Software Diagnostics Institute

The analysis of software traces and logs is largely a qualitative activity. We look for specific problem domain patterns using general analysis patterns (problem domain pattern hierarchy). Some methodological aspects of this software defect research are similar to qualitative research method in social sciences. The latter method uses the so-called coding techniques for data analysis. Software traces and debugger logs from memory dumps are software execution artifacts we previously called DA+TA (Dump Artifact + Trace Artifact, Memory Dump Analysis Anthology, Volume 3, page 330). We propose to use similar “coding” techniques to annotate them with diagnostic indicators, signal and sign mnemonics, and patterns (such as software diagnosis codes). We, therefore, call this software post-construction “coding” as articoding (artecoding), from artifact (artefact) + coding, to distinguish it from software construction coding. Such articoding forms a part of software post-construction problem solving (Introduction to Pattern-Driven Software Problem Solving, page 8). Articodes form a second order software narrative and can be articoded too.

Many software tools were developed for assisting qualitative research coding, and these can be reused for “coding” debugger logs, for example. In addition to those tools, general word and table processing programs can be used as well for some types of artifacts. Here we show MS Word for a WinDbg log example. The debugger log with stack traces from all processes and threads was loaded into MS Word template table with 3 columns. The first column is the log itself, the second column is for diagnostic indicators (such as critical section, CPU consumption, ALPC wait, etc.), and the third column is for pattern language articodes (here we use pattern names from Memory Analysis Pattern Catalog, for traces we can use MS Excel and Trace and Log Analysis Pattern Catalog):

(Click to expand this screenshot)

Formatting and highlighting creativity here is unlimited. Irrelevant parts from the log can be deleted, and the final analysis log can have only relevant annotated tracing information.