An Efficient Analysis Approach for Multi-Core System Tracing Data

Catalog abstract summary

The publisher abstract describes a stateful trace-analysis and abstraction approach for parallel processes. It claims that sharing common information can reduce computation and storage compared with stateless approaches.

Source: Complete eight-page conference-paper PDF reviewed locally; the publisher abstract remains represented by an original catalog paraphrase rather than reproduced text.

Problem and motivation

Kernel traces expose processes, scheduling, files, disks, memory, and network activity, but their volume and low-level system calls make direct analysis difficult. Existing pattern-based abstraction approaches often evaluate patterns independently even when they repeatedly need the same process, file, CPU, or resource state, causing avoidable computation and storage cost.

Method and contribution

A Linux Java analyzer reads LTTng traces and passes raw events through an EventMapper that converts implementation-specific calls into environment-independent semantic events; for example, sys_open and sys_dup become an Open File event, while a scheduling event can produce process_stop and process_running events. A modeled-state database stores resource states such as process status, CPU mode, file descriptors, disks, memory, and locks together with intermediate pattern-matching states. The Synthetic Event Generator consumes the pattern library, modeled state, and trace events, and emits three levels of output: kernel-level abstract events, system problems/faults, and execution statistics. The prototype uses State Machine Language to define patterns. The pattern library contains trace-size-reduction patterns and fault-identification patterns, including file/network/process abstractions, resource overloads, SYN-flood detection, and fork-bomb detection. It reconstructs process execution paths across scheduler-induced execution chunks and supports partial abstraction by loading state at an interval start and replaying only the selected range.

Findings and evidence

The evaluation instruments Linux kernel version 2.6.38.6 with LTTng and runs on a 2.8 GHz system with 6 GB RAM. Workloads include grep -r, wget -r, ls -R, nmap, and a recursive process forker, with traces ranging from small inputs to the 10,000 MB comparison shown in the paper. The stateful approach is faster than the stateless approach across the plotted trace sizes and becomes more advantageous as the number of concurrent patterns increases; a fixed 2,000 MB experiment varies the number of patterns from 50 to 300. The paper's analytic example reports a 38% computation-time gain for 20 concurrent patterns with 10 states each when four states are shared. The memory plots show lower intermediate-state storage for the stateful design, and the conclusion identifies simpler patterns, partial trace abstraction, and reusable high-level events as practical benefits.

Limitations and future directions

Limitations: The study is a prototype evaluation on an older Linux/LTTng environment with workload-generated traces and plotted rather than fully tabulated timing and memory results. The paper does not establish performance on modern kernels, distributed traces, alternative tracing formats, or production workloads, and the pattern library and semantic mappings are implementation-dependent despite the intended environment independence. The reported 38% gain is a parameterized example, not a universal speedup.

Future work: The paper proposes adding pattern-mining methods, extending the library to more system and network faults, and comparing the approach with common intrusion-detection systems. Further work should also test modern trace formats, heterogeneous multicore systems, distributed execution, and reproducible benchmark suites.

Sources and identifiers

• Published version published
• Publisher abstract public_abstract

When to cite this paper

Cite this paper when sharing trace-analysis state and computation across concurrent patterns over large Linux kernel traces.

• LTTng-based kernel tracing with semantic event mapping and a modeled-state database.
• State Machine Language patterns and the three-level synthetic-event output.
• Shared-state computation/storage, partial trace abstraction, and process-path reconstruction.
• The 38% parameterized computation example and the 2,000 MB/50-300-pattern evaluation boundary.

Citation

@inproceedings{ezzatiJivan2012anefficient,
  author = {Naser Ezzati-Jivan and Michel R. Dagenais},
  title = {An Efficient Analysis Approach for Multi-Core System Tracing Data},
  year = {2012},
  booktitle = {16th IASTED International Conference on Software Engineering and Applications (SEA 2012)},
  pages = {446-453},
  publisher = {ACTAPRESS},
  doi = {10.2316/P.2012.790-053},
  url = {https://doi.org/10.2316/P.2012.790-053}
}

Ezzati-Jivan, N., & Dagenais, M. R. (2012). An Efficient Analysis Approach for Multi-Core System Tracing Data. In 16th IASTED International Conference on Software Engineering and Applications (SEA 2012) (pp. 446-453). https://doi.org/10.2316/P.2012.790-053

N. Ezzati-Jivan and M. R. Dagenais, "An Efficient Analysis Approach for Multi-Core System Tracing Data," in 16th IASTED International Conference on Software Engineering and Applications (SEA 2012), pp. 446-453, 2012, doi: 10.2316/P.2012.790-053