What is a software trace from a mathematical standpoint? Before any software writes its trace data, it assembles it in memory. Therefore, generally, a software trace is a linear ordered sequence of specifically prepared memory fragments (trace statements):
(ts1, ts2, …, tsn)
where every tsi is a sequence of bits, bytes or other discrete units (see the definition of a memory dump):
(s11, s12, …, s1k, s21, s22, …, s2l, …, …, …, sn1, sn2, …, snm)
These trace statements can also be minidumps, selected regions of memory space. In the limit, if every tsi is a full memory snapshot saved at an instant of time (ti) we have a sequence of memory dumps:
(mt1, mt2, …, mtn)
Like with memory dump analysis we need symbol files to interpret saved memory fragments unless they were already interpreted during their construction. For example, traces written according ETW specification (Event Tracing for Windows), need TMF files (Trace Message Format) for their interpretation and viewing. Usually these files are generated from PDB files and therefore we have this correspondence:
memory dump file -> software trace file
PDB file -> TMF file
- Dmitry Vostokov @ TraceAnalysis.org -