Self-Aware Applications: Automatic Production Monitoring
summary
Uses ETW call-stack sampling plus Windows performance counters to trigger deeper probes (example: sample CPU stacks every 100 ms after ~10s above ~80% CPU) and uses the open-source LiveStacks flow to symbolize addresses into functions, successfully pinpointing a hot goodHash function. Allocations-per-second monitoring plus CLRMD heap snapshots identifies heavy string concatenation and a leak where byte[] count jumps from 26 to 166 between snapshots. Also detects deadlocks by graphing thread wait chains with CLRMD. Notes: monitoring adds measurable overhead and can itself consume CPU.
AI-written summary · about
chapters (10)
- 0:00Intro
- 2:02Motivation
- 7:25Master Plan
- 10:08Lightweight Monitoring
- 13:04Halfway Monitoring Tools
- 17:29Invasive Analysis APIs
- 21:23(Self) CPU-Profiling
- 38:25(Self) GC-Monitoring
- 48:33(Self) Heap Analysis
- 54:34(Self) Deadlock Detection
related talks
58mDebugging one layer deeper
54mCatching Real-time Safety Violations in C++
10mBacktraces in the mirror: mad science by secrets of elves & dwarves!!
51mAutomation Techniques in C++ Reverse Engineering
16mHardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing
10mDemo: Insightful Debugging & Optimization: System-wide Functional Monitoring with Tessent...
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce