Trace Analysis Patterns (Part 111)
Monday, July 6th, 2015Sometimes we have messages that report about error but do not give exact details. For example, “Communication error. Problem at the server side” or “Access denied error”. This may be the case of Translated Messages. Such messages are plain language descriptions or reinterpretations of flags, error and status codes contained in another log message. These descriptions may be coming from system API, for example, FormatMessage from Windows API, or may be from custom formatting code. Since the code translating the message is in close proximity to the original message both messages usually follow each other with zero or very small Time Delta, come from the same component, file, function, and belong to the same Thread of Activity:
This pattern is different from Gossip because the latter messages come from different modules, and, although they reflect some underlying event, they are independent from each.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -