System and method for troubleshooting runtime software problems using application learning

A method of analyzing execution traces of a computer program, comprising:

• receiving a set of identifiers of situation classes as parameters;
• accumulating execution patterns for an application during execution of the computer program in accordance with the set of identifiers of situation classes;
• classifying the execution patterns by the set of identifiers of situation classes to produce classified execution patterns;
• tracing execution patterns of a copy of said program being diagnosed;
• comparing, using a computer processor, the traced execution patterns to the classified execution patterns to produce matching traced execution patterns and matching classified execution patterns;
• identifying trace regions corresponding to the matching traced execution patterns;
• and
• displaying trace regions according to a likelihood that said trace regions indicate improper execution of said copy of said program, wherein the likelihood is determined based at least in part on situation classes associated with the matching classified execution patterns.

A method for application learning, comprising:

• storing one or more user-defined execution categories as parameters;
• collecting, using a computer processor, a learning mode trace log of an application, during execution of the application according to the execution classes, to produce trace data;
• separating said trace data into logical streams;
• generating patterns from said logical streams;
• and
• storing said patterns in a pattern database, wherein each of the user-defined execution categories is associated with at least one of the stored patterns in the pattern database,
• wherein the pattern database is configured to provide information sufficient to enable a processor to identify a pattern in a diagnostic mode trace log of the application being diagnosed that matches a pattern stored in the pattern database, and determine an execution category associated with the pattern in the pattern database.

A computer-implemented method for evaluating execution trace data, comprising:

• separating trace data into one or more logical streams;
• receiving a set of user-defined situation class identifiers that identify situation classes in which a computer program may be executed;
• filling a stream history array from at least a portion of data in a first logical stream to define a pattern, the data in the first logical stream being generated based on execution of the computer program in accordance with one of the situation classes;
• adding said pattern to a pattern database as a new pattern if said pattern does not already not exist in said pattern database;
• and
• associating with said new pattern the user-defined situation class identifier corresponding to the situation class in accordance with which the computer program was executed,
• wherein the pattern database is configured to provide information sufficient to enable a processor to identify a pattern in a trace log of a copy of the computer program being diagnosed that matches a pattern stored in the pattern database, and determine a user-defined situation class identifier associated with the pattern in the pattern database.

A method for analyzing execution trace information of a computer program being diagnosed, comprising:

• maintaining a pattern database comprising stored patterns gathered during execution of the computer program during a learning mode in accordance with an arbitrary number of situation classes, the situation classes being user-defined and passed as a parameter, wherein the stored patterns are associated with corresponding situation classes based on the execution of the computer program;
• separating trace data gathered from the computer program being diagnosed into one or more logical streams;
• identifying a match between at least a portion of data in a first logical stream and a stored pattern in the pattern database;
• and
• displaying a situation class associated in the pattern database with said stored pattern in connection with said at least a portion of data.