A trace file providing details of an execution of a software application experiencing unexpected behavior can be identified. The trace file can be converted into a graph structure (e.g., Function Call Graph), which details functions called during the execution, a calling relationship, and errors encountered during the execution. The converted graph structure can be programmatically matched against a set of stored graph structures to determine matched results. Each stored graph structure can correspond to unique record of a symptom database. Each unique record can be associated with a determined problem. The matched results can be provided as possible problems causing the unexpected behavior of the software application.