Abstract:
A generic instrumentation framework comprises two primary systems: an instrumentation generation system, and a runtime system. The instrumentation generation system creates an instrumentation generator that is specific to the system or subsystem to be instrumented. Preferably, the instrumentation generator is created by an instrumentation generation engine, which receives as input a system descriptor. The system descriptor is a set of metadata that comprise an interface specification. The instrumentation generation engine reads the system descriptor, identifies the target system, and selects an appropriate instrumentation generator. Using the system descriptor, the instrumentation generator then creates an instrumentation “package” comprising the actual instrumentation code itself (an executable) together with an instrumentation descriptor, which describes a set of one or more instrumentation points in the target system. The target system is then available to be instrumented with the instrumentation code. At an appropriate time, such as system start up, a telemetry stream adapter of the runtime system loads in and initiates the instrumentation code. A telemetry stream reader of the runtime system reads telemetry stream data provided by the telemetry stream adapter. The telemetry is then made available to an analysis module, which also receives the instrumentation descriptor to facilitate a forensic analysis of the telemetry.