Static code analyzers for C
c, code-analysis
Solution
Wikipedia maintains a list of static code analysis tools for various languages (including C).
Personally, I have used both `PC-Lint` and `Splint`. The best choice depends on the type of application you have written. However no matter which tool you use, there will be a low signal to noise ratio until you properly tune the tool and your code.
`PC-Lint` is the most powerful Lint tool I used. If you add it to an existing project, the signal to noise ratio can be low. However, once the tool and your code are properly configured, it can be used as part of your standard build process. The last major project where I used it, we set it so that `PC-Lint` warnings would break the build. Licenses for PC-Lint cost $389, but it is worth the cost.
`Splint` is a great open-source tool. I have used it on several projects, but found that it can be difficult to configure when using a compiler with non-ANSI C extenstions (e.g. on embedded systems projects).
`Valgrind` is also worth considering as a dynamic analysis tool.
You specifically requested feedback on `SourceMonitor`. This tool provides interesting metrics on your code, but should be used as a supplement to good Lint tool as it does not provide that kind of analysis.
As stated on their home page, `SourceMonitor` will:
...find out how much code you have and to identify the relative complexity of your modules. For example, you can use SourceMonitor to identify the code that is most likely to contain defects and thus warrants formal review.
I used it on a recent project and found it to be easy to use (even for embedded systems code). The complexity metric is an excellent resource for developing code that will be less error-prone and easier to maintain.
`SourceMonitor` provides nice graphs of its output as well as well-formatted XML if you want to automate metrics collection. The only downside is that the tool only runs on Windows.
Problem
Which static code analyzer (if any) do you use? I've been using PyLint for Python and I'm pretty satisfied with it, now I need something similar for C code. How much of it's output do you have to suppress for normal daily usage?