A flexible data-driven approach for execution trace filtering

Execution traces are frequently used to study system run-time behaviour and to detect problems. However, the huge amount of data in an execution trace may complexify its analysis. Moreover, users are not usually interested in all events of a trace, hence the need for a proper filtering approach. Filtering is used to generate an enhanced trace, with a reduced size and complexity, that is easier to analyse. The approach described in this paper allows to define custom filtering patterns, declaratively in XML, to concentrate the analysis on the most important and interesting events. The filtering scenarios include syntaxes to describe various analysis patterns using finite state machines. The patterns range from very simple event filtering to complex multi-level event abstraction, covering various types of synthetic behaviours that can be captured from execution trace data. The paper provides the details on this data-driven filtering approach and some interesting use cases for the trace events generated by the LTTng Linux kernel tracer.