xnslong / guess-stack

This is a tool to recover deep stacks whose root are lost, so that they can align with each other again in FlameGraphs.

guess-stack

When taking samples of call stacks from a process in flight, some root stack nodes may be lost if the stack is too deep. Then the stacks cannot align with each other anymore, it will be hard to analyze.

For example, following is a FlameGraph whose stacks have their root call nodes lost, it becomes hard to understand.

This tool will try to recover the stacks by guessing the missing stack nodes, enabling the stacks to align with each other again. Following is the recovered version of the previous FlameGraph. Then we can analyze it easily.

How to guess?

Suppose we have 2 stacks in a graph: A & B. When the root end nodes of a stack A overlaps nodes in stack B, then we guess stack A should have trimmed some root nodes the same as those in stack B under the overlapping nodes (shown in the following 'guess' graph).

The longer the overlapping part is, the more trustable the guess is.

If you are interested in the algorithm to realize it, please refer to algorithm.

Module introduction

Since there are a variety of profile file types, we will provide several tools to fix each profile file type.

• guess-pprof: a tool to fix the golang pprof profile. (taken by pprof)
• guess-fold: a tool to fix the folded stack type of call stacks defined by FlameGraph. it's will be more commonly used for programs written in a variety oflanguages.

The previous tools are working based on the following core module.

• core: The core module providing an implementation to fix the missing nodes by guessing. This module will be used by each other modules.

Installation

guess-pprof

go install github.com/xnslong/guess-stack/guess-pprof@latest

guess-fold

go install github.com/xnslong/guess-stack/guess-fold@latest

guess-stack's Issues

We can reduce complexity from O(n^2) to O(n) with prefix tree

Currently, we try to join a stack with any other stack to test the best join point. Suppose there are n stacks, the complexity will be
C=n * (n-1) = O(n^2).

But if we first organize all stacks into a prefix tree. When a stack try to match a route in the prefix tree, it will finish all join point to this stack computed for all stacks in the tree. Then we only need O(n) matches.

Only stacks that are too deep may be trimmed, so provide an option to fix stacks with certain depth