On the semantics of matching trace monitoring patterns

  • Authors:

  • Pavel Avgustinov;Julian Tibble;Oege de Moor

  • Affiliations:

  • Oxford University, United Kingdom;Oxford University, United Kingdom;Oxford University, United Kingdom

  • Venue:
  • RV'07 Proceedings of the 7th international conference on Runtime verification
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Trace monitor specifications consist of a pattern that is matched against the trace of events of a subject system. We investigate the design choices in defining the semantics of matching patterns against traces. Some systems use an exact-match semantics (where every relevant event must be matched by the pattern), while others employ a skipping semantics (which allows any event to be skipped during matching). The semantics of exact-match is well established; here we give a semantics to skipping by providing a translation to exact-match. It turns out the translation is not surjective: a pattern language with skipping semantics is strictly less expressive than one with exact-match semantics. That proof suggests the addition of a novel operator to a skipping language that makes it equivalent to exact-match. Another design decision concerns the atoms in patterns: are these unique runtime events, or can multiple atoms match the same runtime event? Many implementations have chosen predicates for atoms, and then overlap is natural. There are some exceptions, however, and we examine the consequences of that design choice in some depth.