Gain insights into diagnostic techniques and anomaly detection with over 200 trace and log analysis patterns, applicable across various software environments, operating systems, and platforms.

General trace and log analysis patterns allow the application of uniform diagnostics and anomaly detection across diverse software environments. It includes troubleshooting, debugging, describing, and explaining problems and incidents on various operating systems and platforms. It is also helpful in recording network traces, malware, general data, narratives, and text and image analysis (space-like narratology). This course, organized as a pattern language dictionary and cross-referenced with classification, explains and teaches more than 200 traces and log analysis patterns.

A Guide to Learning Software Trace and Log Analysis Patterns

# Discontinuity
Sometimes we face delays in application startup and session initialization, long response times, and even the absence of response altogether. All these problems can be reflected in software traces showing sudden gaps in [threads of activity](https://www.educative.io/courses/guide-learning-software-trace-log-analysis-patterns/ruptured-strand-thread-time-delta-timeout-weave). This pattern is called **discontinuity** from the analogy with continuous and discontinuous functions in mathematics. Here is an example: aprocess has a long period of CPU spiking calculation, and we record a trace. When we open it, we see this [periodic error](https://www.educative.io/courses/guide-learning-software-trace-log-analysis-patterns/exception-stack-false-positive-hidden-periodic):

However, when looking for any discontinuities for the thread 5476, we see the gap of more than seven minutes:

We have three possibilities here:
1. The process did lengthy CPU spiking calculations involving registry access twice, and was quiet between them.
2. Registry access belonged to some background activity and ceased for seven minutes, and, during that time, the process had CPU spiking intensive calculation.
3. This discontinuity is irrelevant because either the calculation module is not selected for tracing or it simply doesn’t have relevant tracing statement coverage for the code that does the calculation.

The full case study is covered in the September 2009 issue of “Debugged! MZ/PE” magazine.

This lesson introduces the following analysis patterns: discontinuity, fiber of activity, flag, glued activity, and last activity.

Getting Started

Activity

Block and Data

Error and Large Scale

Message 1

Message 2

Trace as a Whole

Trace Set

Vocabulary, Memory, Code and Text

Conclusion

Index

Discontinuity, Fiber, Flag, Glued, Last

Discontinuity