Dynamic rule-based automatic crash dump analyzer

Patent metadata

Field	Value
Publication number	US-9529662-B1
Application number	US-201514815094-A
Country	US
Kind code	B1
Filing date	Jul 31, 2015
Priority date	Jul 31, 2015
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

A method and system for dynamic rule-based automatic crash dump analysis are described. In an example, a dynamic rule-based crash dump analysis system retrieves debug symbol data, rules, and commands from a server over a network. The actions are executed based on the retrieved rules in order to automatically analyze a crash dump using a debugger and the debug symbol data. During the process of analyzing the crash dump, the system parses output from the debugger for further rule processing and creates a human-readable analysis file from the parsed output.

First claim

What is claimed is:

1. A method of crash dump analysis, the method being implemented by one or more processors and comprising:
retrieving debug symbol data, rules, and actions from a server over a network;
based on the retrieved rules, executing corresponding actions to automatically analyze a crash dump from a computer system which experienced a software or hardware fault, the analysis using a debugger and the debug symbol data;
in response to analyzing the crash dump, parsing output from the debugger for further rule processing; and
creating a human-readable analysis file based on the analyzed crash dump from the parsed output.

2. The method of claim 1 , wherein the actions are generic and not specific to the debugger.

3. The method of claim 2 , further comprising adapting the actions into a format compatible with the debugger.

4. The method of claim 1 , wherein the retrieved rules and actions are contained in an XML decision tree.

5. The method of claim 4 , further comprising:
parsing the rules and actions from the XML decision tree; and
retrieving objects associated with the rules and actions from a database.

6. The method of claim 1 , wherein parsing output from the debugger for further rule processing uses forward-chaining approach until all solvable rules are solved.

7. The method of claim 1 , wherein the debugger creates a symbol table using the retrieved debug symbol data.

8. The method of claim 1 , wherein the retrieved debug symbol data is insufficient to create a symbol table and the debugger requests further debug symbol data from the server over the network as needed during the crash dump analysis.

9. A crash dump analysis system comprising:
a memory resource to store instructions;
one or more processors using the instructions stored in the memory resource to:
retrieve debug symbol data, rules, and actions from a server over a network;
based on the retrieved rules, execute corresponding actions to automatically analyze a crash dump from a computer system which experienced a software or hardware fault, the analysis using a debugger and the debug symbol data;
in response to analyzing the crash dump, parse output from the debugger for further rule processing; and
create a human-readable analysis file based on the analyzed crash dump from the parsed output.

10. The system of claim 9 , wherein the actions are generic and not specific to the debugger.

11. The system of claim 10 , further comprising instructions to adapt the actions into a format compatible with the debugger.

12. The system of claim 9 , wherein the retrieved rules and actions are contained in an XML decision tree.

13. The system of claim 12 , further comprising instructions to:
parse the rules and actions from the XML decision tree; and
retrieve objects associated with the rules and actions from a database.

14. The system of claim 9 , wherein parsing output from the debugger for further rule processing uses forward-chaining approach until no more matching rules remain.

15. The system of claim 9 , wherein the debugger creates a symbol table using the retrieved debug symbol data.

16. The system of claim 9 , wherein the retrieved debug symbol data is insufficient to create a symbol table and the debugger requests further debug symbol data from the server over the network as needed during the crash dump analysis.

17. A non-transitory computer-readable medium that stores instructions, executable by one or more processors, to cause the one or more processors to perform operations that comprise:
retrieving debug symbol data, rules, and actions from a server over a network;
based on the retrieved rules, executing corresponding actions to automatically analyze a crash dump from a computer system which experienced a software or hardware fault, the analysis using a debugger and the debug symbol data;
in response to analyzing the crash dump, parsing output from the debugger for further rule processing; and
creating a human-readable analysis file based on the analyzed crash dump from the parsed output.

18. The non-transitory computer-readable medium of claim 17 , wherein the actions are generic and not specific to the debugger.

19. The non-transitory computer-readable medium of claim 18 , further comprising adapting the actions into a format compatible with the debugger.

20. The non-transitory computer-readable medium of claim 17 , wherein the retrieved rules and actions are contained in an XML decision tree.

Assignees

• Netapp Inc

Inventors

• Wangkhem Karnajit
• Ghetiya Rupin
• Jaiswal Ghisiawan Prasad

Classifications

• G06F11/0778

  Dumping, i.e. gathering error/state information after a fault for later diagnosis · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/0748 Primary

  in a remote unit communicating with a single-box computer node experiencing an error/fault (remote testing G06F11/2294) · CPC title

• G06F11/0709

  in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title