Triage: diagnosing production run failures at the user's site
Honeycomb: creating intrusion detection signatures using honeypots