Software Diagnostics and Observability Institute

Logic Programming for Memory Dump, Trace, and Log Analysis

PDF: https://www.dumpanalysis.org/files/Prolog_for_Pattern-Oriented_Software_...

Software diagnostics is reasoning from artifacts, memory dumps, traces, and logs, to statements about the software that produced them, and its vocabulary is a pattern language: Spiking Thread, Wait Chain, Deadlock, Discontinuity, Significant Event. The catalogs that name these patterns were written for people. This book writes them for a machine as well, in the one language in which a description of structure is also a procedure for finding it.

In Prolog, a memory dump rendered into facts is a knowledge base, a pattern written as a rule is a query that enumerates its instances, and the search that answers the query is the analyst’s own search made explicit, repeatable, and open to inspection. The book teaches both subjects from the ground up and together: Prolog, with every construct motivated by a diagnostic use, and the memory analysis and trace analysis pattern catalogs, with 192 patterns, each with a section covering the recognizer, its transcript, and the limits of the formalization. It then goes further than the catalogs: explanation by meta-interpretation, performance at the scale of real dumps and traces, and integration with scripts, services, language-model agents, and the debugger itself, including a WinDbg extension that hosts the engine.