V
Often it is not possible to trace from the very beginning of the software execution. Internal application tracing cannot trace anything before that application start and its early initialization. The same is for system-wide tracing that cannot trace before the logging subsystem or service starts. For this reason, each log has its visibility limit in addition to possible Truncation or Missing Components:
One of the solutions would be to use different logging tools and Inter-Correlation to glue activities, for example, Process Monitor and CDFControl for terminal services environments.
Some traces and logs may have Periodic Message Blocks with very similar message structure and content (mostly Message Invariants). The only significant difference between them is some unique data. We call such a pattern Visitor Trace by analogy with Visitor design pattern150 where tracing code “visits” each object data or data part to log its content or status.
What will you do when confronted with one million trace messages recorded between 10:44:15 and 10:46:55 with an average trace Statement Current of 7,000 msg/s from dozens of modules and having a one-sentence problem description? One solution is to try to search for a specific vocabulary relevant to the problem description. For example, if a problem is intermittent re-authentication, then we might try to search for the word “password” or a similar one drawn from a troubleshooting domain vocabulary. So, it is useful to have Vocabulary Index to search for. In our trace example, the search for “password” jumps straight to small Activity Region of authorization modules starting from the message number #180,010 and the last “password” occurrence is in the message #180,490 that narrows initial analysis region to just 500 messages. Note the similarity here between a book and its index and a trace as a software narrative and its vocabulary index.