Event Collection

Event Collection

The analyzer reads the captured stdout and stderr of the instrumented binary line by line and classifies each line by substring match. There is no structured event protocol: this is pattern matching over log text.

What counts as a CoreTrace line

A line is a CoreTrace line when it contains any of:

==ct==, ct:, [ENTRY-FUNCTION], [EXIT-FUNCTION], [VTABLE-DIAG], tracing-, auto-free, heap-buffer-overflow, heap-use-after-free.

coretrace_lines counts those.

The counters

Counter	Incremented by a line containing
entry_events	[ENTRY-FUNCTION] or ct: enter
exit_events	[EXIT-FUNCTION]
allocation_events	tracing-, auto-free, leaks detected or ct: leak
bounds_errors	heap-buffer-overflow or heap-use-after-free
leak_reports	leaks detected or ct: leak
vtable_events	[VTABLE-DIAG]
warnings	[WARN] or WARN
errors	[ERROR] or ERROR

Consequences worth knowing

• The counters overlap by design. A leak line increments allocation_events and leak_reports. A heap-use-after-free increments bounds_errors even though it is a lifetime error, not a bounds error. Do not sum the counters expecting a total number of events.
• entry_events and exit_events need not match. A program that aborts — which a bounds violation does by default — exits without emitting the exit hooks of the frames still running.
• Program output that happens to contain a pattern is counted. A program printing the word ct: contributes to the collection. Keep the probe programs quiet, or read --show-events to see exactly which lines were counted.
• Counting is per run. In batch mode the per-file summaries are accumulated into one total.

--show-events prints the collected lines, which is the way to check what a counter actually saw. --show-output prints the raw captured stdout and stderr.