Compare traces

SpyStudio Tutorials Home

Use Cases

SpyStudio lets you compare two traces to find the differences between them. For example, we use this feature to create virtual profiles for applications. Sometimes there is a problem with a COM object, a missing dll, a window that cannot be created or a missing registry key. These errors are easy to spot by comparing traces in SpyStudio. The differences in the traces are recognized and interpreted by SpyStudio to highlight the most probable causes of errors.
You could also use this feature when you have an application that is running well on a system but you cannot make it work on another.

Load traces

1. Capture two traces and save them.
The first thing you need is two traces to compare. Normally, you will get a trace of a process in an environment where it performs well and another in an environment where it doesn't. If you don't know how to get a process trace, take a look at this article: Trace an application from startup. Take into account that the comparison will be much more accurate if you trace the executions from startup.
To save the traces, just go to "File"->"Save log" as seen below.


2. Start comparison
Go to "Compare" -> "Traces" and wait for SpyStudio to process both traces and display the comparison window.


Compare Dialog

This example shows a comparison between the traces of a custom application (ThinAppLegacyApp) running on Windows 7 x64 and the same application running on Windows XP. In Windows 7, the application crashes during start-up.

Interpreting results in the Trace tab

Calls: each field in trace control represents a specific call which can be in one of the files or in both.

Time: time that took the call/s in milliseconds.

Color / Background White Blue Green
Black Call succeed, exists in both files and results match Call succeed and exists only in the first file Call succeed and exists only in the second file
Red Call failed, exists in both files and results match Call failed and exists only in the first file Call failed and exists only in the second file
Gray Call succeed, exists in both files, results match and the function was called from a similar place
Light Red Call failed, exists in both files, results match and the function was called from a similar place
Bold Magenta Call exists in both files and results do not match

Interpreting results in the other tabs

Calls: each field represents a group of calls that have the same parameters.
Count: number of calls that were grouped in the field
Time: time that took the calls in milliseconds.

Color / Background White Blue Green
Black Calls exist in both files and succeeded Call exists in the first file and succeeded Call exists in the second file and succeeded
Red Calls exist in both files and failed Call exists in the first file and failed Call exists in the second file and failed

Only for Registry tab

Color / Background White
Bold Black Key exists in both files but their accessed values are different
Bold Magenta Key is accessed from both traces but the results are different

Event Summary


White: low importance events that exist in both files
Gray: mid-importance events that exist in both files
Black: high importance events that exist in both files
Magenta: events that exist in both files which results are different (first place to look for errors)
Blue: events that exist only in the first file
Green: events that exist only in the second file





COM Objects

This tab shows the list of COM objects instantiated by both processes. Here we can see that a COM object which was successfully instantiated in Windows XP, couldn't be instantiated in Windows 7. Hence, the process stopped prematurely under Windows 7 and didn't got to instantiate all the COM objects that were instantiated under Windows XP.


Windows Created

This tab shows the windows created by both processes. Again, we can see the differences between both traces. The process wasn't able to load completely on Windows 7, so it didn't got to open all the windows that were created under XP.

Opened Files

It shows files opened in both traces. Here you can see that most file accesses are unmatched, since the different versions of windows have different versions of system files.


Registry

This tab shows the registry entries accessed by the processes. Here we can see differences in the registry usage too.

Apply Filter

You can apply a filter from 'Edit' menu, click 'Filter ...' item or just press CTRL-L. In this example you can see calls filtered to see only those which ParamMain contains clsid, and doesn't contain uxtheme.dll