TracingBook
From TracingWiki
The objective of this document is to explain the underlying principles and techniques available for tracing and dynamic program analysis in general. It is thus both an introduction to the domain and a survey of the commonly used tools. Each important aspect of dynamic program analysis is examined to explain the various techniques available and most frequently used, as well as the cost (in memory and execution time) and benefits of each. The dynamic program analysis frameworks available and in common usage are presented and their performance, features and usability are discussed.
Contents |
[edit] Introduction
Dynamic analysis consists in obtaining information at runtime to provide some interesting data for the users or developers either online or in a posteriori analysis. The main advantage of dynamic analysis is that it can theoretically access almost any information on the system behavior while it is running in real life production conditions. In practice, the information collection does disturb the system execution, but the disturbance may remain extremely small, possibly negligible, in many cases with the proper use of efficient algorithms and techniques.
The complete dynamic analysis process may be decomposed in several aspects, a section being devoted to each. Data providers are the basic mechanisms to access the needed data, for example by adding instructions to trace the execution of some program section, or by externally interrupting a program and sampling its program counter or other properties. This data must then be written to a trace buffer, accumulated in a counter and later written to disk, or sent through the network; this second aspect is called Data Collection and Transfer. Once the data is available either through a file on disk or through a stream (pipe, socket) it can be read by analysis tools. Data Analysis Tools can measure or identify a number of interesting properties or metrics, for example the state (of processes, CPUs or devices at any given time), the duration (of processes execution, disk requests) or the average (of CPUs or devices queue length) of some properties. The analysis tools may even detect patterns of interest (virtual memory trashing, disk input/output bottleneck, frequent network retransmissions or timeouts). The final component is the Data Visualization and Control Framework. This is where most of the user interaction normally takes place. Accordingly, while the other sections focus more on the underlying mechanisms, the section on frameworks examines in some depth the various frameworks currently available.
