Computer system and method for aiding log base debugging

[0001] This application is based upon and claims the benefit of priority from the prior Japanese Patent Application No. 2000-163792, filed May 31, 2000, the entire contents of which are incorporated herein by reference.

[0002] This invention relates to a computer system suitable for debugging work making use of a log in which a series of events that have occurred as a result of the execution of the target program has been recorded (traced).

[0003] When a programmer does the work of correcting errors (debugging) in a program, a debugger is used for aiding the work. According to the instructions from the debugging person, the debugger activates the target program and controls the execution of the program. In the course of debugging, it can display various pieces of information useful for debugging work.

[0004] There are several known approaches in debugging. Recently, operation logs have been used more often in checking the operation of the program or in debugging work. For instance, a log-based debugging approach has been popularized. In this approach, a history of issued system calls is recorded with an operating system (OS), a history of memory access is recorded by hardware or with an emulator, and a set of these pieces of event information (log), is displayed using a dedicated viewer. This display is a help to debugging work.

[0005] Log-based debugging may be done by not only the approach of examining one log in detail to pinpoint the cause of the bug but also the approach of comparing the log obtained in the proper operation with a log obtained in an abnormal operation, searching for the parts where they differ from each other, and examining the different parts intensively to pinpoint the cause of the bug.

[0006] In debugging on the basis of such log comparison, when an unsuitable log is selected and a comparison is made, too many different parts are found, expanding the scope of examination, which decreases the debugging efficiency seriously. To avoid this problem, the debugging person selects logs that behave as similarly as possible and uses them in comparison.

[0007] Normally, similar logs should be selected, taking into account the meaning of the operation of the program. The conventional approaches are to simply compare the structure of one log with that of another and select the most similar one. The log with the number of repetitive loops in comparison being the closest to that of the proper log may be selected, with the result that debugging is not necessarily efficient.

[0008] It is, accordingly, an object of the present invention to provide a computer system and method, which is capable of obtaining partial logs useful for log comparison and contributes to an improvement in the efficiency of log-based debugging work.

[0009] According to embodiments of the present invention, there is provided a log comparison debug support system which inputs a log in which a series of events occurred as a result of the execution of a target program are recorded, and supports debugging by performing log comparison, the system comprising a partial log creating device configured to create a plurality of partial logs from the inputted log, a master log creating device configured to create a master log by concatenating the partial logs, a normalized log creating device configured to create normalized logs by normalizing the partial logs by use of the master log serving as a normalization reference, a feature value computing device configured to compute feature values representing the degree of feature of the occurrence and nonoccurrence of the events for each of the normalized logs created by the normalized log creating device, and a similarity computing device configured to compute, in a combination of a specific partial log and another partial log, the similarity between these partial logs by performing a specific operation based on the feature values.

[0025] Hereinafter, referring to the accompanying drawings, embodiments of the present invention will be explained.

[0026] FIG. 1 is a block diagram schematically showing the configuration of a log comparison debug support system according to a first embodiment of the present invention. As shown in FIG. 1, this system comprises a condition specifying section 1, a partial log creating section 2, a master log creating section 4, a normalized log creating section 5, a log feature value computing section 6, a log similarity computing section 8, a log select section 9, a log display section 10, and a partial log specifying section 11. When a debugging person 12 gives a prepared operation log L to the log comparison debug support system of the first embodiment and specifies the condition for log comparison via the condition specifying section 1 and partial log specifying section 11, the log display section 10 displays information on the similarity between logs.

[0027] In the operation log L, a series of events that have occurred as a result of the execution of the target program (not shown) has been recorded. The type of target programs and the number of them are arbitrary. The environment of execution is also arbitrary. For instance, part of the target program may be replaced with a simulator. Part or all of the hardware the target program controls may be replaced with an emulator.

[0028] The target program for preparing the operation log L is executed by a debugger (not shown). The process of gathering and recording events is carried out by a “tracer” which is incorporated into the debugger or which is provided separately from the debugger and operates in harmony with the debugger.

[0029] “Event(s)” in the present invention have been defined in the whole debugging environment. According to the definition of events, the tracer traces the execution of the target program and records a series of events that have occurred (established) in the operation log L while executing a debugging operation (sequence) of the target program.

[0030] FIG. 2 is a general flowchart for the processing of the log comparison debug support system according to the first embodiment. Hereinafter, consider a case where the following three operation logs 1 to 3 are given as an example of the operation log L in which a series of events that have occurred as a result of the execution of the target program has been recorded:

[0031]

	Operation log 1:	a b c g h
	Operation log 2:	a c f g h
	Operation log 3:	a b c d e g h a c g h

[0032] Each of distinct ato his an event which constitutes a log. Their arrangement represents the order in which the events occurred.

[0033] First, at step S0 in FIG. 2, a debugging person (user) 12 specifies not only the begin and end events of a partial log as the condition for log comparison but also an extraction rule of extracting at least part of the event sequence sandwiched between the begin and end events (condition specifying section 1).

[0034] Specifically, for instance, it is assumed that the begin and end events of the partial log are specified as event aand event hrespectively. Further, the rule of extracting the event sequence sandwiched between event aand event his also assumed that “all the events should be extracted” is specified as a log comparison condition. “All the events” means that the type of events cut off as partial logs is not limited.

[0035] At step S1, the partial log creating section 2 inputs the operation log L and creates a plurality of partial logs from the operation log L according to the log comparison condition specified at step S0. In this step, the partial log creating section 2 cuts off the event sequence sandwiched between the begin and end events, event aand event h, as a partial log from the operation logs 1 to 3.

[0036] As a result, partial log A is cut off from the operation log 1, partial log B is cut off from the operation log 2, and partial log C and partial log D are cut off from the operation log 3, that is, a total of four logs are cut off as follows:

[0037]

	Partial log A:	(a) b c g (h)
	Partial log B:	(a) c f g (h)
	Partial log C:	(a) b c d e g (h)
	Partial log D:	(a) c g (h)

[0038] Since the begin and end events (that is, event aand event h) are common to each of partial log A to partial log D, they are removed from each partial log for convenience.

[0039] At step S2, the master log creating section 4 concatenates the partial logs A to D created by the partial log creating section 2 according to a specific concatenating algorithm, while leaving out the unnecessary repeated events, thereby creating the master log. The master log may be created by expanding the source program, whose data is different from the operation log L, not by using the partial logs (operation log L) as in the first embodiment. The expansion will be explained later in a second embodiment of the present invention.

[0040] In the first embodiment, partial log A to partial log D are concatenated as follows and the result of the concatenation is determined to be the master log:

[0041]

	A:	b c g
	A + B:	b c f g
	(A + B) + C:	b c f d e g
	((A + B) + C) + D:	b c f d e g

[0042] The created master log is used as a normalized reference corresponding to the log comparison condition specified in the condition specifying section 1.

[0043] At step S3, the normalized log creating section 5 normalizes partial log A to partial log D on the basis of the master log created at step S2. Specifically, the normalized log creating section 5 compares each of the partial logs A to D with the master log obtained from the master log creating section 3 respectively. For each of the partial logs A to D, the section 5 creates a bit string where 1 is set when a component event of the master log exists in the partial log, and 0 is set when such a component event does not exist in the partial log. The bit string is used as a normalized log.

[0044] In the first embodiment, the normalized logs for the partial logs A to D are as follows:

[0045]

	Master log:	b c f d e g
	Normalized log A:	(1 1 0 0 0 1)
	Normalized log B:	(0 1 1 0 0 1)
	Normalized log C:	(1 1 0 1 1 1)
	Normalized log D:	(0 1 0 0 0 1)

[0046] At step S4, the feature value computing section 6 calculates the feature values representing the degree of feature of the occurrence or nonoccurrence of events included in each of the normalized logs A to D. In this calculation, with respect to one feature value in one normalized log (e.g. log A), the other normalized logs (e.g. logs B to D) are used.

[0047] More specifically, as for the normalized value for each event in each normalized log, the following holds:

[0048] (1) When a normalized value of 1 (an event occurred), the number of logs where the corresponding normalized value has that of 0 in the other normalized logs (the event did not occur) are counted, and the resulting value is set as a feature value. If the feature value is relatively large, the occurrence (establishment) of the event is characteristic.

[0049] (2) When a normalized value of 0 (an event did not occur), the number of logs where the corresponding normalized value has that of 1 in the other normalized logs (the event occurred) are counted, and the result of subtracting the value from 0 is set as a feature value. In this case, if the absolute value of the feature value is relatively large, the nonoccurrence (unestablishment) of the event is characteristic.

[0050] For instance, since the normalized value of event b in normalized log A is 1 and the other normalized logs where the normalized value of event bhas that of 0 are normalized logs B and D are 0, the value representing the log feature of event bin normalized log A is 2. Furthermore, since the normalized value of event fin normalized log A is 0 and that of event fonly in normalized log B is 1, the value of the log feature of event fin normalized log A is the result of subtracting 1 from 0, or −1.

[0051] The log feature values (arrays) A to D of the normalized logs A to D are as follows:

[0052]

	Feature value A:	(  2, 0, −1, −1, −1, 0)
	Feature value B:	(−2, 0,   3, −1, −1, 0)
	Feature value C:	(  2, 0, −1,   3,   3, 0)

[0053] Feature value D: (−2, 0, −1, −1, −1, 0)

[0054] At step S5, the similarity computing section 8 calculates the similarity between partial logs by inner product on the basis of the feature values A to D for all the combinations (AB, AC, AD, BC, BD, CD) of a partial log and the remaining partial logs. It is determined that, the larger the result of the inner product, the higher the similarity between the partial logs. For instance, in comparison of (or combination of) partial log A with partial log B, the inner product of the feature values A and B of these partial logs is as follows:

[0055] AB=2*(−2)+0*0+(−1)*3+(−1)*(−1)+(−1)*(−1)+0*0=−5

[0056] The result of doing calculations for all the combinations is as follows:

[0057] AB=−5

[0058] AC=−1

[0059] AD=−1

[0060] BC=−13

[0061] BD=3

[0062] CD=−9

[0063] As shown at step S6, when the debugging person 12 specifies a reference partial log to be compared via the partial log specifying section 11, the partial log select section 9 selects a partial log with high similarity with the specified partial log on the basis of the similarity calculated at the similarity computing section 8. For instance, if the debugging person 12 has specified partial log D via the partial log specifying section 11, the log select section 9 selects partial log B as the partial log most similar to partial log D at step S7.

[0064] Then, at step S8, the log display section 10 preferably displays partial log B and partial log D in such a manner that the parts where they differ are highlighted. Persons skilled in the art will recognize that logs similar to partial log B may be arranged and displayed in the order of similarity.

[0065] When a configuration where the partial log specifying section 11 is eliminated from that of described above, the similarities for all the combinations are displayed. In this case, the logs may be rearranged in the order of similarity and displayed.

[0066] As explained above, with the log comparison debug support system according to the first embodiment, the feature values A to D representing the degree of feature of the occurrence and nonoccurrence of each of the component events (“b c f d e g” in the first embodiment) in the master log are calculated, instead of simply comparing the normalized logs. Use of these calculations and the inner product of the feature values enables similarity determination that attaches greater importance to the common inclusion of a seldom occurring (or seldom missing) event.

[0067] Comparison between partial log A and partial log D and between partial log B and partial log D each shows that there is a difference of one event. When the first event b, the difference between partial log A and partial log B, is compared with the third event f, the difference between partial log B and partial log D, the fact that the first event bis common to B and D is rarer (more characteristic) than the fact that the third event fis common to A and D. That is, it is possible to make a similarity determination that attaches greater importance to the common inclusion of an event featuring its occurrence or nonoccurrence.

[0068] Therefore, even when the amount of data in the operation log L becomes larger and the scope of debugging expands, simply specifying a reference partial log related to the target part enables a partial log similar to the reference partial log and useful for log comparison to be obtained easily. This contributes to an improvement in the efficiency of log-based debugging work including an understanding of the operation of the program.

[0069] Hereinafter, a second embodiment of the present invention will be explained.

[0070] FIG. 4 is a block diagram schematically showing the configuration of a log comparison debug support system according to a second embodiment of the present invention. The second embodiment relates to a debug support system, which performs log comparison using the source code of the target program as a reference. The structure of the operation log L is more practical than that in the first embodiment.

[0071] The system of the second embodiment is different from that of the first embodiment in regard to the master log creating section 7, which takes in the source code 7 of the program to be debugged and expands the source code to create the master log. The remaining component elements are the same as those of the first embodiment.

[0072] A general flow of processing in the second embodiment is the same as in the first embodiment. Hereinafter, explanation will be given, provided that a log composed of operation logs A to H is obtained as the log created as a result of the execution of program 7 shown in FIGS. 5A and 5B. FIG. 6 shows operation log D and FIG. 7 shows operation log E. The remaining logs are not shown.

[0073] First, the debugging person (user) 12 specifies a main function written in the source program of FIG. 5A as the target function in the log comparison condition. In addition, as an expansion parameter for the source program, the debugging person 12 specifies a parameter for expanding the description of a recursive call to a function in the main function up to four steps and further expanding a loop structure up to three times. Moreover, the debugging person 12 specifies that the descriptions of assignment statements, comments, and blank lines should be ignored (removed in the master log).

[0074] The master log creating section 4 then takes in the source code 7 of the target program, cuts off the descriptive part of the main function in the source code, expands the descriptive part according to the expansion parameter specified by the condition specifying section 1, and creates the result of the expansion as the master log. The master log created in this way is shown in FIGS. 8A and 8B. As seen from FIG. 8A, the function “makeValueString( . . . )” related to a recursive call is expanded and described in four steps.

[0075] The partial log creating section 2 cuts off the part ranging from the start to end of the execution of each of the operation logs A to H as a partial log from the main function, the specified function, according to the expansion parameter given to the condition specifying section 1. Since operation log D of FIG. 6 and operation log E of FIG. 7 both correspond to the executable parts of the main function, they make partial logs as they are. Explanation will be given on the assumption that each of the operation logs (A, B, C, F, G, H) other than the operation logs D and E includes one executable log in the main function (these normalized logs are shown in FIG. 10).

[0076] The normalized log creating section 5 causes the partial logs obtained at the partial log creating section 2 to correspond to the master log obtained from the master log creating section 4. When a component event in the master log exists in the corresponding partial log, the normalized log creating section 5 creates a bit string in which 1 set. When a component event in the master log does not exist in the corresponding partial log, the normalized log creating section 5 creates a bit string in which 0 is set. Let the resulting string be a normalized log. The contents of the normalization corresponding to the program description of the partial log of operation log D are shown in FIGS. 9A and 9B. FIG. 10 is a list of the normalized logs for the partial logs A to H in the second embodiment.

[0077] The log feature value computing section 5 performs the same operation as in the first embodiment, on the basis of the normalized logs created at the normalized log creating section 5, and calculates the feature values (arrays) A to H. A list of the feature values A to H is shown in FIG. 11.

[0078] The log similarity computing section 8 carries out the same inner product process as in the first embodiment on the basis of the feature values A to H calculated at the log feature value computing section 5, thereby calculating the similarity. A list of the similarities calculated for all the combinations of the partial logs A to H is shown in FIG. 12.

[0079] It is assumed that the debugging person 12 has selected partial log D as a reference log for comparison with the partial log specifying section 11. On the basis of the similarity calculated at the log similarity computing section 8, the log select section 9 selects partial log H with a maximum similarity of 470 as the partial log most similar to the partial log D specified by the partial log specifying section 11.

[0080] Like the first embodiment, the second embodiment calculates the feature values A to H representing the degree of feature of the occurrence and nonoccurrence of each of the component events (such syntax descriptions as function calls, loops, and switches) and uses the inner product of the feature values, which enables a similarity determination that attaches greater importance to the common inclusion of a seldom occurring (or seldom missing) event.

[0081] Next, a third embodiment of the present invention will be explained.

[0082] The third embodiment relates to a modification of the first embodiment.

[0083] The feature values and similarity explained in the first embodiment may be calculated as explained below.

[0084] At step S4, the feature value for each of the normalized logs created in the first embodiment is calculated.

[0085] The third embodiment differs from the first embodiment in that, at step S4, the probability of occurrence of events is given when an event has occurred and the probability of nonoccurrence of events is given when an event has not occurred.

[0086]

	Master log:	b c f d e g
	Normalized log A:	(1 1 0 0 0 1)
	Normalized log B:	(0 1 1 0 0 1)
	Normalized log C:	(1 1 0 1 1 1)
	Normalized log D:	(0 1 0 0 0 1)

[0087] For instance, event boccurred in the normalized logs A and C and not in the normalized logs B and D. Therefore, the probability of occurrence of event bis 0.5 and the probability of nonoccurrence of event bis also 0.5. Consequently, when event bhas or has not occurred, the feature value is 0.5.

[0088] Similarly, event foccurred only in the normalized log B, with the result that the probability of occurrence of event fis 0.25 and the probability of nonoccurrence of even fis 0.75. Therefore, the feature value of the occurrence of event fis 0.25 and the feature value of the nonoccurrence of event fis 0.75.

[0089] To summarize these, the feature values of the logs are as follows:

[0090]

	Feature value A:	(0.5, 1, 0.75, 0.75, 0.75, 1)
	Feature value B:	(0.5, 1, 0.25, 0.75, 0.75, 1)
	Feature value C:	(0.5, 1, 0.75, 0.25, 0.25, 1)
	Feature value D:	(0.5, 1, 0.75, 0.75, 0.75, 1)

[0091] Next, at step S5, the similarity computing section 8 calculates the similarity between partial logs on the basis of the feature values A to D for all the combination of a certain partial log and the remaining partial logs.

[0092] In this step, the absolute value of the logarithm of the feature value of each event is found. When events have occurred in both of the partial logs combined, or when an event has occurred in neither of them, the absolute values are added. When an event has occurred in only one of them, one absolute value is subtracted from the other.

[0093] For example, in the combination of partial logs A and B, since an event occurred in partial log A and no event occurred in partial log B, the similarity obtained from the comparison of event fis:

[0094] −|log(0.75)|−|log(0.25)|.

[0095] Comparison of event dgives:

[0096] +|log(0.75)|+|log(0.75)|, since an event not occurred in neither of partial logs A and B.

[0097] Similar calculations are done, giving the similarity AB between partial logs A and B:

[0098] $\begin{array}{c}\mathrm{AB}=-\log \left(0.5\right)-\log \left(0.5\right)+\log \left(1\right)+\log \left(1\right)-\log \left(0.75\right)-\\ \log \left(0.25\right)+\log \left(0.75\right)+\log \left(0.75\right)+\log \left(1\right)+\log \left(1\right)\\ =-1.18\end{array}$

[0099] The result of doing calculations for all the combinations is as follows:

[0100] AB=−1.18

[0101] AC=−0.6

[0102] AD=0.15

[0103] BC=−2.775

[0104] BD=0.375

[0105] CD=−1.8

[0106] According to the third embodiment, the advantage equal to that of the first embodiment is obtainable, since the similarity value as for the combination of partial logs B and D has the preferable, largest value of 0.375 as in the first embodiment. It should be noted that persons skilled in the art will recognize that the third embodiment is easily applied to the second embodiment.

[0107] With the present invention, even when the amount of data becomes larger because of a relatively large number of operation logs A to H and the scope of debugging expands, simply specifying a reference partial log related to the target part enables a partial log similar to the reference partial log and useful for log comparison to be obtained easily. This contributes to an improvement in the efficiency of log-based debugging work including an understanding of the operation of the program.

[0108] This invention is not limited to the above-described embodiments and may be practiced or embodied in still other ways without departing from the spirit or essential character thereof. For instance, while the operation on the feature values of the partial logs has been performed by internal product or probability, the operation may be performed using another algorithm. The partial logs may be inputted directly, instead of being created automatically. Alternatively, a prepared master log is inputted directly, instead of the concatenation of partial logs or the automatic creation of a master log referring to the source program. In this case, although it is troublesome to prepare a suitable log and master log, the advantage is that useful information for log comparison is obtained.

[0109] Additional advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details and representative embodiments shown and described herein. Accordingly, various modifications may be made without departing from the spirit or scope of the general inventive concept as defined by the appended claims and their equivalents.