# US 2013/0159977 A1 · Open kernel trace aggregation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0159977 A1 - Document ID: US20130159977A1 - Status: Published application - Kind: A1 - Application number: 13/325,074 - Filed: 2011-12-14 - Published: 2013-06-20 - Earliest claimed: 2011-12-14 - Assignees: Microsoft Corporation - Inventors: Christopher Crosetto; Akshay Johar; Brian Ewanchuk; Shane Guillet; Karen Franco; Austin Lamb; Danial Zaki - Web page: https://patentgrep.com/patent/US20130159977A1 ## CPC - G06F 11/3636: {by tracing the execution of the program} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 2201/86: Event-based monitoring - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A kernel trace system is described that acts as a kernel driver to insert traces into an open system kernel using existing kernel probe application-programming interfaces (APIs) and copies these events to an existing logging module for transfer to user space. The new module aggregates kernel traces to a performance logging module. A performance logging module can be extended with the kernel trace system herein to include new events in an open kernel not originally included in the implementation of the performance logging module. In this way, the kernel trace system can cause events to be logged that were not logged in the kernel as provided by the operating system vendor, and can do so without requiring that a new version of the operating system be built. The probes can be inserted dynamically at run time on an existing kernel to extract additional trace information. ## Claims ### Claim 1 A computer-implemented method to insert new trace probes into an operating system kernel, the method comprising: receiving information describing one or more traces to dynamically collect from an operating system that does not natively provide the described traces; determining one or more probe locations; locating one or more kernel entry points where the described trace information can be collected; creating one or more software probes corresponding to the determined one or more probe locations and located one or more kernel entry points; setting an output destination and format for trace information captured by the inserted software probes; and inserting the created one or more software probes at the corresponding one or more probe locations, wherein the preceding steps are performed by at least one processor. ### Claim 2 (depends on 1) The method of claim 1 wherein receiving information describing traces comprises specifying one or more operating system functions, application-programming interfaces (APIs), or other entry points from which to collect information. ### Claim 3 (depends on 1) The method of claim 1 wherein receiving information describing traces comprises specifying specific data that the trace will collect. ### Claim 4 (depends on 1) The method of claim 1 wherein receiving information describing traces comprises loading a kernel mode driver into the operating system that specifies the traces. ### Claim 5 (depends on 1) The method of claim 1 wherein locating kernel entry points comprises identifying a symbol table exported by the kernel of available entry points in the kernel. ### Claim 6 (depends on 1) The method of claim 1 wherein locating kernel entry points comprises locating a memory address associated with each entry point. ### Claim 7 (depends on 1) The method of claim 1 wherein determining probe locations comprises skipping beyond stack frame setup logic to locate the probe within a body of a function. ### Claim 8 (depends on 1) The method of claim 1 wherein determining probe locations comprises invoking a facility provided by the operating system for inserting probes into the kernel. ### Claim 9 (depends on 1) The method of claim 1 wherein determining probe locations comprises locating and end or exit point of a function so that inserted traces can log the state at the end of the function. ### Claim 10 (depends on 1) The method of claim 1 wherein creating software probes comprises determining at least one of a long jump with an address to be inserted in the original function, storage of an instruction that was originally located at the probe insertion point, and a data structure that determines which trace code is invoked to capture trace information. ### Claim 11 (depends on 1) The method of claim 1 wherein creating software probes comprises creating a probe that inserts a jump instruction, jumps to a location to run trace code, executes the instruction that was at the insertion location, and then jumps back to the function so that the function can continue its execution as normal. ### Claim 12 (depends on 1) The method of claim 1 wherein inserting probes comprises writing a long jump or other instruction at the appropriate location with an address that corresponds to probe trace logic. ### Claim 13 (depends on 1) The method of claim 1 wherein inserting probes comprises storing information for later removing the probe, so that the overwritten portion of the function can be placed back in its original state and any probe code can be deallocated. ### Claim 14 (depends on 1) The method of claim 1 wherein setting an output destination and format comprises routing captured trace information to another kernel module that is designed to aggregate trace information collected from the kernel and to copy the information to user mode where applications can gather and analyze the trace information. ### Claim 15 A computer system for dynamically tracing events in a kernel at run time, the system comprising: a processor and memory configured to execute software instructions embodied within the following components; a trace setup component that receives information describing trace information to be captured in an operating system kernel that is not captured in a static compiled version of the kernel; a probe injection component that injects one or more software probes dynamically at run time into the operating system kernel to add new trace code that will execute upon execution of software code at an injection point; an event detection component that detects execution of software at a probe injection point where a software probe has been inserted to collect trace information; an event aggregation component that aggregates multiple trace events reported by multiple injected probes into a central reporting module; a trace routing component that determines a reporting destination for aggregated trace events; and a trace logging component that stores reported trace information persistently for further analysis. ### Claim 16 (depends on 15) The system of claim 15 wherein the probe injection component invokes facilities of the operating system to insert probes into the kernel. ### Claim 17 (depends on 15) The system of claim 15 wherein the probe injection component provides a facility to remove probes at the end of tracing activity so that the kernel can once again function without the inserted trace probes without requiring a reboot of the computer hardware on which the kernel is executing. ### Claim 18 (depends on 15) The system of claim 15 wherein the event aggregation component formats the information into a format expected and handled by an existing performance/trace logging module that allows the use of existing performance and logging tools for captured trace information. ### Claim 19 A computer-readable storage medium comprising instructions for controlling a computer system to capture trace information from dynamically inserted trace probes, wherein the instructions, upon execution, cause a processor to perform actions comprising: receiving an indication that a location where a software probe was previously dynamically inserted into an operating system kernel has been reached for execution; identifying probe information related to the location reached for execution; invoking a trace handler that captures trace information associated with the reached location and then returns control to original operating system logic associated with the probe location; aggregating trace information from multiple software probes in a trace aggregation module; determining a trace destination and format for the aggregated trace information; and logging trace information to the determined destination and places the trace information in the determined format. ### Claim 20 (depends on 19) The medium of claim 19 wherein identifying probe information comprises identifying a trace handling function, a location to return upon completion of the trace handling, and a format and log destination to be used for information collected from the location.