{
  "schema_version": "0.6.0",
  "paper_id": "efficient-analysis-multi-core-system-tracing-data",
  "page_url": "https://threadslab.org/research-publications/papers/efficient-analysis-multi-core-system-tracing-data/",
  "title": "An Efficient Analysis Approach for Multi-Core System Tracing Data",
  "title_variants": [],
  "authors": [
    "Naser Ezzati-Jivan",
    "Michel R. Dagenais"
  ],
  "author_details": [
    {
      "name": "Naser Ezzati-Jivan",
      "orcid": "https://orcid.org/0000-0003-1435-6297",
      "profile_url": "https://threadslab.org/"
    },
    {
      "name": "Michel R. Dagenais",
      "orcid": null,
      "profile_url": null
    }
  ],
  "publication": {
    "year": 2012,
    "venue": "16th IASTED International Conference on Software Engineering and Applications (SEA 2012)",
    "type": "conference paper",
    "pages": "446-453",
    "publication_date": "2012",
    "online_date": null,
    "print_date": "2012",
    "volume": null,
    "issue": null,
    "article_number": null,
    "publisher": "ACTAPRESS",
    "issn": [],
    "isbn": [],
    "crossref_type": "proceedings-article"
  },
  "publication_type": "conference paper",
  "status": "published_with_local_full_text_evidence",
  "canonical_source_url": "https://doi.org/10.2316/P.2012.790-053",
  "source_record_id": "an-efficient-analysis-approach-for-multi-core-system-tracing-data-67abba75b9",
  "identifiers": {
    "doi": "10.2316/P.2012.790-053"
  },
  "abstract": "The publisher abstract describes a stateful trace-analysis and abstraction approach for parallel processes. It claims that sharing common information can reduce computation and storage compared with stateless approaches.",
  "abstract_source": "Complete eight-page conference-paper PDF reviewed locally; the publisher abstract remains represented by an original catalog paraphrase rather than reproduced text.",
  "abstract_available": true,
  "scholar_eligibility": {
    "eligible": false,
    "basis": "not-eligible",
    "note": "The page is a discovery record; it does not claim Google Scholar article-host eligibility."
  },
  "description": "The publisher abstract describes a stateful trace-analysis and abstraction approach for parallel processes. It claims that sharing common information can reduce computation and storage compared with stateless approaches.",
  "evidence_level": "full-text-reviewed",
  "evidence": {
    "source_basis": "full-text-reviewed",
    "coverage": "material paper sections",
    "summary_origin": "AI-assisted catalog editorial summary",
    "review_status": "catalog-reviewed; paper-author approval pending",
    "verified_on": "2026-08-27",
    "sources": [
      {
        "note": "Local eight-page SEA 2012 PDF reviewed, including the abstract, related work, architecture, EventMapper, state database, synthetic-event generator, pattern library, experiments, figures, and conclusion"
      },
      {
        "note": "Local PDF evidence ledger: pdf-evidence/notes/efficient-analysis-multi-core-system-tracing-data-fulltext.md"
      },
      {
        "note": "DOI metadata: https://doi.org/10.2316/P.2012.790-053"
      },
      {
        "note": "ActaPress publisher record: https://m.actapress.com/Abstract.aspx?paperId=454815"
      },
      {
        "note": "Proceedings record: https://actapress.com/Content_Of_Proceeding.aspx?ProceedingID=745"
      }
    ]
  },
  "summary": {
    "core_contribution": "The paper introduces a stateful trace-abstraction architecture that shares modeled system state and intermediate computation across concurrent patterns to reduce the cost of analyzing large Linux kernel traces.",
    "problem": "Kernel traces expose processes, scheduling, files, disks, memory, and network activity, but their volume and low-level system calls make direct analysis difficult. Existing pattern-based abstraction approaches often evaluate patterns independently even when they repeatedly need the same process, file, CPU, or resource state, causing avoidable computation and storage cost.",
    "method": "A Linux Java analyzer reads LTTng traces and passes raw events through an EventMapper that converts implementation-specific calls into environment-independent semantic events; for example, sys_open and sys_dup become an Open File event, while a scheduling event can produce process_stop and process_running events. A modeled-state database stores resource states such as process status, CPU mode, file descriptors, disks, memory, and locks together with intermediate pattern-matching states. The Synthetic Event Generator consumes the pattern library, modeled state, and trace events, and emits three levels of output: kernel-level abstract events, system problems/faults, and execution statistics. The prototype uses State Machine Language to define patterns. The pattern library contains trace-size-reduction patterns and fault-identification patterns, including file/network/process abstractions, resource overloads, SYN-flood detection, and fork-bomb detection. It reconstructs process execution paths across scheduler-induced execution chunks and supports partial abstraction by loading state at an interval start and replaying only the selected range.",
    "findings": "The evaluation instruments Linux kernel version 2.6.38.6 with LTTng and runs on a 2.8 GHz system with 6 GB RAM. Workloads include grep -r, wget -r, ls -R, nmap, and a recursive process forker, with traces ranging from small inputs to the 10,000 MB comparison shown in the paper. The stateful approach is faster than the stateless approach across the plotted trace sizes and becomes more advantageous as the number of concurrent patterns increases; a fixed 2,000 MB experiment varies the number of patterns from 50 to 300. The paper's analytic example reports a 38% computation-time gain for 20 concurrent patterns with 10 states each when four states are shared. The memory plots show lower intermediate-state storage for the stateful design, and the conclusion identifies simpler patterns, partial trace abstraction, and reusable high-level events as practical benefits.",
    "limitations": "The study is a prototype evaluation on an older Linux/LTTng environment with workload-generated traces and plotted rather than fully tabulated timing and memory results. The paper does not establish performance on modern kernels, distributed traces, alternative tracing formats, or production workloads, and the pattern library and semantic mappings are implementation-dependent despite the intended environment independence. The reported 38% gain is a parameterized example, not a universal speedup.",
    "future_work": "The paper proposes adding pattern-mining methods, extending the library to more system and network faults, and comparing the approach with common intrusion-detection systems. Further work should also test modern trace formats, heterogeneous multicore systems, distributed execution, and reproducible benchmark suites."
  },
  "tags": [
    "kernel-tracing",
    "lttng",
    "trace-analysis",
    "trace-abstraction",
    "trace-filtering",
    "performance-analysis",
    "multicore-systems"
  ],
  "keywords": [
    "multi-core tracing",
    "LTTng",
    "Linux kernel 2.6.38.6",
    "stateful trace analysis",
    "trace abstraction",
    "EventMapper",
    "modeled state",
    "semantic events",
    "synthetic event generation",
    "State Machine Language",
    "pattern library",
    "partial trace abstraction",
    "SYN flood",
    "fork bomb",
    "kernel trace",
    "Java trace analyzer",
    "computation sharing",
    "storage efficiency"
  ],
  "versions": [
    {
      "id": "published-version",
      "label": "Published version",
      "relation": "version-of-record",
      "title": "An Efficient Analysis Approach for Multi-Core System Tracing Data",
      "url": "https://doi.org/10.2316/P.2012.790-053",
      "pdf_url": null,
      "status": "published",
      "canonical_for_citation": true
    },
    {
      "id": "publisher-abstract",
      "label": "Publisher abstract",
      "relation": "source-record",
      "title": "An Efficient Analysis Approach for Multi-Core System Tracing Data",
      "url": "https://m.actapress.com/Abstract.aspx?paperId=454815",
      "pdf_url": null,
      "status": "public_abstract",
      "canonical_for_citation": false
    }
  ],
  "access": {
    "status": "published_with_local_full_text_evidence",
    "note": "The complete eight-page SEA 2012 paper was reviewed locally as full-text evidence. The public catalog links the DOI and publisher record but does not redistribute the conference PDF.",
    "license": null
  },
  "resources": {
    "code": null,
    "data": null,
    "slides": null,
    "demo": null
  },
  "citation_guidance": {
    "when_to_cite": "Cite this paper when sharing trace-analysis state and computation across concurrent patterns over large Linux kernel traces.",
    "points": [
      "LTTng-based kernel tracing with semantic event mapping and a modeled-state database.",
      "State Machine Language patterns and the three-level synthetic-event output.",
      "Shared-state computation/storage, partial trace abstraction, and process-path reconstruction.",
      "The 38% parameterized computation example and the 2,000 MB/50-300-pattern evaluation boundary."
    ],
    "canonical_version_id": "published-version"
  },
  "provenance": {
    "metadata_verified_on": "2026-08-27",
    "metadata_source": [
      "Local eight-page SEA 2012 PDF reviewed, including the abstract, related work, architecture, EventMapper, state database, synthetic-event generator, pattern library, experiments, figures, and conclusion",
      "Local PDF evidence ledger: pdf-evidence/notes/efficient-analysis-multi-core-system-tracing-data-fulltext.md",
      "DOI metadata: https://doi.org/10.2316/P.2012.790-053",
      "ActaPress publisher record: https://m.actapress.com/Abstract.aspx?paperId=454815",
      "Proceedings record: https://actapress.com/Content_Of_Proceeding.aspx?ProceedingID=745"
    ],
    "summary_written_by": "AI-assisted",
    "summary_verified_by": "full-text-grounded catalog review; author approval pending",
    "linked_preprint_record": null,
    "author_order_note": null
  },
  "batch": {
    "phase": 2,
    "batch_label": "expanded forty-paper release",
    "status": "included_in_expanded_catalog",
    "selected_at": "2026-08-28"
  }
}