MARQ monitoring at runtime with QEA

Abstract

Runtime monitoring is the process of checking whether an execution trace of a running system satisfies a given specification. For this to be effective, monitors which run trace-checking algorithms must be efficient so that they introduce minimal computational overhead.We present the MARQ tool formonitoring properties expressed as Quantified Event Automata. This formalism generalises previous automata-based specification methods. MARQ extends the established parametric trace slicing technique and incorporates existing techniques for indexing and garbage collection as well as a new technique for optimising runtime monitoring: structural specialisations where monitors are generated based on structural characteristics of the monitored property. MARQ recently came top in two tracks in the 1st international Runtime Verification competition, showing that MARQ is one of the most efficient existing monitoring tools for both offline monitoring of trace logs and online monitoring of running systems.