Many benefits can be achieved by processing trace events so as to reconstruct a higher-level model, either at operating system process level or at higher level state machine or interaction model. The operating system process level model can be used to follow all the dependencies among processes and thus identify the critical path between a request and the corresponding response. Dependencies arise when a process awaits a message from another process, messages taking different forms such as reading from a pipe or the network, waiting for a process (waitpid), waiting on a synchronization primitive...
Higher level models are built using different techniques which include filtering less-relevant items (e.g. utilities) from the trace; the process also builds on trace abstraction, analysis and correlation. Key challenges are to manage the scope and to determine the appropriate abstractions; this can be guided by the presence of an original UML model used to create the system (if available). An example of the above is taking a series of transmissions in a system and recognizing that it represents a single transaction.
The reconstructed model can then be applied in several ways: 1) It can be used for anomaly detection and analysis by comparing it to either the original UML model, or to models generated from previous correct or anomalous runs. 2) Delays, timing and resource usage can be analyzed at the level of the abstract entities in the model. 3) Various visualization techniques can be applied to the model to allow engineers to obtain insights. 4) It becomes possible to change the model (e.g. change the amount or distribution of resources, or change a condition) and estimate the effect on the system's performance or behavior.