Software Diagnostics Institute

We illustrate trace and log analysis patterns using a graphical language named Dia|gram. When we analyze memory dumps, we get textual log output to which we can apply the same analysis patterns. Therefore, we can reuse the same Dia|gram language for memory dump analysis, for example, for analysis pattern illustrations. We start with the first memory dump analysis pattern, Multiple Exceptions. However, we now use some later analysis pattern names in the latter's description, for example, Stack Trace Collection from multiple threads, which consists of Stack Traces from individual threads.

Each individual thread stack trace can be illustrated using this trace diagram with an implicit time arrow but without time values:

 
If we knew individual stack trace frame timings, we could have assembled the normal trace diagram:

However, we can assemble the combined trace by gluing individual thread traces and sorting them by thread creation time (available in Windows memory dumps):

Additionally, we can impose sparse discrete time labels and structure via Trace Schema:

Having ATIDs, we can use the Adjoint Thread of Activity analysis pattern.

Since we know that top frames existed at the time of the memory snapshot, we can also group them at the end of the trace:

Exception indicators (like exception processing frames) can be highlighted as Error Message and Periodic Error. We can also use Exception Stack Trace:

We can also add other debugger log output to such diagrams for Intra-Correlation.

We now start using Dia|gram in our memory dump analysis training courses and reference materials.