Tracing (software)

In software engineering, tracing is a specialized use of logging to record information about a program's execution. This information is typically used by programmers for debugging purposes, and additionally, depending on the type and detail of information contained in a trace log, by experienced system administrators or technical support personnel to diagnose common problems with software. Tracing is a cross-cutting concern.

There is not always a clear distinction between "tracing" and other forms of "logging", except that the term "tracing" is almost never applied to logging that is a functional requirement of a program (therefore excluding logging of data from an external source, such as data acquisition in a high-energy physics experiment, and write ahead logging). Logs that record program usage (such as a server log) or operating system events primarily of interest to a system administrator (see for example "Event Viewer") fall in a gray area with regards to terminology. This article deals with tracing that is primarily for debugging or diagnostic purposes.

Event logging versus tracing

Difficulties in making a clear distinction between event logging and software tracing arise from the fact that the some of the same technologies can be used for both, and further because many of the criteria that distinguish between the two are continuous rather than discrete. The following table lists some important, but by no means precise or universal, distinctions that are used by developers to select technologies for each purpose, and that guide the separate development of new technologies in each area:

Event logging

Event logging provides system administrators with information useful for diagnostics and auditing. The different classes of events that will be logged, as well as what details will appear in the event messages, are often considered early in the development cycle. Many event logging technologies allow or even require each class of event to be assigned a unique "code", which is used by the event logging software or a separate viewer (e.g., Event Viewer) to format and output a human-readable message. This facilitates localization and allows system administrators to more easily obtain information on problems that occur.

Because event logging is used to log high-level information (often failure information), performance of the logging implementation is often less important.

A special concern, preventing duplicate events from being recorded "too often" is taken care of through event throttling.

oftware tracing

Software tracing provides developers with information useful for debugging. This information is used both during the development cycle and after the software is released. Unlike event logging, software tracing usually does not have the concept of a "class" of event or an "event code". Other reasons that event logging solutions based on event codes are inappropriate for software tracing include:
* Because software tracing is low-level, there are often many more types of messages that would need to be defined, many of which would only be used at one place in the code. The event code paradigm introduces significant development overhead for these "one-shot" messages.
* The types of messages that are logged are often less stable through the development cycle than for event logging.
* Because the tracing output is intended to be consumed by the developer, the messages don't need to be localized. Keeping tracing messages separate from other resources that need to be localized (such as event messages) is therefore important.
* There are messages that should never be seen.
* Tracing messages should be kept in the code, because they can add to the readability of the code. This is not always possible or feasible with event logging solutions.

Another important consideration for software tracing is performance. Because software tracing is low-level, the possible volume of trace messages is much higher. To address performance concerns, it often must be possible for software tracing to be turned off, either at compile-time or run-time.

Other special concerns:
* In proprietary software, tracing data may include sensitive information about the product's source code.
* If tracing is enabled or disabled at run-time, many methods of tracing require a significant amount of additional data be included in the binary, which can indirectly hurt performance even when tracing is disabled.
* If tracing is enabled or disabled at compile-time, getting trace data for a problem on a customer machine depends on the customer being willing and able to install a special, tracing-enabled version of your software and then duplicating the problem.
* Many uses of tracing have very stringent robustness requirements. This is both in the robustness of the trace output but also in that the use-case being traced should not be disrupted.
* In operating systems, tracing is sometimes useful in situations (such as boot) where some of the technologies used to provide event logging may not be available.

Technologies and techniques

Software tracing:
* Tracing macros
* Output to debugger (see for example [http://msdn2.microsoft.com/en-us/library/aa363362.aspx] )
* Aspect-oriented programming and related instrumentation techniques
* Windows software trace preprocessor (aka WPP)
* Linux system level and user level tracing with Kernel Markers and [http://ltt.polymtl.ca LTTng]

Event logging:
* syslog (see article for specific implementations)
* [http://msdn2.microsoft.com/en-us/library/aa363652.aspx Event Logging APIs] for Microsoft Windows
* [http://msdn2.microsoft.com/en-us/library/aa385780.aspx Windows Event Log] (new for Windows Vista)

Appropriate for both:
* [http://logging.apache.org/ Apache logging]
* [http://www.microsoft.com/whdc/devtools/tools/EventTracing.mspx Event Tracing for Windows]
* [http://java.sun.com/j2se/1.5.0/docs/api/java/util/logging/package-summary.html Java logging APIs]
* [http://msdn2.microsoft.com/en-us/library/microsoft.visualbasic.logging.aspx Visual Basic logging] (for Visual Basic .NET)
* Logcheck: a free and open-source utility to manage logs
* [http://www.logmx.com LogMX: a universal log/trace viewer] (commercial)
* [http://www.x-trace.net X-Trace] (research project)

External references

* [http://ltt.polymtl.ca/tracingwiki/index.php/TracingBook The Tracing Book]