Debug output noise in release drivers

NTDEV
1

Whenever I turn on Debug Print Filter UNKNOWN=8 to log KdPrint output and start windbg it surprises me that there is so much noise coming out of a clean install of windows totally cluttering the output window into uselessness. The amount now is more than ever before. I had always thought, perhaps incorrectly, that release compiled drivers should never have debug output. Putting my driver debug output from KdPrintEx into IHVDRIVER=4 (for debug builds only) where the docs seem to say it belongs here again the noise is incredibly high coming from other drivers from a clean install of the latest free build of windows. So 2 questions:

#1: Is there a Debug Print Filter setting to see useful output from other drivers while debugging, but not too much noise?
#2: Where is best place to put your own driver debug output so you can see it with minimal noise from other drivers?

2

I haven’t seen that much in IHVDRIVER. Is it possible you left DEFAULT set to a non-zero value?

I tend to use IHVSTREAMING, but that’s because most of my drivers are streaming drivers.

Also, remember that you can change the in-memory values on the fly and observe the results.

3

@Tim_Roberts said:
Is it possible you left DEFAULT set to a non-zero value?

Unfortunately no. The noise in IHVDRIVER is different than DEFAULT. And when raising the level from DPFLTR_TRACE_LEVEL to DPFLTR_WARNING_LEVEL the IHVDRIVER noise all went away. I could just dump all my debug output into DPFLTR_WARNING_LEVEL as a solution but it seems against the spirit of the design to spit out trace level stuff into the warning level. But unless there are other ideas I’ll just have to take the CB radio approach of trial and error switching around looking for quiet channels and adjusting the squelch.

4

The ‘spirit of the design’ was abandoned decades ago with the shift to using ETW. So don’t worry about that, just use a filter level for your driver that makes sense.

5

If I need to distinguish debug prints of my drivers from others, I usually use certain prefix in the prints, so the ooutput can be easily post-processed (and all noise filtered out).

6

To be clearer, what we generally do is use a level based wrapper around: DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, …). That results in very little noise from other kernel components, and very little noise from our components as our ‘level based wrapper’ limits our spew.