Electrical computers and digital processing systems: interprogra – Event handling or event notification
Reexamination Certificate
2000-11-30
2004-08-31
An, Meng-Al T. (Department: 2126)
Electrical computers and digital processing systems: interprogra
Event handling or event notification
C710S260000, C710S263000
Reexamination Certificate
active
06785893
ABSTRACT:
TECHNICAL FIELD
The present invention relates generally to computer programming and more particularly to a system and method for tracking events handled by an operating system kernel.
BACKGROUND OF THE INVENTION
As operating systems have become more sophisticated, and as the environments with which operating systems operate have become more complex, it has become important to monitor the actions taken by an operating system in response to events the operating system is tasked to handle. In particular, visibility into the internal workings of an operating system kernel can be important to activities including, but not limited to, developing, debugging, and/or diagnosing an operating system. For example, tracking the number and type of events that an operating system handles can be important to diagnosing system problems, bottlenecks, malfunctioning equipment and/or component, and capacity problems.
Conventionally, monitoring operating system events has been difficult to achieve. Even if possible to log events handled by an operating system, such logging negatively impacted the ability of the operating system to handle events. For example, when an operating system experienced a problem, support personnel may have considered monitoring the events handled by the operating system to diagnose the problem. But the processing required to log an event may have taken more time to perform than handling the event, and thus the operating system could not be monitored under conditions that produced the problem, thus reducing the relevance of the monitoring. Similarly, when testing an operating system, test conditions that stress the operating system to a point where bugs appear can overwhelm a conventional monitor, and events may not be logged or requests may not be handled and thus the problem may remain undiagnosed. Further, contemporaneously logging interrupt events and non-interrupt events frequently lead to interrupt data interfering with non-interrupt data, and thus accurate monitoring was difficult. Thus, the monitoring may not have been performed and operating system improvements may not have been achieved.
Even if operating system monitoring is performed, it can be difficult to understand complex interactions between entities including, but not limited to, threads, processes, mutexs, locks, events, device drivers and applications. The value of operating system monitoring can be limited if the data produced during such monitoring is difficult to understand.
Thus there remains a need for a minimally intrusive system and method to accurately monitor events handled by an operating system, where the data produced by such monitoring is viewable and facilitates understanding the running of the operating system.
SUMMARY OF THE INVENTION
The following presents a simplified summary of the invention in order to provide a basic understanding of some aspects of the invention. This summary is not an extensive overview of the invention. It is not intended to identify key/critical elements of the invention or to delineate the scope of the invention. Its sole purpose is to present some concepts of the invention in a simplified form as a prelude to the more detailed description that is presented later.
The present invention relates to a system and method for logging events processed by an operating system. The events can include both interrupt and non-interrupt data. When an event is logged, the present invention stores data associated with interrupts in an interrupt buffer and stores data associated with non-interrupt events in a non-interrupt buffer. By writing small amounts of data to separate memories and by not attempting to transport data concerning the event to other processes (e.g. data viewer, disk log, network) during the event handling process, the logging of the events is less intrusive, and less likely to corrupt nearly simultaneous events, thus mitigating problems associated with conventional monitoring systems.
Both the interrupt buffer and the non-interrupt buffer can be flushed to a secondary buffer during non-event handling time. The interrupt buffer can be flushed upon completion of the interrupt handling process and the non-interrupt buffer can be flushed upon completion of the execution of the event-handler and/or upon the non-interrupt buffer becoming substantially full. One or more processes (e.g. a viewer) can access the secondary buffer. The secondary buffer can also be flushed to one or more devices and/or processes (e.g. a viewer, data communication devices, disk) when the secondary buffer becomes substantially full and/or when a timeout condition occurs.
In one aspect of the present invention, the interrupt buffer, the non-interrupt buffer and the secondary buffer are located in memory associated with the computer running the operating system being monitored. In an alternative aspect of the present invention, the interrupt buffer, the non-interrupt buffer and the secondary buffer are located in memory associated with a separate hardware probe. When the buffers are located in memory associated with computer running the operating system being monitored, flushing the buffers may be accomplished under software control. But when the buffers are located in memory associated with a separate hardware probe, then flushing the buffers may be accomplished under hardware and/or software control.
By logging operating system kernel events, visibility into the internals of the operating system kernel is achieved. Such visibility facilitates actions including, but not limited to, debugging, programming and maintaining operating systems, hardware components, software components and/or applications. By employing the triple buffering method described above, acquiring such visibility is less intrusive to the operating system being monitored. Initially storing the data associated with interrupt events and the data associated with non-interrupt events in separate buffers mitigates problems associated with interrupt data corrupting non-interrupt data. Subsequently merging the interrupt data and the non-interrupt data during non-event handling time reduces the impact of the monitor on the operating system event handling performance and facilitates chronologically ordering the interrupt data and non-interrupt data in the secondary buffer. To facilitate such chronological ordering, when the flushing of the buffers is under software control, a time stamp can be associated with events as they are written to the buffers. The time stamp can then be used to arrange events in chronological order, and to ascertain the amount of time spent processing one or more events.
Monitoring an operating system may be undertaken for many reasons. For example, an operating system can be monitored to determine the effect of adding a new piece of hardware, the effect of adding a new software component, and/or to determine the amount of operating system resources being allocated to handle certain events. Thus, a plurality of events can be logged by the present invention to facilitate customizing monitoring an operating system. A user interface provides means for an administrator to select events that are to be logged by the monitor. An Application Programming Interface (API) similarly provides means for processes to select events that are to be logged by the monitor. Since users may be interested in events not defined by the present invention, users may define events that are to be logged, and thus the present invention provides means for defining such events, which can then be selected via the UI or API.
The value of monitoring an operating system can be increased if the data produced by such monitoring is viewable in a manner that facilitates understanding the running of the operating system. Thus, the present invention includes a component and method for runtime display of monitoring data. Such a runtime display of monitoring data facilitates visualizing time based thread interactions, and system events associated with the interacting threads. The runtime display facilitates viewing items including, but not limited
Dey Susan A.
Eldridge John R.
Morris Larry A.
Sauntry David M.
Shepard Marc
Amin & Turocy LLP
An Meng-Al T.
Anya Charles
Microsoft Corporation
LandOfFree
Operating system event tracker having separate storage for... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Operating system event tracker having separate storage for..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Operating system event tracker having separate storage for... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3296272