JP2015114786A - Information processing system and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To specify a traced application even in the case of simultaneously tracing an application and an OS in such situations that a plurality of applications have the same name.SOLUTION: A process information generation part 6 generates process information 5 in which process IDs designated for applications 2 and 3 are associated with the paths of the object files of the applications 2 and 3 in the case of executing the applications 2 and 3. A trace log generation part 17 generates a trace log in the same format as the trace log of an OS in which the process ID of the process information 5 is described as the trace logs of the applications 2 and 3. A trace analysis part 18 extracts the trace log in which the process ID of the process information 5 is described from the trace logs generated by the trace log generation part 17, and specifies the object files of the applications 2 and 3 on the basis of the path of the object file of the process information 5.

Description

  The present invention relates to program trace.

There is a technique called program trace (hereinafter also simply referred to as trace) for analyzing the operation of a program.
Trace is a mechanism for keeping track of software operations from the outside by keeping a trace log indicating that a specific function was called during program execution, a specific value was changed, or a specific processing path was passed. is there.
The following technologies are available as trace technologies.
For example, in order to correctly display the call stack when tail call optimization is performed, a technique that holds a program code operand, function name, and function address information is disclosed (for example, Patent Document 1). )
In addition, there is a technique (for example, Patent Document 2) that shows a method of holding function callers and function names on the called side in order of execution in order to grasp the order of function calls and the contents thereof.

JP 2010-287101 A JP 2001-282576 A

  When tracing application programs (hereinafter also simply referred to as applications) and OS (Operating System) simultaneously, if there are multiple applications with the same name (file name) but different, the traced application cannot be identified There is.

  One of the main objects of the present invention is to solve such a problem. In a situation where a plurality of different application programs have the same name, tracing is also performed when the application program and the OS are traced simultaneously. The main purpose is to make it possible to identify a registered application program.

An information processing system according to the present invention includes:
A process information generating unit that generates process information in which a process ID (Identifier) specified for the application program and a path of an object file of the application program are associated with each other when the application program is executed;
An OS (Operating System) trace log in which the process ID is described is generated, and the process ID indicated in the process information is described as the trace log of the application program. The trace log has the same format as the OS trace log. A trace log generator for generating
Extracting a trace log in which the process ID indicated in the process information is described from the trace log generated by the trace log generation unit, and based on the path of the object file associated with the process ID in the process information, And an object file specifying unit for specifying an object file of the application program.

According to the present invention, since the process ID is associated with the object file path of the application program in the process information, by extracting the trace log in which the process ID indicated in the process information is described, the application program Trace log can be extracted.
Further, the object file of the application program can be specified based on the path indicated in the process information.
For this reason, even when a plurality of different application programs have the same name, the trace log of the application program can be acquired and the traced application program can be specified.

1 is a diagram illustrating a configuration example of an information processing system according to Embodiment 1. FIG. FIG. 4 is a diagram showing an example of process information according to the first embodiment. FIG. 3 is a flowchart showing an operation example of the information processing system according to the first embodiment. FIG. 6 is a diagram illustrating an operation example of a program display unit according to the first embodiment. FIG. 4 is a flowchart showing an operation example of a program display unit according to the first embodiment. FIG. 3 is a diagram illustrating a hardware configuration example of the information processing system according to the first embodiment.

Embodiment 1 FIG.
In the present embodiment, a configuration will be described in which an executed application is uniquely identified by creating a correspondence table between the ID (Identifier) of the application to be executed and the path of the object file.

  FIG. 1 shows a configuration example of an information processing system 100 according to the present embodiment.

The application execution program 1 is a program that executes an application and creates a correspondence table between the process ID of the executed application and an object file.
The application execution program 1 includes a program execution unit 4 and a process information generation unit 6.
The program execution unit 4 executes an application.
The process information generation unit 6 generates a correspondence table (process information 5) between an application process ID and an object file.
FIG. 2 shows the process information 5.
As shown in FIG. 2, in the process information 5, the process ID is associated with the object file paths of the applications 2 and 3.

Assume that there are a plurality of applications executed in the information processing system 100.
In the present embodiment, description will be made using application 2 and application 3.
Application 2 and application 3 are different applications.
For this reason, the object files are different, and the path of the object file is also different.
However, it is assumed that the same name is set for the application 2 and the application 3.

Each of the application 2 and the application 3 has a function hook means that is called from each function in the application with a compile-time option.
Function hook means 9 exists in the application 2, and function hook means 10 exists in the application 3.
In the function hook means 9 and 10, a code for calling a specific function is embedded at the head of all the functions by the compiler like the -pg option of gcc (GNU Compiler), and the shared library 7 is called.
The function hook means 9 and 10 do not exist only in the trace function, but are functions generally used for performance analysis of a profiler and the like.

The shared library 7 calls a service of the OS 8 in the form of a system call.
The shared library 7 includes a function hook function processing unit 11, a start / end unit 12, a function address / argument acquisition unit 13, and a system call issue unit 14.

The function hook function processing unit 11 performs a function hook function called at the time of dynamic linking with the applications 2 and 3.
The start / end unit 12 is called from the function hook means 9 and 10 and determines whether or not to execute the trace.
The function address / argument acquisition unit 13 acquires the address of the function that called the function hook means 9 and 10 and the argument of the function.
The system call issuing unit 14 issues a system call and calls a service of the OS 8.

  The OS 8 includes a system call processing unit 15 and a trace log generation unit 17.

The system call processing unit 15 processes a system call from the shared library 7.
The trace log generation unit 17 traces the OS 8 and records the trace log in the OS trace log information 16.
In addition, the trace log generation unit 17 records the trace logs of the applications 2 and 3 in the OS trace log information 16 in the same format as the OS 8 trace log.
The trace log generated by the trace log generation unit 17 includes the process ID and the address of the executed function.

The trace analysis unit 18 analyzes the OS trace log information 16, extracts a trace log in which the process ID indicated in the process information 5 is described from the OS trace log information 16, and associates it with the process ID in the process information 5. The object files of the applications 2 and 3 are specified based on the object file path.
Further, the trace analysis unit 18 acquires a function name corresponding to the address of the function described in the trace log of the applications 2 and 3 from the identified object files of the applications 2 and 3.
Then, the trace analysis unit 18 creates application / kernel trace log information 23 that is a trace log of the application and the kernel.
Note that the trace analysis unit 18 corresponds to an example of an object file specifying unit.

  The trace analysis unit 18 includes a function name extraction unit 19, a process information reference unit 20, a trace log collection unit 21, and a function / argument conversion unit 22.

The function name extraction unit 19 refers to the applications 2 and 3 and acquires the function name.
The process information reference unit 20 refers to the process information 5 and acquires the path of the object file from the process ID.
The trace log collection unit 21 acquires the OS trace log information 16.
The function / argument conversion unit 22 converts the OS trace log information 16 into application / kernel trace log information 23.

The trace result display tool 24 is a tool for displaying the application / kernel trace log information 23.
The trace result display tool 24 includes a program display unit 25 that draws a program source of a function executed from the application / kernel trace log information 23.
More specifically, the program display unit 25 analyzes the debug information included in the object files of the applications 2 and 3 to identify the location where the function name extracted by the function name extraction unit 19 is described, The program source at the location where the function name is described is acquired from the debug information and rendered.

Next, the operation will be described.
FIG. 3 is a flowchart showing an operation example of the information processing system 100 according to the present embodiment.

First, in step 100, the program execution unit 4 executes the applications 2 and 3.
When executing the applications 2 and 3, the user designates an object file.

Next, in step 101, the process information generation unit 6 creates process information 5 from the process IDs of the executed applications 2 and 3 and the path of the object file.
In the case of Unix (registered trademark), the process ID can be obtained by the getpid () function.
Also, the program can be executed by specifying the path of the object file with the execute () function.

Next, in step 102, the dynamic link between the shared library 7 and the applications 2 and 3 is performed in the applications 2 and 3 executed in step 100.
During this dynamic linking, the function hook function processing unit 11 of the shared library 7 rewrites the code of the function hook units 9 and 10 so that the function hook units 9 and 10 call the start / end unit 12 of the shared library 7. .

Next, in step 103, when dynamic linking with the shared library 7 is performed, the applications 2 and 3 start to operate, the main () function is called, and each function is executed accordingly.
When each function is executed, the function hook means 9 and 10 are called at the head of each function.

Next, in step 104, the start / end unit 12 of the shared library 7 is called, and the function address / argument acquisition unit 13 acquires the address of the function that called the function hook means 9, and the function argument.
Further, the system call issuing unit 14 executes a system call that explicitly causes an error.
At this time, the address of the function and the argument of the function acquired by the function address / argument acquisition unit 13 are set in the argument of the system call.

Next, in step 105, the system call processing unit 15 calls the trace log generation unit 17 to record the function trace.
The trace log generation unit 17 records function trace information in the OS trace log information 16 as system call trace information together with recording of other events (file write, interrupt occurrence, context switch, etc.) in the OS 8.
Further, since the operating system call processing unit 15 is operated from the applications 2 and 3 and the process ID is the same as that of the applications 2 and 3, when the function trace information is recorded in the OS trace log information 16, The process ID of the call processing unit 15 is recorded.

  Next, in step 106, the operations of the applications 2 and 3 are finished.

Next, in step 107, the trace log collection unit 21 acquires the OS trace log information 16 recorded by the trace log generation unit 17 and passes it to the function / argument conversion unit 22.
At this time, the function trace information of the applications 2 and 3 is recorded in the OS trace log information 16 only as system call trace information.
That is, the trace logs of the applications 2 and 3 are generated in the same format as the trace log of the OS8.

Next, in step 108, the function / argument conversion unit 22 analyzes the trace information for each time of the OS trace log information 16 obtained in step 107, and sends the process ID obtained from the analysis result to the process information reference unit 20. .
That is, the function / argument conversion unit 22 extracts a trace log in which the process ID included in the process information 5 is described from the OS trace log information 16, and uses the process ID of the extracted trace log as the process information reference unit 20. Send to.

  Next, in step 109, the process information reference unit 20 refers to the process information 5, obtains an object file path from the process ID obtained in step 108, and sends it to the function / argument conversion unit 22.

  Next, in step 110, the function / argument conversion unit 22 sends the function information (function address and argument) obtained from the analysis result in step 108 and the object file path obtained in step 109 to the function name extraction unit 19. .

  Next, in step 111, the function name extraction unit 19 specifies the application 2 or application 3 to be referred to from the path of the object file obtained in step 110, and the function information obtained in step 110 from the identified application 2 or application 3. The function name is obtained based on the function address, and sent to the function / argument conversion unit 22.

  Next, in step 112, the function / argument conversion unit 22 uses the time information of the trace information analyzed at step 108, the process ID, the function argument information, the kernel trace log, and the function name obtained in step 111 as the application. / Output to kernel trace log information 23.

  Next, at step 113, when displaying the application / kernel trace log information 23, the program display unit 25 displays which function of which application is executed from the trace information of the application.

The program display unit 25 will be described.
FIG. 4 shows an operation example of the program display unit 25.
The applications 2 and 3, process information 5, application / kernel trace log information 23, trace result display tool 24, and program display unit 25 are the same as those in FIG.
It is assumed that the object files of the applications 2 and 3 have debug information 26 and 27, respectively, and the debug information 26 and 27 includes what program source the executed function is in which line and the program source.

  FIG. 5 is a flowchart illustrating an operation example of the program display unit 25.

  First, in step 200, the program display unit 25 displays the application / kernel trace log information 23 line by line for each time.

  Next, in step 201, the program display unit 25 selects one line from the log displayed in step 200.

  Next, in step 202, the program display unit 25 reads the information of the trace log line selected in step 201.

  Next, in step 203, the program display unit 25 refers to the process information from the process ID recorded in the trace log information read in step 202, and obtains an object file path.

  Next, in step 204, the program display unit 25 searches the debug information in the object file specified in step 203 for a match with the function of the trace log information read in step 202, and which program source is the function. Get the information of the function of which line.

  Next, in step 205, the program display unit 25 reads the program source specified in step 204 from the debug information.

  Finally, in step 206, the program display unit 25 displays the function part program source from the program source acquired in step 205 and the number of function lines acquired in step 204.

As another means for creating the process information 5, there is the following method.
When the application execution program 1 does not execute the applications 2 and 3 by the program execution unit 4 and creates the process information 5 by the process information generation unit 6 but issues a system call by the system call issue unit 14 , The path of the object file is obtained with the execute () function.
Further, since the current process ID becomes the PID of the application, the process ID can be obtained and the process information 5 can be created in the OS 8.

Finally, a hardware configuration example of the information processing system 100 shown in the present embodiment will be described with reference to FIG.
The information processing system 100 is a computer, and each element of the information processing system 100 can be realized by a program.
As a hardware configuration of the information processing system 100, an arithmetic device 901, an external storage device 902, a main storage device 903, a communication device 904, and an input / output device 905 are connected to a bus.

The arithmetic device 901 is a CPU (Central Processing Unit) that executes various programs including the OS, shared library, and application shown in FIG.
The external storage device 902 is, for example, a ROM (Read Only Memory), a flash memory, or a hard disk device.
The main storage device 903 is a RAM (Random Access Memory).
The communication device 904 is, for example, a NIC (Network Interface Card).
The input / output device 905 is, for example, a mouse, a keyboard, a display device, or the like.

The program is normally stored in the external storage device 902, and is loaded into the main storage device 903 and sequentially read into the arithmetic device 901 and executed.
The program also includes a program that realizes the function described as “˜unit” shown in FIG.
In the description of the present embodiment, it is described as “determining”, “determining”, “extracting”, “generating”, “acquiring”, “specifying”, etc. Information, data, signal values, and variable values indicating the results of processing are stored in the main storage device 903 as files.

  The configuration in FIG. 6 is merely an example of the hardware configuration of the information processing system 100, and the hardware configuration of the information processing system 100 is not limited to the configuration illustrated in FIG. Also good.

  1 application execution program, 2 application, 3 application, 4 program execution unit, 5 process information, 6 process information generation unit, 7 shared library, 8 OS, 9 function hook unit, 10 function hook unit, 11 function hook function processing unit, 12 start / end unit, 13 function address / argument acquisition unit, 14 system call issue unit, 15 system call processing unit, 16 OS trace log information, 17 trace log generation unit, 18 trace analysis unit, 19 function name extraction unit, 20 Process information reference unit, 21 Trace log collection unit, 22 Function / argument conversion unit, 23 Application / kernel trace log information, 24 Trace result display tool, 25 Program display unit, 100 Information processing system.

Claims (5)

A process information generating unit that generates process information in which a process ID (Identifier) specified for the application program and a path of an object file of the application program are associated with each other when the application program is executed;
An OS (Operating System) trace log in which the process ID is described is generated, and the process ID indicated in the process information is described as the trace log of the application program. The trace log has the same format as the OS trace log. A trace log generator for generating
Extracting a trace log in which the process ID indicated in the process information is described from the trace log generated by the trace log generation unit, and based on the path of the object file associated with the process ID in the process information, An information processing system comprising: an object file specifying unit that specifies an object file of the application program. The trace log generation unit
As the trace log of the application program, a trace log having the same format as the trace log of the OS, in which the process ID and the address of a function executed when the application program is executed, is generated.
The object file specifying unit
The information processing system according to claim 1, wherein the function name corresponding to the address of the function described in the extracted trace log is acquired from the identified object file. The information processing system further includes:
Analyzing the identified object file, identifying the location in the object file in which the function name obtained by the object file identification unit is described, obtaining the program source of the location in which the function name is described, The information processing system according to claim 2, further comprising a program display unit that displays the acquired program source. The program display unit
Analyzing debug information included in the identified object file, identifying a location where the function name is described, and obtaining a program source of the location where the function name is described from the debug information The information processing system according to claim 3. A process information generation process for generating process information in which a process ID (Identifier) specified for the application program and a path of an object file of the application program are associated with each other when the application program is executed;
An OS (Operating System) trace log in which the process ID is described is generated, and the process ID indicated in the process information is described as the trace log of the application program. The trace log has the same format as the OS trace log. Trace log generation processing to generate
Extracting a trace log in which the process ID indicated in the process information is described from the trace log generated by the trace log generation process, and based on the path of the object file associated with the process ID in the process information, A program for causing a computer to execute an object file specifying process for specifying an object file of the application program.

Images