WPP during boot by AutoLogger

NTDEV
1

I use WDK demo [tracedrv] , and set it to AutoLogger . The .etl file is created correctly but there are not have any log in it.
The problem is the same as described on this(ETL logging - how to generate trace logs in DriverEntry function. — OSR) website.

1194×542 47.4 KB

1191×614 51.2 KB

What settins are missing ?

2

Did you stop/flush trace session?

3

I think you also need EnableFlags set (try 3 based on the flags defined in the sample). Also, make sure the driver is actually generating messages during boot. Looks to me like the sample only generates messages when it receives a particular IOCTL.

4

@“Scott_Noone_(OSR)” said:
I think you also need EnableFlags set (try 3 based on the flags defined in the sample). Also, make sure the driver is actually generating messages during boot. Looks to me like the sample only generates messages when it receives a particular IOCTL.

Has been resolved. Thanks~

5

Great! Care to share the details to help out the next person?

6

@“Scott_Noone_(OSR)” said:
Great! Care to share the details to help out the next person?

As you said above,
Every bits of EnableFlags is assosiated to the definition of WPP_CONTROL_GUIDS
#define WPP_CONTROL_GUIDS \ WPP_DEFINE_CONTROL_GUID(TraceTest,(d58c126f, b309, 11d1, 969e, 0000f875a5bc), \ WPP_DEFINE_BIT(FLAG_ONE) \ WPP_DEFINE_BIT(FLAG_TWO) )
The first bit of EnableFlags indicates the FLAG_ONE and so on.