a human-readable analysis file based on the analyzed crash dump from the parsed output.

18. The non-transitory computer-readable medium of claim 17, wherein the actions are generic and not specific to the debugger.

19. The non-transitory computer-readable medium of claim 18, further comprising adapting the actions into a format compatible with the debugger.

20. The non-transitory computer-readable medium of claim 17, wherein the retrieved rules and actions are contained in an XML decision tree.