Verarbeitung von Ereignisströmen im Betriebssystemkern (English shop)

Preview

Table of Contents, Datei (33 KB)
Extract, Datei (70 KB)

Observing system behaviour by recording events occurring in the system (event tracing) is employed in a variety of areas — for example for debugging, for performance analysis or for monitoring quality-of-service properties.
Challenges arise from the large volume of data to be recorded, a potentially considerable perturbation of the system, the temporal gap between analysis and a possible reaction, as well as from the level of detail of the recorded events.
Processing event streams directly within the operating system kernel constitutes a new approach to system analysis. This work presents a runtime environment integrated into the operating system kernel for processing event streams. It allows the detection of constellations of multiple events in different execution contexts within the system-wide event stream, the immediate processing and analysis directly while the events occur, and the execution of actions immediately after the detection of particular event constellations.
With the aid of the described approach, the volume of data to be recorded can be reduced by recording only the information that is actually necessary for detecting a specific constellation. The integration into the operating system kernel makes it possible to analyse almost arbitrary applications running on a system with such a kernel.
The runtime environment and the instrumentation infrastructure used have been implemented as a prototype for the Windows operating system kernel. Furthermore, a specification language for describing event constellations is presented. The particular characteristics of event stream processing in the operating system kernel are analysed and taken into account.
The approach to processing event streams in the operating system kernel described in this work makes it possible, for example, to implement a software test bench or to realise concepts of autonomic computing.