On the Semantics of Matching Trace Monitoring Patterns

Abstract

Abstract. Trace monitor specifications consist of a pattern that is matched against the trace of events of a subject system. We investigate the design choices in defining the semantics of matching patterns against traces. Some systems use an exact-match semantics (where every relevant event must be matched by the pattern), while others employ a skipping semantics (which allows any event to be skipped during matching). The semantics of exact-match is well established; here we give a semantics to skipping also by providing a translation to exact-match. It turns out the translation is not surjective: a pattern language with skipping semantics is strictly less expressive than one with exact-match semantics. That proof suggests the addition of a novel operator to a skipping language that makes it equivalent to exact-match. Another design decision concerns the atoms in patterns: are these unique runtime events, or can multiple atoms match the same runtime event? Many specification formalisms chose predicates for atoms, and then overlap is natural. There are some exceptions, however, and we examine the consequences of that design choice in some depth.