Trace Analysis Patterns (Part 208)

Most of the time tracing and logging is done sequentially, for example, when a service or application is restarted after the crash or bug fix, or the host is rebooted. Then we can glue all resulted traces together (similar to Glued Stack Trace) into one large Serial Trace. Here we assume the same Trace Schema for all individual traces and logs. It can also be considered as flattening a 2-dimensional Trace Tensor:

This allows us to apply various trace and log analysis patterns to the unified Serial Trace instead of doing Inter-Correlation (vs. Intra-Correlation).

Serial Trace is different from Meta Trace which is a trace about trace and Master Trace which is a trace we compare all other traces to. It is similar to Trace Mask when there is no overlap in time. Also, Serial Trace is not a reverse of Split Trace in a general case due to Visibility Limits between individual traces.

When gluing traces together, Ornament messages may be added to serve as a boundary between fragments.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Comments are closed.