Profiling a program based on a combination of dynamic instrumentation and sampling

A method implemented at a computer system for profiling a program based on a combination of multiple profilers, the method comprising:

• during an execution of a program,
• obtaining, by a first profiler, a first set of information associated with the execution of the program;
• and
• obtaining, by a second profiler, a second set of information associated with one or more executions of a function in the program, the second set of information comprising at least a call count or an execution time of each of the one or more executions of the function;
• identify a subset of the first set of information that is associated with the one or more executions of the function;
• create aggregate information based on (1) the subset of the first set of information, and (2) the second set of information associated with the one or more executions of the function, including detecting an anomaly based on correlating the first set of information and the second set of information associated with the execution of the function, the anomaly being detected when a number of samples collected during the one or more executions of the function are greater than a first threshold, and a total call count of the function is lower than a second threshold;
• and
• report the aggregate information.

A computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that are structured such that, when the computer-executable instructions are executed by one or more processors of a computer system, the computer system is configured to:

• during an execution of a program, profile the program by at least:
• obtaining, by a first profiler, a first set of information associated with the execution of the program;
• and
• obtaining, by a second profiler, a second set of information associated with one or more executions of a function in the program, the second set of information comprising at least a call count or an execution time of each of the one or more executions of the function;
• identify a subset of the first set of information that is associated with the one or more executions of the function;
• create aggregate information based on (1) the subset of the first set of information, and (2) the second set of information associated with the one or more executions of the function, including detecting an anomaly based on correlating the first set of information and the second set of information associated with the execution of the function, the anomaly being detected when a number of samples collected during the one or more executions of the function are greater than a first threshold, and a total call count of the function is lower than a second threshold;
• and
• report the aggregate information.