software engineering Software engineering is a systematic engineering approach to software development. A software engineer is a person who applies the principles of software engineering to design, develop, maintain, test, and evaluate computer software. The term '' ...

, tracing involves a specialized use of logging to record information about a program's execution. This information is typically used by programmers for debugging purposes, and additionally, depending on the type and detail of information contained in a trace log, by experienced

system administrator A system administrator, or sysadmin, or admin is a person who is responsible for the upkeep, configuration, and reliable operation of computer systems, especially multi-user computers, such as servers. The system administrator seeks to en ...

s or technical-support personnel and by software monitoring tools to

diagnose Diagnosis is the identification of the nature and cause of a certain phenomenon. Diagnosis is used in many different disciplines, with variations in the use of logic, analytics, and experience, to determine " cause and effect". In systems engin ...

common problems with software. Tracing is a

cross-cutting concern In aspect-oriented software development, cross-cutting concerns are aspects of a program that affect several modules, without the possibility of being encapsulated in any of them. These concerns often cannot be cleanly decomposed from the rest ...

. There is not always a clear distinction between ''tracing'' and other forms of ''logging'', except that the term ''tracing'' is almost never applied to logging that is a functional requirement of a program (therefore excluding logging of data from an external source, such as

data acquisition Data acquisition is the process of sampling signals that measure real-world physical conditions and converting the resulting samples into digital numeric values that can be manipulated by a computer. Data acquisition systems, abbreviated by the acro ...

in a

high-energy physics Particle physics or high energy physics is the study of fundamental particles and forces that constitute matter and radiation. The fundamental particles in the universe are classified in the Standard Model as fermions (matter particles) a ...

experiment, and

write-ahead logging In computer science, write-ahead logging (WAL) is a family of techniques for providing atomicity and durability (two of the ACID properties) in database systems. A write ahead log is an append-only auxiliary disk-resident structure used for crash ...

). Logs that record program usage (such as a server log) or operating-system events primarily of interest to a system administrator (see for example ''

Event Viewer Event Viewer is a component of Microsoft's Windows NT operating system that lets administrators and users view the event logs on a local or remote machine. Applications and operating-system components can use this centralized log service to repo ...

'') fall into a terminological gray area. This article deals primarily with tracing for debugging or diagnostic purposes.

Event logging versus tracing

Difficulties in making a clear distinction between event logging and software tracing arise from the fact that some of the same technologies are used for both, and further because many of the criteria that distinguish between the two are continuous rather than discrete. The following table lists some important, but by no means precise or universal, distinctions that are used by developers to select technologies for each purpose, and that guide the separate development of new technologies in each area:

Event logging

Event logging provides system administrators with information useful for diagnostics and auditing. The different classes of events that will be logged, as well as what details will appear in the event messages, are often considered early in the development cycle. Many event logging technologies allow or even require each class of event to be assigned a unique "code", which is used by the event logging software or a separate viewer (e.g., Event Viewer) to format and output a human-readable message. This facilitates localization and allows system administrators to more easily obtain information on problems that occur. Because event logging is used to log high-level information (often failure information), performance of the logging implementation is often less important. A special concern, preventing duplicate events from being recorded "too often" is taken care of through event throttling.

Software tracing

Software tracing provides developers with information useful for debugging. This information is used both during development cycles and after the release of the software. Unlike event logging, software tracing usually does not have the concept of a "class" of event or an "event code". Other reasons why event-logging solutions based on event codes are inappropriate for software tracing include: * Because software tracing is low-level, there are often many more types of messages that would need to be defined, many of which would only be used at one place in the code. The event-code paradigm introduces significant development overhead for these "one-shot" messages. * The types of messages that are logged are often less stable through the development cycle than for event logging. * Because the tracing output is intended to be consumed by the developer, the messages don't need to be localized. Keeping tracing messages separate from other resources that need to be localized (such as event messages) is therefore important. * There are messages that should never be seen. * Tracing messages should be kept in the code, because they can add to the readability of the code. This is not always possible or feasible with event-logging solutions. Another important consideration for software tracing is performance. Because software tracing is low-level, the possible volume of trace messages is much higher. To address performance concerns, it often must be possible to turn off software tracing, either at

compile-time In computer science, compile time (or compile-time) describes the time window during which a computer program is compiled. The term is used as an adjective to describe concepts related to the context of program compilation, as opposed to concept ...

or run-time. Other special concerns: * In

proprietary software Proprietary software is software that is deemed within the free and open-source software to be non-free because its creator, publisher, or other rightsholder or rightsholder partner exercises a legal monopoly afforded by modern copyright and i ...

, tracing data may include sensitive information about the product's

source code In computing, source code, or simply code, is any collection of code, with or without comments, written using a human-readable programming language, usually as plain text. The source code of a program is specially designed to facilitate the w ...

. * If tracing is enabled or disabled at run-time, many methods of tracing require the inclusion of a significant amount of additional data in the binary, which can indirectly hurt performance even when tracing is disabled. * If tracing is enabled or disabled at compile-time, getting trace data for a problem on a customer machine depends on the customer being willing and able to install a special, tracing-enabled version of the software and then duplicating the problem. * Many uses of tracing have very stringent robustness requirements. This is both in the robustness of the trace output but also in that the use-case being traced should not be disrupted. * In operating systems, tracing is sometimes useful in situations (such as booting) where some of the technologies used to provide event logging may not be available. * in

embedded software Embedded software is computer software, written to control machines or devices that are not typically thought of as computers, commonly known as embedded systems. It is typically specialized for the particular hardware that it runs on and has tim ...

, tracing requires special techniques.

Techniques

Software tracing: * Tracing macros * Output to debugger *

Aspect-oriented programming In computing, aspect-oriented programming (AOP) is a programming paradigm that aims to increase modularity by allowing the separation of cross-cutting concerns. It does so by adding behavior to existing code (an advice) ''without'' modifying th ...

and related

instrumentation Instrumentation a collective term for measuring instruments that are used for indicating, measuring and recording physical quantities. The term has its origins in the art and science of scientific instrument-making. Instrumentation can refer to ...

techniques *

Windows software trace preprocessor The Windows software trace preprocessor (WPP; the preprocessor and related support tools are known as ''WPP Software Tracing'') is a preprocessor that simplifies the use of WMI event tracing to implement efficient software tracing in drivers an ...

(aka WPP) * FreeBSD and SmartOS tracing with

DTrace DTrace is a comprehensive dynamic tracing framework originally created by Sun Microsystems for troubleshooting kernel and application problems on production systems in real time. Originally developed for Solaris, it has since been released und ...

- traces the kernel and the userland * Linux kernel tracing with

ftrace ftrace (Function Tracer) is a tracing framework for the Linux kernel. Although its original name, Function Tracer, came from ftrace's ability to record information related to various function calls performed while the kernel is running, ftr ...

* Linux system-level and user-level tracing with kernel markers and LTTng * Linux application tracing with UST - part of the same project as LTTng * Linux C/C++ application tracing wit
cwrap
* Tracing with

GNU Debugger The GNU Debugger (GDB) is a portable debugger that runs on many Unix-like systems and works for many programming languages, including Ada, C, C++, Objective-C, Free Pascal, Fortran, Go, and partially others. History GDB was first written ...

's trace command Event logging: *

syslog In computing, syslog is a standard for message logging. It allows separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. Each message is labeled with a facility code, i ...

(see article for specific implementations) Appropriate for both: * Instruction set simulation

Trace analysis

Trace analysis consists of extracting knowledge from executions of software systems. One kind of trace analysis is trace alignment, it consists of identifying parts in the traces that are common, that correspond to the same behavior. Trace alignment is a complex problem, because of the size of the traces, as well as because of the non-determinism and noise in real-world traces.

References