Software Diagnostics and Observability Institute

A survey of memory dumps, traces, logs, and project records

PDF: https://www.dumpanalysis.org/files/Residues_in_Diagnostics-Version17.pdf

After a function returns, its arguments may still be recognizable in the raw stack. What corresponds to Execution Residue in a trace or a log? In Error Thread, we start at an error message and follow earlier messages from the same activity. In our Circular Trace example, an entry dated 28 May is followed by one dated 27 May. The date change tells us where the recording wrapped.

In Residues in Diagnostics, we examine what such evidence can tell us about events and defect mechanisms. What survives also depends on architectural decisions. SQLite’s rollback journal preserves a page's original contents, while its write-ahead log records the new contents.

We use the Software Narratology Square to distinguish what a participant reports from what a trace records, and revisit our application of crash dump analysis patterns to organizational project postmortems. We also compare two uses of the word residue. In diagnostics, we examine what remains from a particular execution. In Barry O’Reilly’s residuality theory, the architectural question is what would remain of a system under a given stressor.