Information Technology Reference
In-Depth Information
Ecient Model to Query and Visualize
the System States Extracted from Trace Data
Alexandre Montplaisir, Naser Ezzati-Jivan,
Florian Wininger, and Michel Dagenais
Ecole Polytechnique de Montreal
{
firstname.lastname
}
@polymtl.ca
Abstract.
Any application, database server, telephony server, or oper-
ating system maintains different states for their internal elements and
resources. When tracing is enabled on such systems, the corresponding
events in the trace logs can be used to extract and model the different
state values of the traced modules to analyze their runtime behavior. In
this paper, a generic method and corresponding data structures are pro-
posed to model and manage the system state values, allowing ecient
storage and access. The proposed state organization mechanism gener-
ates state intervals from trace events and stores them in a tree-based
state history database. The state history database can then be used to
extract the state of any system resources (i. e. cpu, process, memory, file,
etc.) at any timestamp. The extracted state values can be used to track
system problems (e. g. performance degradation). The proposed system
is usable in both the oine tracing mode, when there is a set of trace
files, and online tracing mode, when there is a stream of trace events.
The proposed system has been implemented and used to display and an-
alyze interactively various information extracted from very large traces
in the magnitude order of 1 TB.
1 Introduction
Tracing of computer systems allows programmers and administrators to extract
useful data about the runtime behavior of their systems or applications. From a
high-level point of view, the concept of tracing relies on inserting trace points, or
probes, at specific places in a program's code. Whenever execution reaches those
points, an event about reaching this location is sent to the tracer. The LTTng
tracer (Linux Tracing Toolkit Next Generation) [DD08, DD06] was developed by
the DORSAL lab in the Ecole Polytechnique de Montreal university. This tracer
integrates with the Linux kernel, and allows kernel and user-space tracing.
Although the trace data provides valuable information from system runtime
execution, the event generation rate can be quite large, especially in a multi-
core system and for a detailed kernel execution trace (system calls, interrupts,
etc.). Extracting, saving and analyzing this information without impacting the
running system is a serious challenge.
