Archive for the ‘Software Trace Diagramming’ Category

Trace Analysis Patterns (Part 258)

Sunday, June 7th, 2026

Usually, software traces and logs are sorted by time.

Spatial Form is a specialized Sorted Trace in which trace or log messages are sorted by spatial, topological, or diagnostic proximity to a chosen origin component, device, process, service, or subsystem. Instead of reading the trace solely as a chronological sequence, we choose a diagnostic origin and arrange messages by their distance from that origin. Within each distance layer, the original local time order may still be preserved.

The pattern name comes from Joseph Frank’s The Idea of Spatial Form that is associated with reading narrative structure through juxtaposition and relational arrangement rather than only through linear chronological progression; the concept was introduced into literary discussion through his 1945 essay and later collected with reconsiderations in his book.

Sorted Trace is the more general pattern: messages are sorted according to some attribute value, for example, by TID, ATID, message type, message invariants, or message data.

For Spatial Trace, the distance may come from network topology, service dependency graph, component containment, process/thread ownership, device hierarchy, pipeline stage distance, proxy/gateway chain, address-space relation, storage or shard topology, causal adjacency, and many others. The resulting trace is not anti-temporal. It is spatially primary and temporally secondary.

Spatial Trace analysis pattern may help answer these questions: What happened around this proxy? Which nearby component first showed abnormal behavior? How did the request propagate outward? Was the fault local, adjacent, or remote? It may help distinguish local symptoms, adjacent symptoms, downstream effects, remote dependencies, and external causes. It gives the trace a layered diagnostic structure and spatial Layered Periodization. The pattern is therefore both a sorting technique and a reading strategy.

This pattern is especially useful for distributed systems, microservices, network devices, storage stacks, cloud control planes, request pipelines, proxies, gateways, and agentic AI workflows where activity is spread across many components.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Trace Analysis Patterns (Part 246)

Wednesday, June 19th, 2024

Trace Sketch embodies Dia|gram language approach: in essence each trace and log analysis pattern illustration is a sketch. For example, a WinDbg log is represented as sequence of different Activity Regions:

Another example of Trace Sketch is Trace Skeleton.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Trace Analysis Patterns (Part 230)

Monday, March 6th, 2023

Inspired by Laws of Form and works inspired by it including Story and Structure we introduce Iconic Trace symbolic mapping for individual messages, Activity Regions, Motives, and Activity Theatre. A typical example is illustrated in the following diagram:

It is also possible to construct Iconic CoTraces. We will provide different symbolic profiles (with the meaning of various symbols) and examples later in the forthcoming revision of Software Narratology.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Trace Analysis Patterns (Part 193)

Thursday, July 30th, 2020

If we take Combed Trace for Thread of Activity or some Adjoint Thread of Activity, strip other message content, and then trace all non-empty values we get Trace Contour:


- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Trace Analysis Patterns (Part 133)

Friday, September 30th, 2016

In Adjoint Message analysis pattern description we mentioned compressing message sequences having the same message attribute into one message. Considering the trace as “topological” space and message attribute as “equivalence” relation we introduce Quotient Trace analysis pattern by analogy with quotient space in topology. By endowing message sequences having the same attribute with some “metric” such as cardinality of Message Set we can also visually distinguish resulted quotient messages if they have the same attribute but from different sequences at different times. All this is illustrated in the following diagram:

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Trace Analysis Patterns (Part 82)

Monday, May 5th, 2014

So far we have been discussing trace analysis patterns related to execution of a particular software version. However, software code changes and also its tracing and logging output: from large scale changes where components are replaced to small scale code refactoring affecting message structure and format. On a software narratological level this corresponds to a narrative about a software trace or log, it evolution. Such Meta Trace analysis pattern is different from Master Trace pattern where the latter is similar to what Metanarrative is usually meant in narratology: a master or grand idea - an expected trace if all functional requirements were correctly identified and implemented during software construction and non-functional ones are met during software execution.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Software Trace Diagrams (STDiagrams)

Tuesday, July 3rd, 2012

When depicting trace analysis patterns I used two-dimensional diagrams based on CDF (ETW) traces such as this one for a bifurcation point:

While working today on a new pattern I needed a new expressive way to graphically illustrate the same idea of trace bifurcation points but without too much drawing. Traces from particle chambers and scattering diagrams came to my imagination after draw the first few diagrams illustrating bifurcation points:

Time directional arrow end can be omitted:

Trace variation after a bifurcation point can be indicated by angle partition:

The case when a variation also happens before is illustrated on this diagram:

and the case with several bifurcations:

Are N-bifurcations like on the diagram below possible?

Yes, they are, if the course of execution depends on some non-binary trace message parameter such as a loaded module that implements a required interface differently.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -