Information processing program, information processing method, and information processing system

Abstract

To provide an information processing program, an information processing method, and an information processing system for improving system reliability.SOLUTION: A computer executes a predetermined program to determine whether or not a predetermined condition for collecting data is met based on a call path of a predetermined function called by the predetermined program and a first route list representing one or more other functions called before the predetermined function is called in the order of call, and to execute a process for collecting first investigation data when the predetermined condition is met.SELECTED DRAWING: Figure 9

Description

[Technical field]

[0001] The present invention relates to an information processing program, an information processing method, and an information processing system. [Background technology]

[0002] In today's information society, system troubles entail great risks such as business interruption, information leaks, and damage to customers. Furthermore, as cloud services become more prevalent in various fields, there is a greater need for quicker problem resolution than ever before.

[0003] Generally, system troubles are resolved by the support department of each organization, such as the computer or software manufacturer, the company that delivered the system, or a company specializing in support. For example, the support department receives information about the trouble from the operator and investigates the cause of the trouble by reproducing the condition in which the trouble occurred in the analysis environment owned by the support department.

[0004] However, there are some problems that the support department cannot reproduce the condition in which the problem occurred, and cannot be solved with the operation logs of hardware and software or trace information of various programs, and such problems tend to take a long time to solve. In such cases, the investigation to determine the cause is often carried out in the following procedure.

[0005] One method, because it is difficult to predict what information will be useful in an investigation, is to create a correction program specifically for the investigation after the problem occurs and have the operator run the correction program on the information processing system to collect information. Another method is to have the operator repeatedly collect dumps until a process dump is collected when the problem reoccurs.

[0006] However, in the case of the method of collecting information by applying a patch, it takes time to create the patch, and the operator is forced to carry out the burden of testing the application of the patch, applying the patch, running tests to collect information, and disabling the patch after the investigation, which places a high operational burden on the investigation. Therefore, it is difficult to apply a patch to collect information and conduct an investigation. In addition, the technique of having the operator repeatedly collect dumps places a burden on the operator to collect dumps, and there is a risk that the operation of the system will be affected if dumps are collected multiple times. If the operation is affected, the investigation using this method may be stopped at the discretion of the operator, and it may not be possible to collect the desired information. Therefore, this method also places a high operational burden and is difficult to implement, and there are cases in which the desired information cannot be collected and it is difficult to solve the problem after all.

[0007] Therefore, a technique has been proposed as an investigative technique for solving problems in the past, in which predetermined additional information is added to the normal trace log for a period when certain conditions are met, and then this registered information is output when a specific function is executed, thereby collecting information that is useful for identifying the cause.

[0008] For example, a technique has been proposed for collecting function arguments and return values, which suppresses the addition of arguments and return values ​​for a specific function when the number of functions called from that specific function is one or less, and controls the writing of function call information to a buffer.In addition, a technique has been proposed in which, when a problem occurs, the execution module itself operates as an error handler to perform a specified error processing to collect information. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] Patent Publication No. 2022-107270 [Patent Document 2] JP 2009-259078 A Summary of the Invention [Problem to be solved by the invention]

[0010] However, in conventional techniques for collecting and outputting additional information during a period that satisfies a specific condition, the section in which the additional information is collected is wide, making it difficult to obtain a large amount of additional information at each location within the section, and there is a risk that information useful for the investigation will be missed and unnecessary information will be collected, resulting in a high operational load. Thus, with conventional techniques for investigating problems, it is difficult to obtain information useful for the investigation while suppressing the operational load, making it difficult to improve the reliability of the system.

[0011] The disclosed technology has been made in consideration of the above, and aims to provide an information processing program, an information processing method, and an information processing system that improve the reliability of the system. [Means for solving the problem]

[0012] In one aspect of the information processing program, information processing method, and information processing system disclosed in the present application, a specified program is executed, and a first determination is made as to whether or not a predetermined condition for collecting data is met based on a first route list that represents the call path of a specified function called in the specified program and one or more other functions called before the specified function is called in order of calling, and if the predetermined condition is met, the computer is caused to execute a process of collecting first investigation data. Effect of the Invention

[0013] In one aspect, the present invention can improve the reliability of a system. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a block diagram of an operating environment computer according to an embodiment. [Diagram 2] FIG. 2 is a block diagram of an analysis environment computer according to an embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of the route related information. [Figure 4] FIG. 4 is a diagram showing a specific information table for matching. [Diagram 5] FIG. 5 illustrates an example of a function call. [Figure 6] FIG. 6 is a diagram showing an example of a correspondence table of a memory map. [Figure 7] FIG. 7 is a diagram showing an example of the result of converting the contents of a stack segment in the operational environment computer to match the analysis environment computer. [Figure 8] FIG. 8 is a diagram showing an outline of the operation of the analysis environment computer. [Figure 9] FIG. 9 is a flowchart of a program execution process by the operational environment computer. [Figure 10] FIG. 10 is a flowchart of the investigation data collection process when investigation data is collected by the entry built-in function in the operation environment computer. [Figure 11] FIG. 11 is a flowchart of the investigation data collection process when investigation data is collected by the exit built-in function in the operational environment computer. [Figure 12] FIG. 12 is a flowchart of a program execution process by the analysis environment computer. [Figure 13] FIG. 13 is a flowchart of the investigation material collection process when investigation material is collected by the entrance built-in function in the analysis environment computer. [Figure 14] FIG. 14 is a flowchart of the investigation data collection process when investigation data is collected by the exit built-in function in the analysis environment computer. [Figure 15] FIG. 15 is a flowchart of the analysis process by the analysis environment computer. [Figure 16] FIG. 16 is a diagram showing the hardware configuration of a computer. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] Hereinafter, an information processing program, an information processing method, and an information processing system disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the information processing program, the information processing method, and the information processing system disclosed in the present application are not limited to the following embodiments. EXAMPLES

[0016] Fig. 1 is a block diagram of an operation environment computer according to an embodiment, and Fig. 2 is a block diagram of an analysis environment computer according to an embodiment.

[0017] The operational environment computer 1 is a computer that is actually used to carry out business. The support department investigates the cause of events such as failures that occur in the operational environment computer 1 using the analysis environment computer 2. When investigating the cause of an event, the operational environment computer 1 collects investigation materials to be used for the investigation.

[0018] The analysis environment computer 2 is a computer located in the support department. The analysis environment computer 2 is configured with the same system environment as the operational environment computer 1, and reproduces the occurrence state of the event that is the subject of cause investigation in the operational environment computer 1, using the investigation materials collected in the operational environment computer 1.

[0019] The operation of the operational environment computer 1 when collecting investigation materials will be described in detail with reference to Fig. 1. As shown in Fig. 1, the operational environment computer 1 has a program processing unit 11, a context-dependent operation unit 110, a data storage unit 15, and an input unit 16. The context-dependent operation unit 110 also has a setting file reading unit 111, a matching processing unit 112, an investigation materials collection unit 113, and a path information acquisition unit 114. Furthermore, the operational environment computer 1 has a program 100 in which an event occurs that is the subject of cause investigation.

[0020] When an administrator of the operational environment computer 1 investigates the cause of a particular event, such as a problem, that has occurred at least once in the past, the administrator requests the support department in charge of the operational environment computer 1 to investigate the cause.

[0021] The program 100 to be run on the operational environment computer 1 is embedded with an entry intrinsic function and an exit intrinsic function for collecting investigation materials, such as obtaining a simple dump. An entry intrinsic function is basically embedded for each function included in the program 100, and is called when the function is called. An exit intrinsic function is embedded for each function included in the program 100, and is called when the function returns to the function that called it. The entry intrinsic function and the exit intrinsic function are embedded in the program 100 automatically, for example, by an insert option of a compiler. Each function in the program 100 in which the entry intrinsic function and the exit intrinsic function are embedded is an example of a "predetermined function". Note that the entry intrinsic function and the exit intrinsic function are not embedded in the functions for implementing the present invention itself, and therefore these are not "predetermined functions". It is possible to prevent the incorporation of the functions that are not "predetermined functions" by instructing the compiler, etc.

[0022] Both the entry built-in function and the exit built-in function record route information indicating the history of the function that called them, update setting information 152 in which setting information for investigation material collection is registered, and handle the process for collecting investigation material from the context-dependent operation unit 110. Setting information 152 is a table that is referenced by the matching processing unit 112 and the investigation material collection unit 113, and the investigation material collection process is executed according to the settings. The operation of the entry built-in function and the exit built-in function will be described in detail later.

[0023] Here, if the program 100 is processed in an interpreter-type language, it is also possible to write it as a parameter in the form of an option so that "an instruction to embed the entry intrinsic function and the exit intrinsic function is given" when the source is read and executed. In this case, when the program 100 is executed by the program processing unit 11, the entry intrinsic function and the exit intrinsic function are embedded in the program 100, or are processed as if they were embedded.

[0024] An administrator of the operational environment computer 1 causes the operational environment computer 1 to store and execute a program 100 in which an entry intrinsic function and an exit intrinsic function are embedded.

[0025] The data storage unit 15 holds route-related information 151, setting information 152, and setting file 153. The area in the data storage unit 15 for storing the route-related information 151 corresponds to a route information buffer secured in the initialization process at the time of process startup, which will be described later, and in the thread initialization process called at the time of thread startup. The setting information 152 corresponds to the initialization process at the time of process startup, which will be described later, and the contents of the setting file 153 read into memory by the setting file reading unit 111.

[0026] FIG. 3 is a diagram showing an example of path-related information. As shown in FIG. 3, the path-related information 151 registers a path list, a path path length, a parent function stack, and a current path path. In the path list, information indicating a called function and a function returning to the caller is arranged in the order of execution. In FIG. 3, the left end of the path list is the function that was called first, and the function names are registered in the order of the calls or returns to the right. However, in the path list, when returning from a specific function to the caller function, a symbol indicating a return is added to the function name of the specific function. In FIG. 3, a dash added to the function name indicates that a return has been made to the caller function.

[0027] Here, in FIG. 3, the function name is used as information indicating the function for easy understanding, but in reality, the storage address of the code corresponding to the function name is used. For example, if a specific function is arranged at an address of 0x100 to 0x1ff, when the specific function is called, any address between these addresses becomes information indicating the function. When comparing functions, the path related information 151 actually judges that they are the same function if the address to be compared is included in the section of the code corresponding to the function. Note that the difference between the function name without a dash when the function is called and the function name with a dash when returning from the function to the parent function may be distinguished by preparing a dedicated area paired with the address information, with 1 indicating when the function is called (without dash) and 0 indicating when returning to the function (with dash), or by using the lower 1 bit part of the return address as the information. In the following explanation, it is assumed that the function name or the item with a dash in the function name is actually judged as described above.

[0028] The route path length is registered as information indicating the depth to the corresponding function, i.e., the number of functions called up to that function including that function. Specifically, the route path length is registered as a relative path length based on the target path length. In other words, the route path length is a relative value to the depth of this target function.

[0029] Furthermore, the parent function stack registers the functions above the corresponding function. Here, functions within the range of the set scope path are not registered in the parent function stack. For example, if the scope path is a / b, a and b are not registered in the parent function stack in Figure 3. Next, the route path up to the corresponding function is registered as the current route path. In this current route path as well, a route path is registered in which functions within the range of the set scope are omitted.

[0030] The setting file 153 is input by the administrator using the input unit 16, and is stored in the setting information 152 of the data storage unit 15 by the setting file reading unit 111 in the context-dependent operation unit 110 in the entry built-in function and the exit built-in function during initialization processing at the time of process startup. In the setting file 153 and the setting information 152, matching information including the target function, the scope path, and the checkpoint function, other conditions for collecting investigation materials, and settings for collecting investigation materials such as operations during collection of investigation materials are registered. Here, the target function is a function that triggers the collection of investigation materials. In addition, the checkpoint function is a function that is a condition for collecting investigation materials if it is passed through before the target function is called, that is, a function that is a condition for collecting investigation materials if it exists on the path until the target function is called. The scope path is information indicating the specified effective range. By setting the scope range, the verification range in determining whether or not to collect investigation materials can be narrowed, and it is possible to prevent overdetection and reduce the processing load by searching for parts that do not need to be verified.

[0031] Note that the timing when configuration file reading unit 111 in context-dependent operation unit 110 in the entry built-in functions and exit built-in functions reads configuration file 153 is limited to when the configuration file reload flag in data storage unit 15 is on. The configuration file reload flag is turned off when configuration file 153 is read. Also, the configuration file reload flag is turned on when a signal handler embedded in the process initialization process receives a signal. There are no particular limitations on the method of sending a signal, as long as it can send the signal number set by the signal handler. Also, communication between processes using signals is just one example, and other methods can be used as long as they can perform equivalent inter-process communication.

[0032] Here, a brief explanation will be given of how to determine the target function. When determining the target function, the support department staff can use either a top-down method, a bottom-up method, or both.

[0033] In the top-down method, the person in charge infers the function that is being operated from the event that has occurred, and narrows down the parts of the processing of that function that are likely to be related to the error through source review.

[0034] In the bottom-up method, the person in charge performs a source search using an error-specific message contained in the error information as a key to identify the target function. After identifying the function, the person in charge uses a call graph to identify the function that called the target function. A call graph is a directed graph that represents the calling relationships between subroutines in a program. The person in charge can find the calling path of the target function by tracing the directed graph from the tip to the root.

[0035] When using both the top-down and bottom-up methods, the engineer identifies the target function using the following procedure. In the bottom-up method using a static call graph, call paths that never occur in actual operation are also included. Therefore, the engineer considers the context used in the top-down analysis and narrows down the target function to the function related to the operation where the problem occurred.

[0036] Next, we will briefly explain how to determine the checkpoint function. The checkpoint function is used to prevent false positives and narrow down problem areas by taking into account the context leading up to the target function.

[0037] The person in charge identifies a dynamic path to the target function based on information from the user. Furthermore, the person in charge determines a checkpoint function that is a condition for the occurrence of an event from among the paths to the target function based on data used when the event occurred. Furthermore, the person in charge can determine a scope from the target function and the checkpoint function.

[0038] In addition, since the functions that become checkpoints are included in the functions leading up to the target function, the target function is specified in the analysis environment computer 2, and the settings are set so that the path information leading up to the target function is output when the target function is called. Then, by performing an operation that may cause an event in the operation environment computer 1, it is possible to obtain call path information of the path functions. It is also possible to select the function (path) to be the checkpoint from this information.

[0039] In the setting information 152, the target function, checkpoint function, and scope determined in the above-mentioned procedure are registered.

[0040] The processing performed by the program processing unit 11 includes, for example, processing by an OS (Operating System). When the program processing unit 11 receives an instruction to execute the program 100, it reads the program 100 and executes it from an entry point. The program 100 executed from the entry point is executed through an initialization processing unit (initialization processing for process startup) executed at the time of process startup and an initialization processing unit (initialization processing for thread startup) executed at the time of thread startup. In this embodiment, the program 100 is embedded with the initialization processing for process startup (#1) according to this embodiment just before the initialization processing for process startup of the original program. Also, the program 100 is embedded with the initialization processing for process startup (#2) according to this embodiment just after the initialization processing for process startup of the original program. Also, when the original program is multi-threaded, the program 100 is embedded with the initialization processing for thread startup (#3) according to this embodiment before the initialization processing for thread startup. Note that the embedding of these processing units may be done by embedding the actual processing entities, or by incorporating the entities by loading a dynamic library at the time of program startup as only the entry point of the function. Also, it may be implemented by overriding the processing contents using a technique such as DLL (Dynamic Link Library) injection, etc. Also, in the case of an interpreted language, it may be specified to dynamically load the entity using an interpreter option, etc.

[0041] The process startup initialization process (#1) according to this embodiment described above registers a signal handler that turns on the reload flag of the configuration file 153 in the data storage unit 15. The process startup initialization process (#2) according to this embodiment reads the configuration file 153 and stores it in the configuration information 152 of the data storage unit 15. Next, the program processing unit 11 secures a route buffer area for storing route-related information 151 including a route list indicating the route of the function called by the main thread. Next, the program processing unit 11 reads symbol information of each function of the program 100 and creates a hash for searching the storage address of the code from the function name. Then, the program processing unit 11 converts the functions constituting the target path registered in the configuration information 152 into the corresponding addresses using the created hash, and stores them in the management table as target path information. The program processing unit 11 performs the same for the checkpoint path. Also, the thread startup initialization process (#3) according to this embodiment secures a route buffer area for storing route-related information 151 including a route list indicating the route of the function called by the thread.

[0042] After completing the above initialization process, the program processing unit 11 executes the main body of the application. Here, the above initialization process includes process startup initialization process (#1), process startup initialization process for the original program, and process startup initialization process (#2). In the case of multi-threading, the above initialization process further includes thread startup initialization process (#3) and thread startup initialization process for the original program. Note that if the program processing unit 11 receives a signal even while the process of the application main body is being executed, the signal handler turns on the reload flag of the configuration file 153.

[0043] The program processing unit 11 calls each function to execute the application main body of the program 100. When each function is called, an entry built-in function is called. Also, when returning from each function to the function that called it, an exit built-in function is called. The entry built-in function and the exit built-in function execute the context-dependent operation unit 110. The context-dependent operation unit 110 has a setting file reading unit 111, a matching processing unit 112, an investigation data collection unit 113, and a route information acquisition unit 114. Also, the setting file reading unit 111 and the route information acquisition unit 114 are implemented by the entry built-in function and the exit built-in function, and the matching processing unit 112 and the investigation data collection unit 113 are implemented by either the entry built-in function or the exit built-in function. The side to be implemented is determined by the value of the setting information 152.

[0044] Setting file reading unit 111 of context-dependent operation unit 110 checks the reload flag in the management table to determine whether or not to reload setting file 153. If the reload flag is on, setting file reading unit 111 reads setting file 153 and updates setting information 152 in data storage unit 15.

[0045] The path information acquisition unit 114 of the context-dependent operation unit 110 regards the function that called the entry built-in function as a parent function and registers information indicating that the parent function has been called in the path list of the path related information 151. For example, if the function name of the function in which the entry built-in function is embedded is a, the path information acquisition unit 114 registers "a" in the path list. Note that, for simplicity of explanation, the thing to be registered is the function name here, but the information to be registered may be other information as long as it is information indicating an address and information indicating that it has been called from the parent function.

[0046] Similarly, the path information acquisition unit 114 of the context-dependent operation unit 110 registers information indicating that the function that called the exit built-in function has returned from the parent function to the caller function in the path list of the path related information 151, with the function being the parent function. For example, if the function name of the function in which the exit built-in function is embedded is e, the path information acquisition unit 114 registers "e'" with a dash added to the function name in the path list as a code indicating a return to the caller. Note that, for simplicity of explanation, the thing to be registered is the function name here, but the information to be registered may be other information as long as it is information indicating an address and information indicating that it has been called from the parent function.

[0047] Furthermore, when an entry built-in function or an exit built-in function is executed, the context-dependent operation unit 110 judges whether the function name of the parent function matches the function name of the target function. Here, whether the entry built-in function or the exit built-in function is used to collect investigation material is specified in advance in the setting file 153 and stored in the setting information 152. Then, when either the entry built-in function or the exit built-in function specified in the setting information 152 is executed, the context-dependent operation unit 110 judges whether the function name of the parent function matches the function name of the target function.

[0048] If the function names match, the context-dependent operation unit 110 follows the parent function to obtain the call path to the target function. Then, the context-dependent operation unit 110 determines whether the parent function matches the target function. If the parent function matches the target function, the context-dependent operation unit 110 registers the parent function in the parent function stack, and then instructs the matching processing unit 112 to execute a matching process.

[0049] The matching processing unit 112 receives an instruction to execute the matching process from the context-dependent operation unit 110. Then, the matching processing unit 112 acquires the route-related information 151 from the data storage unit 15, and executes the following matching process.

[0050] Fig. 4 is a diagram showing a designation information table for matching. In Fig. 4, the function at the top of the target function path is simply represented as a. Also, the path name related to the checkpoint function is expressed by omitting the scope path. The matching processing unit 112 acquires the information shown in table 141 in Fig. 4 from the setting information 152 as designation information for matching. For example, the matching processing unit 112 acquires information on the target function, the scope path, and the checkpoint function.

[0051] In this case, the condition for the matching process is that the path name is "a / b / m / n / x" and the function named x is the target function. The scope path, which indicates the range of the scope, is "a / b". Table 141 shows the checkpoint functions excluding the scope path. Checkpoint function #0 is the first function to be passed through, and "a / c / d / e" with the scope path added corresponds to the actual path. Checkpoint function #1 is the second function to be passed through, and "a / b / l / e" with the scope path added corresponds to the actual path.

[0052] FIG. 5 is a diagram showing an example of a function call. Here, the matching process will be described using the function call 101 shown in FIG. 5 as an example. Here, FIG. 5 shows an example in which the timing of data collection is the timing when the entry built-in function is called, and the matching location of the checkpoint function is the function registered in the route list when the entry built-in function is called (i.e., a function without a dash), and the description will be based on this case. The function call 101 shows the functions called in order from the top of the page. For example, when "a / b" and "a / b / c" are lined up, it indicates that "a / b / c", i.e., function c, was called in "a / b", i.e., function b. In addition, in the function call 101, the return to the calling function is omitted. For example, when "a / b / c" and " / a / b / d" are lined up, it indicates that "a / b / d", i.e., function d, was called after "a / b / c", i.e., function c, returned to "a / b", i.e., function b. In addition, in the series of function calls shown in function call 101, checkpoint functions are called as shown in functions 102 and 103. Furthermore, the final function 104 in function call 101 is the current function, which is the parent function that called the entry built-in function at that time, and is the target function "a / b / m / n / x".

[0053] In Fig. 3, the matching processing unit 112 refers to the parent function stack of the current function and calculates the route path length of the current function together with the scope. In this case, m and n are registered in the parent function stack of the current function. Therefore, the matching processing unit 112 determines that m and n exist in the path of the current function x, and further that a and b, which are the scopes, exist. Therefore, the matching processing unit 112 determines that the route path length of the route path corresponding to the current function "a / b / m / n / x" is 5, and registers it as an initial value in the column of the route path length of the current function in the route related information 171 in Fig. 3.

[0054] 3, the matching processing unit 112 determines the route path length for each function and registers it in the route path length of the route related information 171. Here, the function registered later in the order of registration in the route list is called the later function, and the function registered earlier is called the earlier route path.

[0055] When a function name without a dash is registered as the function immediately before the specific function, the function immediately before the specific function is a function that is registered by being called. Therefore, the matching processing unit 112 subtracts 1 from the route path length of the specific function to obtain the route path length of the immediately previous function. For example, the route path length of the current function in which x is registered as the function name in the route list of FIG. 3 is 5, and n without a dash is registered as the function name of the immediately previous function, so the matching processing unit 112 calculates the route path length of this function as 5-1=4.

[0056] Also, when a function name with a dash added is registered as the function immediately before a specific function, the function immediately before the specific route path is a function registered by returning to the function that called it (more precisely, it is registered immediately before returning). Therefore, the matching processing unit 12 adds 1 to the route path length of the specific function to obtain the route path length of the immediately previous function. For example, the route path length of the function with m registered as the function name in the third column from the right on the paper is 3, and the function with "l'" with a dash added as the function name in the fourth column from the right immediately before that is registered. Therefore, the matching processing unit 12 calculates the route path length of the function with "l'" registered as the function name as 3+1=4.

[0057] Furthermore, for the function for which the route path length has been calculated (for example, a function in the "route list" in FIG. 3), the matching processing unit 12 calculates and registers the parent function stack of the function from the parent function stack of the subsequent function. If the function for which the route path length has been calculated is a function that has been registered by being called, the matching processing unit 12 registers the parent function stack of the subsequent function excluding the top function as the parent function stack. Here, the top of the parent function stack refers to the upper side of the parent function stack in FIG. 3 as viewed from the paper surface.

[0058] In addition, if the function that calculated the route path length is a function that was registered when returning to the calling function, the matching processing unit 12 registers the function name of the function that calculated the route path length, excluding the dashes, at the top of the parent function stack of the next function as the parent function stack.

[0059] At this time, when the function that has found the route path length is a function without a dash that has been registered by being called, the matching processing unit 112 finds the current route path by concatenating the functions in the parent function stack from the bottom to the top in the order of the function that has found the route path length. In the case of function 172 in the 13th column from the right in Fig. 3, the parent function stack is [top] [d, c] [bottom], and the function that has found the route path length is e, so the matching processing unit 112 can find / c / d / e as " / c / d" + "e". The matching processing unit 112 registers this route path as the current route path.

[0060] Furthermore, if the function for which the route path length is found is a function registered at the timing of returning to the caller function, the matching processing unit 112 finds a route path by adding a dash to the top function name of the parent function stack and linking the functions from the bottom of the stack to the top. For example, in the case of the fifth column from the right in FIG. 3, the parent function stack is [top][e, l][bottom], so the matching processing unit 112 finds a route path by adding a dash to the top e and linking them in reverse to find / l / e'. This route path indicates the call path when e is called from function l and then returns from e to l, and the matching processing unit 112 registers this route path as the current route path.

[0061] The matching processing unit 12 performs the above-mentioned calculation of the route path length and the information registration process of the parent function stack and the current route path in the route related information 151, from the back to the front of the order of registration according to the route list. Then, when the route path length reaches the range of the scope, the matching processing unit 12 ends the information registration process in the route related information 151. Next, the matching processing unit 12 judges whether or not the current route path of the registered route related information 151 matches the checkpoint function. The matching processing unit 12 performs the judgment process of whether or not the current route path of the route related information 151 matches the checkpoint function, from the back to the front of the route list. In other words, the matching processing unit 12 performs the judgment process of whether or not the current route path of the route related information 151 matches the checkpoint function for each column of the route related information 171 in FIG. 3. The location of the comparison between the current route path and the checkpoint function can be either the location of a function without a dash or the location of a function with a dash in the route list in Figure 3, as long as it is consistent.

[0062] In the above description, in order to make the outline of the process easier to understand, the matching processing unit 12 has been described as a two-pass process in which the matching processing with the checkpoint function list is performed after performing the information registration processing in the route related information 151, but the registration processing and the matching processing may be performed simultaneously in one-pass processing. In other words, the matching processing unit 12 may obtain the route path length, parent function stack, and current route path information for each column from back to front in the route list of Fig. 3 within the scope range (the range in which the route path length is not less than the scope path length), and make a judgment by comparing the current route path with a checkpoint function, which will be described later.

[0063] Here, with regard to the process of registering information into the route-related information 151, it is not necessary to store all the values ​​of the information on the "route path length" and "parent function stack" for each item in the route list. The matching processing unit 12 only needs to retain the "route path length" and "parent function stack" used in the processing when performing one stage of processing from back to front.

[0064] The checkpoint function match determination here also takes into account the order in which the checkpoint functions are called. For this reason, when scanning the route list from back to front as described above, a match is determined using the checkpoint function list R, in which the checkpoint functions are registered in the order in which they are called, in reverse order. For example, if the checkpoint function list is [a / b / c / d / e,a / b / l / e], then [a / b / l / e,a / b / c / d / e] is the checkpoint function list R used to determine a match. Note that the current route path to be compared is information excluding the scope path, so in reality the checkpoint function list R is " / l / e, / c / d / e".

[0065] Then, the matching processing unit 12 judges whether or not the function matches the element function of the checkpoint function list R, taking into consideration the order. When the comparison location of the current route path and the checkpoint function is the location of the function without a dash in the route list of FIG. 3, the matching processing unit 12 judges that there is a match when the checkpoint functions match in order, that is, the functions 173 and 172 in FIG. 3, that is, the functions 103 and 102 in FIG. 5. When the comparison location of the current route path and the checkpoint function is the location of the function with a dash in the route list of FIG. 3, the comparison is performed using the lowest function name of each function in the checkpoint function list R with a dash added. In the case of the above example, the checkpoint function list R is " / l / e', / c / d / e'". The comparison location may be selected by setting the setting information 152, or may be selected by hard coding. In general, route lists cannot be prepared infinitely, and in terms of performance, it is advantageous to match using the dashed function of the route list in Figure 3, which allows for faster matching.

[0066] If there is a checkpoint function for which no matching function exists, the matching processing unit 112 determines that the timing does not match the timing for collecting investigation information, and ends the matching processing. On the other hand, if there is a function that matches all checkpoint functions, the matching processing unit 112 determines that the timing for collecting investigation material does match. Then, the matching processing unit 112 instructs the investigation material collection unit 113 to execute the investigation material collection processing.

[0067] The investigation information collection unit 113 receives an instruction to execute an investigation information collection process from the matching processing unit 112. Then, the investigation information collection unit 113 collects information at that time according to the setting information 152. In the operation environment computer 1, first, a memory map is collected. At this time, the investigation information collection unit 113 stores information on the heap area in the memory map.

[0068] Furthermore, the investigation data collection unit 113 executes a simple dump collection process that includes collection of a dump of each memory segment, as well as collection of register information and a call stack.

[0069] In this way, the investigation information collection unit 113 does not collect investigation materials on a program variable basis, but collects investigation materials on a memory segment basis managed by a process. This allows the investigation information collection unit 113 to collect program variables that are not specified in advance, and also reduces the amount of information collected. Below, the dump of each memory segment is called a "segment file."

[0070] Thereafter, the investigation material collection unit 113 outputs the investigation material collected in the simple dump collection process. Here, in Fig. 1, in order to make the flow of the investigation material easier to understand, the investigation material collection unit 113 is illustrated as directly outputting the investigation material to the analysis environment computer 2. However, in reality, the investigation material held by the investigation material collection unit 113 may be acquired by an administrator of the operation environment computer 1 and transmitted to a support department, and the person in charge of the support department may input the received investigation material to the analysis environment computer 2, thereby transferring the investigation material.

[0071] As described above, when investigation data collection is executed, it is performed using either the predetermined entry built-in function or the exit built-in function. However, in terms of collecting data immediately after a problem occurs, using the exit built-in function to collect data is advantageous from the standpoint of reproducibility, since values ​​are set in the local variables of that function.

[0072] Next, the analysis environment computer 2 will be described with reference to Fig. 2. As shown in Fig. 2, the analysis environment computer 2 has a program processing unit 21, a context-dependent operation unit 22, a research material storage unit 23, a conversion processing unit 24, and an analysis unit 25. The analysis environment computer 2 also holds the program 100 used in the operational environment computer 1 with the entry built-in functions and exit built-in functions already built in.

[0073] The investigation material storage unit 23 collects investigation materials collected by the operation environment computer 1 and stores them as operation environment investigation materials 230.

[0074] The program processing unit 21 executes the program 100 using the same modules used when the program 100 was executed on the operational environment computer 1, and reproduces the state when the program 100 was executed on the operational environment computer 1. For this purpose, the program 100 is executed on the analysis environment computer 2 using the same modules used when the program 100 was executed on the operational environment computer 1 to collect a process dump, then the collected process dump is read on the debugger, and the information (contents of segment files and registers) collected on the operational environment computer 1, whose contents have been appropriately converted, is overwritten in the corresponding location. This makes it possible to refer to the segment data collected on the operational environment computer 1 as variables on the analysis environment computer 2. Note that the timing of collecting the process dump may be anywhere, since it is replaced with the information collected on the operational environment computer 1 later, as described above. However, the Heap segment size is ensured to be equal to or larger than the Heap size of the map memory of the operational environment computer 1. In order to perform this series of processing, the program processing unit 21 performs the processing as follows.

[0075] The program processing unit 21 modifies the setting file 153 of the operational environment computer 1 for the analysis environment computer 2. Specifically, it adds a heap expansion setting for expanding the memory map of the operational environment computer 1 to a size equal to or larger than the heap size, changes the contents to be performed when matching conditions such as the target path are met from simple dump and memory map collection to heap expansion, external process dump, and memory map collection, and changes the target path set in the operational environment computer 1 to a value that is also passed through in normal processing. For example, if the path of the target function in the operational environment is "a / b / m / n / x", and x is an error route and its parent n is a normal route, it modifies the path by truncating it to "a / b / m / n".

[0076] After changing the settings, the program processing unit 21 executes the program 100. When the program 100 is executed, the program processing unit 21 executes both initialization processes, ie, the original initialization process of the program 100 and initialization process for collecting investigation materials.

[0077] When the program processing unit 21 executes the program 100 after the initialization process, each function in the program 100 is called. When a call is made from each function, an entry built-in function is called, as in the case of the operational environment computer 1. When returning from the called function to the calling function, an exit built-in function is called, as in the case of the operational environment computer 1. Then, the called entry built-in function and exit built-in function execute the processing of the context-dependent operation unit 22.

[0078] Here, the context-dependent operation unit 22 has the same functions as the setting file reading unit 111, the matching processing unit 112, the investigation data collection unit 113, and the route information acquisition unit 114 of the operational environment computer 1, but is omitted in FIG. 2 except for the investigation data collection unit 220. Also, the analysis environment computer 2 has the same functions as the data storage unit 15 of the operational environment computer 1, but is omitted in FIG. 2. Also, in the context-dependent operation unit 22, the processing performed by the setting file reading unit 111 and the route information acquisition unit 114 of the operational environment computer 1 is performed by an entrance built-in function and an exit built-in function, and the processing performed by the matching processing unit 112 and the investigation data collection unit 113 is performed by either an entrance built-in function or an exit built-in function, which is the same as in the case of the operational environment computer 1. Also, in the analysis environment computer 2, processing similar to the processing performed by the setting file reading unit 111, the matching processing unit 112, and the route information acquisition unit 114 of the operational environment computer 1 is performed.

[0079] As described above, the processing in the context-dependent operation unit 22 similar to that of the matching processing unit 112 and the processing by the investigation data collection unit 220 are called on the side specified in the setting information 152 (either the side of the entry built-in function or the exit built-in function) and the next processing is carried out. If it differs from the specification of the setting information 152, the processing of the context-dependent operation unit 22 is terminated.

[0080] When the matching processing unit 112 of the context-dependent operation unit 22 detects a match with the timing for collecting investigation information, it calls the investigation information collection unit 220 of the context-dependent operation unit 22. The process executed by the investigation information collection unit 220 in the context-dependent operation unit 22 is different from the process executed by the investigation information collection unit 113 of the operational environment computer 1 (to be precise, the function that is called is different).

[0081] Specifically, the operational environment computer 1 collected relevant information at the time of dump (memory map, register information, call stack, route list information (optional) in FIG. 3) and a simple dump (a segment dump of the type specified in the setting information 152), whereas the analysis environment computer 2, after expanding the heap area, collects relevant information at the time of dump (memory map, register information (optional), call stack (optional), route list information (optional) in FIG. 3) and a detailed dump (a process dump by an external dump using an external tool) as investigation materials. Note that for materials with (optional) written after the name of the material, whether or not they are collected is determined according to the setting information 152. Also, as in the case of the operational environment computer 1, the number of times materials are collected when the timing for collecting investigation materials matches is the number of times specified in the setting information 152 (usually once).

[0082] Thereafter, the investigation information collection unit 220 outputs the memory map to the conversion processing unit 24. In addition, the investigation information collection unit 220 outputs the process dump to the analysis unit 25. Furthermore, the investigation information collection unit 220 may output a segment file and route-related information in the analysis environment computer 2 to the analysis unit 25.

[0083] The conversion processing unit 24 receives an input of the memory map from the investigation material collection unit 220 of the context-dependent operation unit 22. The conversion processing unit 24 may also acquire a segment file in the analysis environment computer 2 from the investigation material collection unit 220 of the context-dependent operation unit 22.

[0084] Next, the conversion processing unit 24 acquires the segment files, memory map, and register information of the operational environment computer 1 from the operational environment research material 230. Then, the conversion processing unit 24 compares the memory map in the operational environment computer 1 with the memory map in the analysis environment computer 2 to create a correspondence table of the memory maps, and further rewrites the contents of the segment files of the operational environment computer 1 to match those of the analysis environment computer 2 using the register information.

[0085] 6 is a diagram showing an example of a correspondence table of memory maps. For example, a case will be described in which the conversion processing unit 24 acquires the addresses of the operational environment and the analysis environment shown in the correspondence table 201 of FIG. 6 for the stack segment and the text segment from the memory maps of the operational environment computer 1 and the analysis environment computer 2.

[0086] In this case, the conversion processing unit 24 subtracts the address of the operational environment from the address of the analysis environment computer 2 in the stack segment to obtain a difference of 0x02000. Then, the conversion processing unit 24 adds the difference of 0x02000 to data having a value corresponding to the address range of the stack segment in the operational environment computer 1, 0x12000 to 0x12fff, in all segment memory dumps collected by the operational environment computer 1, to convert the data into an address of the analysis environment computer 2. That is, for the stack segment, if the address in the operational environment computer 1 is X and the address of the analysis environment computer 2 is Y, the conversion processing unit 24 converts the data storing the address of the operational environment computer 1 into the address of the analysis environment computer 2 by the formula Y=x+Δ(0x02000).

[0087] In this case, the conversion processing unit 24 subtracts the address of the operational environment computer 1 from the address of the analysis environment computer 2 in the text segment to obtain a difference of 0x20000. Then, the conversion processing unit 24 adds the difference of 0x20000 to data having a value corresponding to the address range of the text segment in the operational environment computer 1, 0x04400 to 0x0ffff, in all segment memory dumps collected in the operational environment computer 1, to convert the data into an address of the analysis environment computer 2. That is, for the text segment as well, if the address in the operational environment computer 1 is X and the address of the analysis environment computer 2 is Y, the conversion processing unit 24 converts the data storing the address of the operational environment computer 1 into the address of the analysis environment computer 2 by the formula Y=x+Δ(0x20000).

[0088] For stack segments, addresses before the stack pointer do not need to be used for computer operation analysis. Therefore, the conversion processing unit 24 may obtain the stack pointer address from the register file and convert only data at addresses after the stack pointer.

[0089] Similarly to the segment files, the conversion processing unit 24 also creates a converted register information file of the operational environment computer 1 to match the analysis environment computer 2. Specifically, the conversion processing unit 24 converts the value of the program counter using a conversion formula similar to that of the text segment, and also converts the stack pointer and the frame pointer using a conversion formula similar to that of the stack segment, to create a converted register file.

[0090] Fig. 7 is a diagram showing an example of the result of converting the contents of the stack segment of the operational environment computer to match the analysis environment computer. An address group 211 in Fig. 7 indicates the addresses of the stack segment in the operational environment computer 1, and an address group 212 indicates the addresses of the stack segment in the analysis environment computer 2. For example, if the data stored in the segment file is a value within the range of the text segment, the conversion processing unit 24 converts the data value using the conversion formula Y=x+Δ(0x20000) for the text segment, and if the value is a value within the range of the stack segment, the conversion processing unit 24 converts the data value using the conversion formula Y=x+Δ(0x02000) for the stack segment, rewrites it into data that matches the analysis environment computer 2, and generates a converted segment file.

[0091] Thereafter, the conversion processing unit 24 outputs the memory map correspondence table, the converted segment file, and the converted register file to the analysis unit 25. The conversion processing unit 24 may also output the memory map of the analysis environment computer 2 to the analysis unit 25.

[0092] The analysis unit 25 receives a process dump input from the investigation data collection unit 220 of the context-dependent operation unit 22. The analysis unit 25 also receives a memory map correspondence table, a converted segment file, and a converted register file from the conversion processing unit 24.

[0093] Then, the analysis unit 25 reads the process dump collected by the investigation data collection unit 220 into the debugger, and also reads the converted segment file generated by the conversion processing unit 24 into the memory space of the process running in the debugger according to the correspondence table of the map files of the operational environment computer 1 and the analysis environment computer 2. Next, the analysis unit 25 reads the values ​​of the program counter, stack pointer, and frame pointer from the converted register file, and sets the values ​​in each register. This results in a process image that has the same target function as the operational environment computer 1 and an equivalent memory space. In this way, the analysis unit 25 makes it possible to refer to the segment information collected in the operational environment computer 1 as a variable through the process image.

[0094] After that, through the process image, an operational analysis of the operational environment is performed by referring to various variables on the operational environment computer 1. The support department can use the results of the operational analysis performed by the analysis unit 25 to investigate the cause of an event that has occurred on the operational environment computer 1.

[0095] 8 is a diagram showing an outline of the operation of the analysis environment computer 2. Here, the overall operation of the analysis environment computer 2 will be summarized again with reference to FIG.

[0096] The analysis environment computer 2 acquires the operational environment investigation material 230 including the segment file, memory map, register information, and call stack at the time of investigation material collection from the operational environment computer 1 (step S1).

[0097] After changing the settings of the setting file 153, the analysis environment computer 2 executes the program 100 and acquires the analysis environment research material 231 (step S2).

[0098] Next, the analysis environment computer 2 uses the operational environment research materials 230 and the analysis environment research materials 231 to perform a conversion process to convert the segment file of the operational environment computer 1 into a segment file adapted to the analysis environment computer 2, and a conversion process to convert the register information file of the operational environment computer 1 into a register file adapted to the analysis environment computer 2 (step S3).

[0099] Then, the analysis environment computer 2 uses a debugger to generate a process image equivalent to the process that was running on the operational environment computer 1, based on the process dump of the analysis environment investigation material 231 and the converted segment file included in the converted investigation material 232. After that, the analysis environment computer 2 executes debugging using the generated process image (step S4).

[0100] 9 is a flowchart of the program execution process by the operational environment computer 1. Next, the overall flow of the program execution process by the operational environment computer 1 will be described with reference to FIG.

[0101] The program processing unit 11 executes both initialization processes, ie, initialization process for the original program 100 and initialization process for collecting investigation materials (step S101).

[0102] Next, the program processing unit 11 executes the part of the program 100 after the initialization (step S102).

[0103] After that, when the execution of the program 100 is completed, the program processing unit 11 executes a termination process (step S103).

[0104] Fig. 10 is a flowchart of the investigation material collection process when investigation material is collected by the entry built-in function in the operating environment computer. When a function is called during execution of the program 100 in the process of step S102 in Fig. 9 and the entry built-in function is executed, the processes shown in the flows in Fig. 10 are executed. Next, the flow of the investigation material collection process when the entry built-in function is called in the operating environment computer 1 will be described with reference to Fig. 10.

[0105] The program processing unit 11 makes a function call when executing the program 100. When the function call is made, the entry built-in function is executed, and the following processing is performed in the processing of the context-dependent operation unit 110 implemented therein.

[0106] The context-dependent operation unit 110 checks the flag for reloading the setting file and determines whether or not to reload the setting file 153 (step S111). If the setting file 153 is not to be reloaded (step S111: No), the context-dependent operation unit 110 proceeds to step S113.

[0107] On the other hand, if the setting file 153 is to be reread (step S111: Yes), the setting file reading unit 111 of the context-dependent operation unit 110 reads the contents of the setting file 153 and updates the setting information 152 in the data storage unit 15 (step S112).

[0108] After that, context-dependent operation unit 110 registers the parent function of the entry built-in function in the path list of path related information 151 (step S113).

[0109] Next, the context-dependent operation unit 110 checks the item "matching implementation location of investigation material collection" in the setting information 152, and judges whether the matching implementation location of investigation material collection is set on the entry side of the function (step S114). If the matching implementation location of investigation material collection is not set on the entry side of the function (step S114: No), the context-dependent operation unit 110 ends the investigation material collection process.

[0110] On the other hand, if the matching implementation location for the investigation material collection is set on the entry side of the function (step S114: Yes), the context-dependent operation unit 110 judges whether the parent function is the target function (step S115). If the parent function is not the target function (step S115: No), the context-dependent operation unit 110 ends the investigation material collection process.

[0111] On the other hand, if the parent function is the target function (step S115: Yes), the context-dependent operation unit 110 instructs the matching processing unit 112 to execute a matching process. The matching processing unit 112 receives the instruction from the context-dependent operation unit 110 and executes the matching process (step S116).

[0112] Then, the matching processing unit 112 judges whether or not the investigation material collection timing is matched based on the result of the matching processing (step S117). If the investigation material collection timing is not matched (step S117: No), the matching processing unit 112 ends the investigation material collection processing.

[0113] On the other hand, if the timing for collecting investigation materials matches (step S117: Yes), the matching processing unit 112 instructs the investigation materials collection unit 113 to collect investigation materials. Upon receiving the instruction from the matching processing unit 112, the investigation materials collection unit 113 executes a dump time supplemental information acquisition process (step S118). As a result, the investigation materials collection unit 113 acquires a memory map, register information, a call stack, and the like.

[0114] Next, the investigation data collection unit 113 executes a simplified dump process for collecting memory dumps of segments that match the item "collected segment type" of the setting information 152 as segment files (step S119).

[0115] When the investigation data collection process is completed, the process returns to the original route continuing from the function call of the original program 100 and continues.

[0116] Fig. 11 is a flowchart of the investigation material collection process when investigation material is collected by the exit built-in function in the operating environment computer. When the exit built-in function is executed immediately before returning from the current function to the caller function during execution of the program 100 in the process of step S102 in Fig. 9, the processes shown in the respective flows in Fig. 11 are executed. Next, the flow of the investigation material collection process when the exit built-in function is called in the operating environment computer 1 will be described with reference to Fig. 11.

[0117] Return from the current function to the calling function is performed by the program processing unit 11. When return to the calling function is performed, the exit built-in function is executed, and the following processing is performed by the processing of the context-dependent operation unit 110 implemented in the built-in function.

[0118] The context-dependent operation unit 110 checks the flag for reloading the setting file and determines whether or not to reload the setting file 153 (step S121). If the setting file 153 is not to be reloaded (step S121: No), the context-dependent operation unit 110 proceeds to step S123.

[0119] On the other hand, if the setting file 153 is to be reread (step S121: Yes), the setting file reading section 111 of the context-dependent operation section 110 reads the contents of the setting file and updates the setting information 152 in the data storage section 15 (step S122).

[0120] After that, context-dependent operation unit 110 registers the parent function of the exit built-in function in the path list of path-related information 151 (step S123).

[0121] Next, the context-dependent operation unit 110 checks the item "matching implementation location for investigation material collection" in the setting information 152, and determines whether the matching implementation location for investigation material collection is set on the exit side (step S124). If the matching implementation location for investigation material collection is not set on the exit side (step S124: No), the context-dependent operation unit 110 ends the investigation material collection process.

[0122] On the other hand, if the matching implementation location for the investigation material collection is set to the exit side of the function (step S124: Yes), the context-dependent operation unit 110 judges whether the parent function is the target function (step S125). If the parent function is not the target function (step S125: No), the context-dependent operation unit 110 ends the investigation material collection process.

[0123] On the other hand, if the parent function is the target function (step S125: Yes), the context-dependent operation unit 110 instructs the matching processing unit 112 to execute a matching process. The matching processing unit 112 receives the instruction from the context-dependent operation unit 110 and executes the matching process (step S126).

[0124] Then, the matching processing unit 112 determines whether or not the investigation material collection timing is matched based on the result of the matching processing (step S127). If the investigation material collection timing is not matched (step S127: No), the matching processing unit 112 ends the investigation material collection processing.

[0125] On the other hand, if the timing for collecting investigation materials matches (step S127: Yes), the matching processing unit 112 instructs the investigation materials collection unit 113 to collect investigation materials. Upon receiving the instruction from the matching processing unit 112, the investigation materials collection unit 113 executes a dump time supplemental information acquisition process (step S128). As a result, the investigation materials collection unit 113 acquires a memory map, register information, a call stack, and the like.

[0126] Next, the investigation data collection unit 113 executes a simplified dump process for collecting memory dumps of segments that match the item "collected segment type" of the setting information 152 as segment files (step S129).

[0127] When the investigation material collection process is completed, the process returns to the calling function in the original program 100, and the original route process, which starts from the return to the parent function, is continued.

[0128] 12 is a flowchart of the program execution process by the analysis environment computer 2. Next, the overall flow of the program execution process by the analysis environment computer 2 will be described with reference to FIG.

[0129] The program processing unit 21 rewrites the setting items of the setting file 153 (step S201). For example, the program performs a heap expansion setting for expanding the heap to a size equal to or larger than the heap size of the memory map of the operating environment computer 1, a setting for setting the contents to be executed when the data collection conditions are matched to heap expansion, external process dump, and memory map collection, and a setting for shortening the depth of the target path to ensure a match.

[0130] Next, the program processing unit 21 executes both initialization processes of the original program 100 and initialization process for collecting investigation materials (step S202).

[0131] Next, the program processing unit 21 executes the part of the program 100 after the initialization (step S203).

[0132] After that, when the execution of the program 100 is completed, the program processing unit 21 executes a termination process (step S204).

[0133] Fig. 13 is a flow chart of the investigation material collection process when investigation material is collected by the entry built-in function in the analysis environment computer. When the function is called during execution of the program 100 in the process of step S203 in Fig. 12 and the entry built-in function is executed, the processes shown in the respective flows in Fig. 13 are executed. Next, the flow of the investigation material collection process when the entry built-in function is called in the analysis environment computer 2 will be described with reference to Fig. 13.

[0134] The program processing unit 21 makes a function call when executing the program 100. When a function call is made, an entry built-in function is called, and the following process is performed in the process of the context-dependent operation unit 22.

[0135] Context-dependent operation unit 22 registers the parent function of the entry built-in function in the path list of path related information 151 (step S211).

[0136] Next, the context-dependent operation unit 22 checks the item "matching implementation location for investigation material collection" in the setting information 152, and determines whether or not the matching implementation location for investigation material collection is set on the entrance side (step S212). If the matching implementation location for investigation material collection is not set on the entrance side (step S212: No), the context-dependent operation unit 22 ends the investigation material collection process.

[0137] On the other hand, if the matching implementation location for the investigation material collection is set on the entrance side (step S212: Yes), the context-dependent operation unit 22 judges whether the parent function is the target function (step S213). If the parent function is not the target function (step S213: No), the context-dependent operation unit 22 ends the investigation material collection process.

[0138] On the other hand, if the parent function is the target function (step S213: Yes), context-dependent operation unit 22 executes a matching process (step S214).

[0139] Then, the context-dependent operation unit 22 determines whether or not the timing for collecting investigation materials is matched based on the result of the matching process (step S215). If the timing for collecting investigation materials is not matched (step S215: No), the context-dependent operation unit 22 ends the investigation materials collection process.

[0140] On the other hand, if it matches the investigation material collection timing (step S215: Yes), the context-dependent operation unit 22 judges whether or not to expand the heap area based on the item "heap expansion setting" in the setting information 152 (step S216). If the heap area is not to be expanded (step S216: No), the context-dependent operation unit 22 proceeds to step S218.

[0141] On the other hand, if the heap area is to be expanded (step S216: Yes), the context-dependent operation unit 22 expands the heap area (step S217).

[0142] After that, context-dependent operation section 22 executes a dump-time supplemental information collection process (step S218).

[0143] Next, the context-dependent operation unit 22 instructs the investigation material collection unit 220 to collect investigation material. Upon receiving the instruction from the context-dependent operation unit 22, the investigation material collection unit 220 executes a detailed dump collection process (step S219). As a result, the investigation material collection unit 220 collects the process dump collected by the external tool.

[0144] When the investigation data collection process is completed, the process returns to the original route continuing from the function call of the original program 100 and continues.

[0145] Fig. 14 is a flow chart of the investigation material collection process when the investigation material is collected by the exit built-in function in the analysis environment computer. When the exit built-in function is executed immediately before returning from the current function to the caller function during execution of the program 100 in the process of step S203 in Fig. 12, the processes shown in the respective flows in Fig. 14 are executed. Next, the flow of the investigation material collection process when the exit built-in function is called in the analysis environment computer 2 will be described with reference to Fig. 14.

[0146] The program processing unit 21 returns from the current function to the caller function during execution of the program 100. The exit built-in function is executed immediately before returning to the caller function. Then, the following processing is performed by the context-dependent operation unit 22 in the exit built-in function.

[0147] Context-dependent operation unit 22 registers the parent function of the exit built-in function in the route list of route related information 151 (step S221).

[0148] Next, the context-dependent operation unit 22 checks the item "matching implementation location for investigation material collection" in the setting information 152, and determines whether or not the matching implementation location for investigation material collection is set on the exit side (step S222). If the matching implementation location for investigation material collection is not set on the exit side (step S222: No), the context-dependent operation unit 22 ends the investigation material collection process.

[0149] On the other hand, if the matching implementation location for the investigation material collection is set to the exit side (step S222: Yes), the context-dependent operation unit 22 determines whether the parent function is the target function (step S223). If the parent function is not the target function (step S223: No), the context-dependent operation unit 22 ends the investigation material collection process.

[0150] On the other hand, if the parent function is the target function (step S223: Yes), context-dependent operation unit 22 executes a matching process (step S224).

[0151] Then, the context-dependent operation unit 22 determines whether or not the timing for collecting investigation materials is matched based on the result of the matching process (step S225). If the timing for collecting investigation materials is not matched (step S225: No), the context-dependent operation unit 22 ends the investigation materials collection process.

[0152] On the other hand, if it matches the investigation material collection timing (step S225: Yes), the context-dependent operation unit 22 judges whether or not to expand the heap area based on the item "heap expansion setting" in the setting information 152 (step S226). If the heap area is not to be expanded (step S226: No), the context-dependent operation unit 22 proceeds to step S228.

[0153] On the other hand, if the heap area is to be expanded (step S226: Yes), the context-dependent operation unit 22 expands the heap area (step S227).

[0154] After that, context-dependent operation section 22 executes a dump-time supplemental information collection process (step S228).

[0155] Next, the context-dependent operation unit 22 instructs the investigation material collection unit 220 to collect investigation material. Upon receiving the instruction from the context-dependent operation unit 22, the investigation material collection unit 220 executes a detailed dump collection process (step S229). As a result, the investigation material collection unit 220 collects the process dump collected by the external tool.

[0156] When the investigation material collection process is completed, the process returns to the calling function in the original program 100, and the original route process, which starts from the return to the parent function, is continued.

[0157] 15 is a flow chart of the analysis process by the analytical environment computer 2. Next, the flow of the analysis process by the analytical environment computer 2 will be described with reference to FIG.

[0158] The conversion processing unit 24 receives an input of the memory map from the investigation material collection unit 220 of the context-dependent operation unit 22. Next, the conversion processing unit 24 acquires the segment file, memory map, and register information of the operational environment computer 1 from the operational environment investigation material 230. Then, the conversion processing unit 24 compares the memory map in the operational environment computer 1 with the memory map in the analysis environment computer 2, and further uses the register information to convert the contents of the segment file and the register information file in the operational environment computer 1 to match those in the analysis environment computer 2 (step S301).

[0159] The analysis unit 25 receives a process dump from the investigation data collection unit 220 of the context-dependent operation unit 22. The analysis unit 25 also receives from the conversion processing unit 24 the converted segment file, the converted register file, and the correspondence table of the map file between the operational environment computer 1 and the analysis environment computer 2 used during conversion by the conversion processing unit 24. Next, the analysis unit 25 reads the process dump acquired using the debugger. Next, the analysis unit 25 loads the converted segment file into the memory of the process read by the debugger. Here, the load destination address is the segment address of the analysis environment computer 2 that is paired with the one collected in the operational environment computer 1, and is stored in the correspondence table of the map file. Next, the analysis unit 25 reads the values ​​of the program counter, stack pointer, and frame pointer from the converted register file, and sets the values ​​in each register. This enables the analysis unit 25 to create a process image that is processing the same target function as the operational environment computer 1 and has the same size memory space, and the segment information collected in the operational environment computer 1 can be referenced as a variable. Thereafter, the analysis unit 25 uses the generated process image to execute an analysis process of the event that has occurred in the operational environment computer 1 (step S302).

[0160] (Hardware configuration) Fig. 16 is a hardware configuration diagram of a computer. Next, an example of a hardware configuration for realizing each function of the operational environment computer 1 and the analysis environment computer 2 will be described with reference to Fig. 16. Both the operational environment computer 1 and the analysis environment computer 2 can be realized by, for example, a computer 90 shown in Fig. 16.

[0161] 16, a computer 90 includes, for example, a CPU (Central Processing Unit) 91, a memory 92, a hard disk 93, and a network interface 94. The CPU 91 is connected to the memory 92, the hard disk 93, and the network interface 94 via a bus.

[0162] The network interface 94 is an interface for communication between the computer 90 and an external device. The network interface 94 relays communication between the operation environment computer 1 and the analysis environment computer 2, for example.

[0163] The hard disk 93 is an auxiliary storage device. In the case of the operational environment computer 1, the hard disk 93 realizes the data storage unit 15 illustrated in FIG. 1. The hard disk 93 may also store the materials collected by the investigation material collection unit 113 and the program 100. The hard disk 93 also stores a program for realizing the functions of the program processing unit 11 and the context-dependent operation unit 110 illustrated in FIG. 1. In the case of the analysis environment computer 2, the hard disk 93 realizes the function of the investigation material storage unit 23 illustrated in FIG. 2. The hard disk 93 may also store the program 100. The hard disk 93 also stores a program for realizing the functions of the program processing unit 21, the context-dependent operation unit 22, the conversion processing unit 24, and the analysis unit 25 illustrated in FIG. 2.

[0164] The memory 92 is a main storage device, and may be, for example, a dynamic random access memory (DRAM).

[0165] The CPU 91 reads out various programs from the hard disk 93, expands them into the memory 92, and executes them. As a result, in the case of the operational environment computer 1, the CPU 91 realizes the functions of the program processing unit 11 and the context-dependent operation unit 110 illustrated in Fig. 1. Also, in the case of the analysis environment computer 2, the CPU 91 realizes the functions of the program processing unit 21, the context-dependent operation unit 22, the conversion processing unit 24, and the analysis unit 25 illustrated in Fig. 2.

[0166] As described above, the operational environment computer executes a program incorporating an entry intrinsic function and an exit intrinsic function. The operational environment computer then calls the entry intrinsic function and the exit intrinsic function at the timing of function invocation and return to register the parent function. The operational environment computer also executes a context-dependent operation unit from the entry intrinsic function or the exit intrinsic function, and performs matching with the target function and the checkpoint function list with either the entry intrinsic function or the exit intrinsic function according to the contents of the configuration information. If there is a match, the simplified dump collection process is executed. Next, in the analysis environment computer 2 that has constructed an environment similar to that of the operational environment computer, the configuration file of the operational environment computer is changed to that of the analysis environment computer, a program similar to that of the operational environment computer is processed, and a process dump with a heap area equal to or larger than that of the operational environment is collected. Next, the memory maps of the operational environment computer and the analysis environment computer are compared, and the segment file and register information file collected by the operational environment computer are converted to match those of the analysis environment computer. Next, the process dump collected using a debugger is read, the contents of the converted segment file are loaded into the memory space of that process, and the contents of the registers are changed according to the converted register information to create a process that has variable information of the operational environment computer and can reference it as a variable, and analysis processing is performed using these.

[0167] This makes it possible to collect the materials necessary for an investigation while keeping operational burdens down, reducing the impact on business and operational burdens during trouble occurrences, and therefore improving the reliability of the system. [Explanation of symbols]

[0168] 1 Production Computer 2. Analysis environment computer 11 Program Processing Section 15 Data storage section 16 Input section 21 Program Processing Section 22 Context-sensitive operation part 23 Research Materials Storage Section 24 Conversion Processing Section 25 Analysis Department 100 Programs 110 Context-sensitive operation part 111 Configuration file reader 112 Matching processing unit 113 Research and Data Collection Department 114 Route information acquisition unit 151 Route-related information 152 Setting information 153 Configuration File 220 Research and Data Collection Department 230 Operational Environment Survey Materials

Claims

1. Execute a specified program, a first determination as to whether or not a predetermined condition for data collection is met based on a first route list that represents a call path of a predetermined function called in the predetermined program and one or more other functions called before the predetermined function is called in an order of calling; If the predetermined conditions are met, the first investigation data is collected. An information processing program for causing a first computer to execute a process.

2. Executing the predetermined program, a second determination as to whether or not the predetermined condition for data collection is met based on a second route list that represents a call path of the predetermined function called in the predetermined program and one or more other functions called before the predetermined function is called in an order of calling; If the predetermined condition is met, a second investigation material including more detailed information than the first investigation material is collected; Analyzing the behavior of the predetermined program at the time of execution based on the first investigation material and the second investigation material.

2. The information processing program according to claim 1, further comprising: a second computer for executing the processing.

3. the first computer further executes a process of incorporating, into each function included in the predetermined program, an entry built-in function that registers the predetermined function in the first route list in the order of calling when the predetermined function is called, and an exit built-in function that adds a code indicating a return to the predetermined function when the predetermined function returns to a function that has called the predetermined function, and registers the specified function in the first route list in the order of calling; The first determination process includes a process of acquiring the first route list in which the predetermined function and the other function are registered by the entrance built-in function and the exit built-in function by executing the predetermined program.

2. The information processing program according to claim 1,

4. The process of collecting the first investigation data includes collecting a dump of each memory segment, a first memory map, and a call stack in the first computer at the time of collection, The process of collecting the second investigation data includes collecting a process dump and a second memory map that include more detailed information than the dump for each memory segment in the second computer at the time of collection, The second computer further executes a process of converting the dump of each memory segment based on the first memory map and the second memory map to suit an environment of the second computer; The analysis process includes a process of performing the analysis based on the converted dump of each memory segment and the process dump.

3. The information processing program according to claim 2,

5. The computer Execute a specified program, a first determination as to whether or not a predetermined condition for data collection is met based on a first route list that represents a call path of a predetermined function called in the predetermined program and one or more other functions called before the predetermined function is called in an order of calling; If the predetermined conditions are met, the first investigation data is collected.

2. An information processing method comprising:

6. An information processing system including a first computer and a second computer, the first computer; a first program processing unit that executes a predetermined program; a matching processing unit that performs a first determination as to whether or not a predetermined condition for data collection is met based on a first route list that represents a call path of a predetermined function called in the predetermined program and one or more other functions called before the predetermined function is called in an order of calling; When the predetermined condition is met, an investigation data collection unit is provided for collecting first investigation data. The second computer is a second program processing unit that executes the predetermined program and performs a second determination as to whether or not the predetermined condition for data collection is met based on a second route list that represents a call path of the predetermined function called by the predetermined program and one or more other functions called before the predetermined function is called in an order of calling; an investigation data collection unit that collects second investigation data including more detailed information than the first investigation data when the predetermined condition is met; an analysis unit that executes an analysis of an operation of the predetermined program at the time of execution based on a comparison result between the first investigation material and the second investigation material; An information processing system comprising:

Images