Improving Troubleshooting via Dynamic Dependency Analysis

The task of identifying the “root cause” of a problem becomes increasingly difficult as systems become more complex, yet existing tools for root cause analysis remain fairly primitive. We examine the potential for aiding root cause analysis via auditing of dynamic dependencies at the kernel level. There are two main challenges to this kind of analysis: gathering data without unacceptably degrading system performance, and representing that data at an appropriate level of abstraction. We base our work on several prior efforts at dependency analysis that apply differing levels of abstraction. Sowhat [3] performs a static, global analysis of dynamic library dependencies in order to predict the effects of a system change. Strider [4] performs a similar form of analysis on the Windows registry, using “before and after” snapshots of registry contents to infer potential causes of problems. Our approach looks instead to information that is naturally generated by auditing as a vehicle for dependency analysis. Unlike these prior attempts, our work concentrates on dynamic dependencies that cannot be inferred from static analysis but must instead be observed at runtime. While library dependencies can be identified effectively using sowhat’s static analysis, libraries themselves are infrequently modified entities. Program behavior is determined in large part by configuration files and environment; these dependencies change more frequently, yet few tools automatically identify them. Strider uses some dynamic analysis, but it only does so on individual programs, essentially missing transitive and asynchronous dependencies. Furthermore, Strider’s approach assumes that undesired program behavior is reproducible, which is not always the case.