Log analysis debugging without running on real production environment

A computer receives a log file, where the log file comprises records associated with the instructions in a source code. The computer loads, using a debugger, the log file and the source code. The computer receives a loading address from the log file. The computer updates a debugging data format (DWARF) with the one or more records of the log file, where the DWARF is accessed using the loading address and comprises one or more data structure entries. The computer identifies a calling address from the log file and identifies the one or more data structure entries associated with the calling address.

BACKGROUND

The present invention relates, generally, to the field of computing, and more particularly to performing a log debugging without running the debugger in a real production environment.

A real production environment is a computer system in which a computer program or software component is deployed and executed. In simple cases, such as developing and immediately executing a program on the same machine, there may be a single environment, but in industrial use the development environment and production environment are separated. A development environment is a computer system in which the computer program is generated by compiling it from the computer code. This structured release management process allows phased deployment testing and rollback in case of execution problems.

Computer code or a source code is any collection of instructions, written on a computer using a human-readable programming language as ordinary text that can be transformed by an assembler or compiler into binary machine code to be executed by a computer. Due to errors (bugs) in the computer code, the compiled binary machine code may malfunction and generate an error report, such as a log file, in order to assist the developer to determine the error in the computer code and enable error debugging and correction. Typically, in order to determine and fix errors in the computer code, developers use a debugging software such as a debugger.

A debugger is a software program that is used to test and debug computer code. A debugger can be a standalone software or an integrated part to an Integrated Development Environment (IDE) software. During debugging, the computer code is executed on an instruction set simulator (ISS), a technique that allows halting the execution of the computer code when specific conditions are encountered or perform step-by-step execution and analysis of the variables after each instruction of the source code.

SUMMARY

According to one embodiment, a method, computer system, and computer program product for log debugging is provided. The present invention may include a computer receives a log file, where the log file comprises records associated with the instructions in a source code. The computer loads, using a debugger, the log file and the source code. The computer receives a loading address from the log file. The computer updates a debugging data format (DWARF) with the one or more records of the log file, where the DWARF is accessed using the loading address and comprises one or more data structure entries. The computer identifies a calling address from the log file and identifies the one or more data structure entries associated with the calling address.

DETAILED DESCRIPTION

Embodiments of the present invention relate to the field of computing, and more particularly to performing log debugging without running the debugger in a real production environment. The following described exemplary embodiments provide a system, method, and program product to, among other things, perform debugging of the computer code without running a debugger on the real production environment (client computing device). Therefore, the present embodiment has the capacity to improve the technical field of debugging by analyzing a log file from the production environment, simulating a debugger environment, and displaying stack frame without physically running a debugger to execute the software program at the production environment.

As previously described, a debugger is a software program that is used to test and debug computer code in order to find and resolve errors in the software. A debugger can be a standalone software or an integrated part to an Integrated Development Environment (IDE) software. During debugging, the computer code is executed on an instruction set simulator (ISS), a technique that allows halting the execution of the computer code when specific conditions are encountered or perform step-by-step execution and analysis of the variables after each instruction of the source code.

When a developer receives an error report, typically in a format of a log file from the production environment, running a debugger on the client computer is generally impracticable because the customer has only an executable binary program without a debugging software and a source code. Currently, the developer may determine an error or narrow down the root cause of the problem by mapping the received log file with the source code or a hard code log that was generated before delivering the product to the client. However, when the log file is large (frequently log files exceed 100 Mb), bug identification and elimination process is inefficient and frequently impossible. As such, it may be advantageous to, among other things, implement a system that simulates a debugging of a source code without running the debugger on the real production environment (client computing device) by mapping debug info and log data with current program execution addresses, thus allowing variable type and stack frames views including breakpoints set and hit functionality without physical execution of the software program.

Stack frame is an abstraction of a stack that provides the execution context of one or more structured instructions (functions). A stack frame, typically, holds the local variables of each function and the arguments accompanying it. Stack frame view is typically, an active view on a display runtime information that describe the name, type, and value of local variables and arguments, that appear in various debug windows as a consequence of executing an instruction. For example, stack frame view may display a list of active procedures and functions. In addition, it may display a back-trace of the stack frame, line per frame view, currently executing frame and future frames up the stack.

According to one embodiment, a log analysis debugging program may map debug info with a current program execution address that is generated by the compiler and by using an entry address of the called routine's code entry address of the called routine's code that is typically inserted by the compiler, unwind a stack frame and allow debugging without running an actual debugger software on a computing device of a client.

The following described exemplary embodiments provide a system, method, and program product to enable debugging of the software program without running a debugger on a client computing device by mapping debug info and log data from the log file using a current program execution address (CurrentAddr) and an entry address of the called routine's code (CallingAddr).

Referring toFIG. 1, an exemplary networked computer environment100is depicted, according to at least one embodiment. The networked computer environment100may include production environment102and a developer environment112interconnected via a communication network114. According to at least one implementation, the networked computer environment100may include a plurality of production environments102and developer environments112, of which only one of each is shown for illustrative brevity.

The production environment102may include a processor104and a data storage device106that is enabled to host and run a software program108that may generate a log file118, and a log analysis debugging program110A and may communicate with the developer environment112via the communication network114, in accordance with one embodiment of the invention. Production environment102may be, for example, a mobile device, a telephone, a personal digital assistant, a netbook, a laptop computer, a tablet computer, a desktop computer, or any type of computing device capable of running a program and accessing a network. As will be discussed with reference toFIG. 5, the production environment102may include internal components502aand external components504a, respectively.

The developer environment112may be a laptop computer, netbook computer, personal computer (PC), a desktop computer, or any programmable electronic device or any network of programmable electronic devices capable of hosting and running a log analysis debugging program110B, debugger124, and a storage device116and communicating with the production environment102via the communication network114, in accordance with embodiments of the invention. The log analysis debugging program110B may be a part of the debugger124. In another embodiment, the log analysis debugging program110B may be a standalone application that controls the debugger124As will be discussed with reference toFIG. 5, the developer environment112may include internal components502band external components504b, respectively. The developer environment112may also operate in a cloud computing service model, such as Software as a Service (SaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS). The developer environment112may also be located in a cloud computing deployment model, such as a private cloud, community cloud, public cloud, or hybrid cloud.

The storage device116may store a log file118, a source code120, application122, and debug info126. The source code120may be a source code of software program108that is used by a client and requires a debugging. The application122and debug info126may be generated by the compiler during compilation of the source code120. The log file118may be a log record that was generated by the software program108in the production environment102and was sent or replicated to the developer environment112via communication network114. Typically, the log file118may include records such as filename of the source code (FileName), a line number of log data generated (LineNo), a function of record data (FuncName), a variable name (VarName), and a value of the recorded variable (VarValue). According to an example embodiment, the log file118may include additional fields in each record such as current program execution address (CurrentAddr) and an entry address of the called routine's code entry address of the called routine's code or later the return code (CallingAddr).

According to the present embodiment, the log analysis debugging program110A,110B may be a program capable of receiving the log file from the production environment102and enable a debugging of the software program108on the developer environment112without running a debugger (or executing the software program108) on the production environment102. The log analysis debugging method is explained in further detail below with respect toFIG. 2.

Referring now toFIG. 2, an operational flowchart illustrating a debugger session initialization process200is depicted according to at least one embodiment. At202, the log analysis debugging program110A,110B checks a type of debug mode. According to an example embodiment, the log analysis debugging program110A,110B may request a developer, using a graphical user interface (GUI) whether the developer wants to run the debugger in a normal mode (by executing an existing application) or to run in a log mode debugging without loading the debugger at the same computer where the software application such as software program108is executed. In another embodiment, the log analysis debugging program110A,110B may display a directory and, if the user choses a log file, the log analysis debugging program110A,110B may determine that the user chose to run the debugger in a log debug environment.

Then, at204, the log analysis debugging program110A,110B determines whether a log debug should be performed. According to an example embodiment, the log analysis debugging program110A,110B may determine whether the log debug is chosen based on an input from the user via the GUI. For example, the log analysis debugging program110A,110B may display a message requesting the user to choose whether the user wants to run in a log debug mode or as a conventional debugger. In another embodiment, the log analysis debugging program110A,110B may determine that it should run the log debug mode based on determining a log file is present in a predefined folder. If the log analysis debugging program110A,110B determines that log debugging should be performed (step204, “YES” branch), the log analysis debugging program110A,110B may continue to step206to receive and load the log file118. If the log analysis debugging program110A,110B determines that log debugging should not be performed (step204, “NO” branch), the debugger124may continue to step212to load the source code120and the application122in the address space.

Next, at206, the log analysis debugging program110B receives and loads the log file. According to an example embodiment, the log analysis debugging program110B may request a user to choose one or more log files using a GUI. For example, a user may locate one or more log files on a production environment102and the log analysis debugging program110B may copy the one or more log files to the storage device116of the developer environment112. During the loading, the log analysis debugging program110B may arrange the log file in a database having a loading address and plurality of records where each record has a CurrentAddr and CallingAddr. In another embodiment, the log file may be arranged according to line numbers in order to determine the corresponding line in the source code120to the line in the log file118. In further embodiments, the log analysis debugging program110B may match the function names from the log file118to each line of the source code120using a text searching method.

Then, at208, the log analysis debugging program110B retrieves loading addresses from log record. According to an example the log analysis debugging program110B may retrieve the loading address from the corresponding line of the log file118of the developer environment112. As previously mentioned, the log file118may be arranged in records where each record include fields such as CurrentAddr that may represent a loading address of a program or specific instruction and CallingAddr that may represent an address of the next instruction or function.

Next, at210, the debugger124updates DWARF_PC and debugging information entries (DIEs). DWARF is a widely used, standardized debugging data format that is generated by the compiler and consumed by the debugger. The DWARF uses a data structure of DIEs. The DIE may have nested DIEs forming a tree structure. For example, a DIE attribute may refer to another DIE anywhere in the tree, such as a DIE representing a variable would have a DW_AT_type entry pointing to the DIE describing the type of the variable. According to an example embodiment, the debugger124—may access the DWARF using the loading address and update the DWARF_PC using the log file118and debug info126. The process of updating the DWARF_PC is depicted inFIG. 4and explained in further details below.

Then, at212, the debugger124loads an application in an address space. According to an example embodiment, when running in normal debugging mode, the debugger124may load the application122in the address space.

Next, at214, the debugger124retrieves real loading addresses. According to an example embodiment, the debugger124may retrieve real loading addresses from the address space where the application122is loaded.

Referring now toFIG. 3, an operational flowchart illustrating active debugging process300is depicted according to at least one embodiment. At302, the log analysis debugging program110B retrieves current address. According to an example embodiment, the log analysis debugging program110B may retrieve the current address using the debugger124. In another embodiment, the log analysis debugging program110B may get the current address from the log file118or the debugger124may get the current address from the address space where the application122is loaded. In a further embodiment, the debugger124may retrieve the current address from the initiation process (step2068or214), depending whether the debugger runs in a normal mode or in a log debug mode.

Then, at304, the log analysis debugging program110B determines whether a current mode is a log debug mode. According to an example embodiment, the log analysis debugging program110B determines based on an input of the user, by using the GUI that was received during initialization process at step204. If the log analysis debugging program110B determines that a log debug was chosen (step304, “YES” branch), the log analysis debugging program110B may continue to step306to get a calling address from log record of the log file118. If the log analysis debugging program110B determines that a log debug was not chosen (step304, “NO” branch), the log analysis debugging program110B may continue to step310to cause the debugger124to read calling address from saved area of callee according to application binary interface (ABI). The ABI, typically, defines a method that data structures or computational routines are accessed in machine code in a low-level, hardware-dependent format.

Next, at306, the log analysis debugging program110B retrieves a calling address from a log record. According to an example embodiment, the log analysis debugging program110B may get the calling address from a corresponding to the instruction record in the log file118. As previously mentioned, the log file118may have additional fields, such as CurrentAddr, and CallingAddr, that enable unwinding of a stack and get the calling address from the log record. In another embodiment, the log analysis debugging program110B may cause the debugger to display the unwinded stack. This process is further explained below with respect toFIG. 4.

Then, at308, the log analysis debugging program110B may cause the debugger124to search DIEs to get caller's DIE. According to an example embodiment, the log analysis debugging program110B may cause the debugger124to search the DIEs to identify the caller's DIE and receive the values of the variables associated with the specific instruction. This process is further explained below with respect toFIG. 4.

Then, at310, the debugger124reads the calling address from saved area of the callee according to ABI. According to an example embodiment, the debugger124may read the calling address by accessing the application binary interface (ABI).

Then, at312, the debugger124searches DIEs to get caller's DIE. According to an example embodiment, the debugger124may search the DIEs to identify the caller's DIE and receive the values of the variables associated with the specific instruction.

Next, at314, the debugger124determines whether a frame view is still active. According to an example embodiment, the debugger124determines whether the frame view (stack unwinding view) is still active either by requesting an input from the user or based on determining whether the frame view window is active on a display (GUI). If the debugger124determines that the user is still in the frame view (step314, “YES” branch), the debugger124may continue to step302to retrieve the current address (CurrentAddr) of a function. If the log analysis debugging program110B determines that a log debug was not chosen (step314, “NO” branch), the debugger124may terminate.

It may be appreciated thatFIGS. 2 and 3provide only an illustration of one implementation and does not imply any limitations with regard to how different embodiments may be implemented. Many modifications to the depicted environments may be made based on design and implementation requirements. For example, a log debug may be performed synchronously to the regular debugging of the source code in order to determine stack discrepancies between the values of variables in a log debugging and regular debugging. In further embodiments, a breakpoint may be incorporated that halts execution of the source code when the stack or a specific variable is different between regular debugging and log debugging.

Referring now toFIG. 4, a stack frame unwinding process is depicted according to at least one embodiment. Typically, a stack frame is a frame of data that gets pushed onto the stack and frequently is displayed during the debugging process using a GUI. A stack frame may represent an instruction or a function call and a corresponding argument data. During regular debugging, such as during using the debugger124a source code that is displayed in a debugging session406, depicts as an example depicted inFIG. 4, three functions: “funC”, “funB” and “funA”. During regular debugging these three functions are arranged in a stack as depicted in stack frame unwind (Normal debug)402, where “funC” has a CallingAddr that points to the next function “funB” and so on. However, during log analysis debugging, the log analysis debugging program110B determines a stack frame unwind using three steps. First, the log analysis debugging program110B identifies a current address of “funC” instruction of the source code120from the corresponding to the instruction record in the log file118(0x22ce1fa0). The corresponding record may be determined, as previously mentioned, either by line number or matching instruction name in the source code to the record in the log file. Second, the log analysis debugging program110B identifies CallingAddr (0x22ce1ccc) from the corresponding to the instruction in the source code120record in the logfile118. Third, the log analysis debugging program110B may make the debugger124to call the SearchDIE module to identify the DIE of “funB” and get the corresponding dwarf PC that was generated during the initialization process (step210).

FIG. 5is a block diagram500of internal and external components of the production environment102and the developer environment112depicted inFIG. 1in accordance with an embodiment of the present invention. It should be appreciated thatFIG. 3provides only an illustration of one implementation and does not imply any limitations with regard to the environments in which different embodiments may be implemented. Many modifications to the depicted environments may be made based on design and implementation requirements.

The production environment102and the developer environment112may include respective sets of internal components502a,band external components504a,billustrated inFIG. 3. Each of the sets of internal components502include one or more processors520, one or more computer-readable RAMs522, and one or more computer-readable ROMs524on one or more buses526, and one or more operating systems528and one or more computer-readable tangible storage devices530. The one or more operating systems328, the software program108and the log analysis debugging program110A in the production environment102, and the log analysis debugging program110B in the developer environment112are stored on one or more of the respective computer-readable tangible storage devices530for execution by one or more of the respective processors520via one or more of the respective RAMs522(which typically include cache memory). In the embodiment illustrated inFIG. 5, each of the computer-readable tangible storage devices530is a magnetic disk storage device of an internal hard drive. Alternatively, each of the computer-readable tangible storage devices530is a semiconductor storage device such as ROM524, EPROM, flash memory or any other computer-readable tangible storage device that can store a computer program and digital information.

Each set of internal components502a,balso includes a RAY drive or interface532to read from and write to one or more portable computer-readable tangible storage devices538such as a CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk or semiconductor storage device. A software program, such as the cognitive screen protection program110A,110B, can be stored on one or more of the respective portable computer-readable tangible storage devices538, read via the respective R/W drive or interface532, and loaded into the respective hard drive530.

Each set of internal components502a,balso includes network adapters or interfaces536such as a TCP/IP adapter cards, wireless Wi-Fi interface cards, or 3G or 4G wireless interface cards or other wired or wireless communication links. The software program108and the log analysis debugging program110A in the production environment102and the log analysis debugging program110B in the developer environment112can be downloaded to the production environment102and the developer environment112from an external computer via a network (for example, the Internet, a local area network or other, wide area network) and respective network adapters or interfaces536. From the network adapters or interfaces536, the software program108and the log analysis debugging program110A in the production environment102and the log analysis debugging program110B in the developer environment112are loaded into the respective hard drive530. The network may comprise copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers.

Each of the sets of external components504a,bcan include a computer display monitor544, a keyboard542, and a computer mouse534. External components504a,bcan also include touch screens, virtual keyboards, touch pads, pointing devices, and other human interface devices. Each of the sets of internal components502a,balso includes device drivers540to interface to computer display monitor544, keyboard542, and computer mouse534. The device drivers540, RAY drive or interface532, and network adapter or interface536comprise hardware and software (stored in storage device530and/or ROM524).

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Workloads layer90provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation91; software development and lifecycle management92; virtual classroom education delivery93; data analytics processing94; transaction processing95; and log debugging96. Log debugging96may relate to simulating a debugging process without actual step by step execution of the instructions in the production environment, where the stack frame is generated using the records of the log file.