Disruption, Divergence, Overlap, Packet, Quantum

Activity disruption

Sometimes a few error messages or periodic errors with low statement density for specific activity regions or adjoint threads of activity (for a specific component, file, or function) may constitute activity disruption. If a particular functionality was no longer available at logging time, then its unavailability may not be explained by such disruptions, and such messages may be considered false positive errors in relation to the reported problem.

But if we have periodic message blocks containing only periodic errors, activity region or adjoint thread, discontinuity, or simply no activity, then we may have a complete cessation of activity that may correlate with the unavailable functionality.

Activity divergence

Sometimes we have several threads of activity—for example, from the same process—visible for a certain period. Then, suddenly, we see only one such thread till the end of a trace (or even none). This may be an indication of an application hang or, if several active threads doing logging are normal, some other abnormal behavior. If we consider such activities (including adjoint threads) as vectors running through some temporal “surface,” we can use the analogy of a divergence.

Activity overlap

Sometimes, specific parts of simultaneous use case trails, blocks of significant events, or message sets in general may overlap. This may be due to possible synchronization problems, such as race conditions (prognostics), or be due to visible root causes that are reported (diagnostics). We call this pattern activity overlap.

For example, a first request may start a new session, and we would expect that the second request would be processed by the same session.

However, users report that a second session started upon the second request. If we filter the execution log by session ID, we find that session initialization prologs are overlapped. The new session started because the first session initialization was not yet completed.

Activity packet

Sometimes, we are interested in a message set that has the same time attribute value (or rounded to a digit). We call this analysis pattern activity packet from analogy with wave packets. It may allow the identification of related threads and activities.

It is different from the activity quantum analysis pattern below where time attribute value may change for a continuous message set with the same thread ID.

Activity quantum

Once we have chosen a trace message, we are interested in its message context, which can span all “continuous” messages before and after from the same thread of activity. We call this activity quantum, which is variable and independent from CPU quantum. Different messages from activity quantum may be executed on different CPUs. The following diagram depicts this analysis pattern: