Error logging

Hello,

Is there a way to write out a log message to a standard system log file
from an NDIS miniport. I am hitting a condition that happens
unpredictably and only after running my driver for a long time. I can’t
tell if it is an assert in my code or if it is a null-pointer reference
or something like that. Either way, I see my machine reset itself. I’d
like to throw in some log messages at potential suspect points in my
driver and see the event log after rebooting the system back up. Is this
possible to do?

Thanks
Ravi

NdisWriteErrorLogEntry


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting

“Murty, Ravi” wrote in message news:xxxxx@ntdev…
Hello,

Is there a way to write out a log message to a standard system log file
from an NDIS miniport. I am hitting a condition that happens
unpredictably and only after running my driver for a long time. I can’t
tell if it is an assert in my code or if it is a null-pointer reference
or something like that. Either way, I see my machine reset itself. I’d
like to throw in some log messages at potential suspect points in my
driver and see the event log after rebooting the system back up. Is this
possible to do?

Thanks
Ravi

You can open a file from the driver and write to it. It is possible to
write to the system log too, but it’s more complicated and less “free” in
what message you write. If you use a file, you can just write whatever you
fancy in the file (either binary or clear text).

Use ZwCreateFile, ZwWriteFile and ZwCloseFile for this.


Mats

xxxxx@lists.osr.com wrote on 05/06/2005 04:30:04 PM:

Hello,
Is there a way to write out a log message to a standard system log
file from an NDIS miniport. I am hitting a condition that happens
unpredictably and only after running my driver for a long time. I
can’t tell if it is an assert in my code or if it is a null-pointer
reference or something like that. Either way, I see my machine reset
itself. I’d like to throw in some log messages at potential suspect
points in my driver and see the event log after rebooting the system back
up.
Is this possible to do?
Thanks
Ravi


Questions? First check the Kernel Driver FAQ at http://www.
osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
ForwardSourceID:NT000127A6

Thanks, this helps. Couple of more questions:

  1. How do I view (after a reboot) messages my driver logged before dying
    using NdisWriteErrorLogEntry()? Can I view these messages using the
    system Event Viewer app?

  2. My guess at this point is that my problem happens in the deferred
    interrupt handler (MiniportHandleInterrupt()) and since this runs at
    DISPATCH, I can’t really use ZwCreateFile etc.

Thanks,
Ravi

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mats PETERSSON
Sent: Friday, May 06, 2005 8:41 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Error logging

You can open a file from the driver and write to it. It is possible to
write to the system log too, but it’s more complicated and less “free”
in
what message you write. If you use a file, you can just write whatever
you
fancy in the file (either binary or clear text).

Use ZwCreateFile, ZwWriteFile and ZwCloseFile for this.


Mats

xxxxx@lists.osr.com wrote on 05/06/2005 04:30:04 PM:

Hello,
Is there a way to write out a log message to a standard system log
file from an NDIS miniport. I am hitting a condition that happens
unpredictably and only after running my driver for a long time. I
can’t tell if it is an assert in my code or if it is a null-pointer
reference or something like that. Either way, I see my machine reset
itself. I’d like to throw in some log messages at potential suspect
points in my driver and see the event log after rebooting the system
back
up.
Is this possible to do?
Thanks
Ravi


Questions? First check the Kernel Driver FAQ at http://www.
osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
ForwardSourceID:NT000127A6


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@intel.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Since the error occurs at dispatch, use option 1. yes, you view the log
entry in the event viewer (under system events). For the viewer to
display the message text correctly, you need to compile the .mc file and
#include the resuling .bin in your .rc file. Also, if you are logging
at the point of failure, it is very likely that the final entry will not
make it into the error log b/c you crash before it is written to disk.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Murty, Ravi
Sent: Friday, May 06, 2005 9:00 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Error logging

Thanks, this helps. Couple of more questions:

  1. How do I view (after a reboot) messages my driver logged before dying
    using NdisWriteErrorLogEntry()? Can I view these messages using the
    system Event Viewer app?

  2. My guess at this point is that my problem happens in the deferred
    interrupt handler (MiniportHandleInterrupt()) and since this runs at
    DISPATCH, I can’t really use ZwCreateFile etc.

Thanks,
Ravi

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mats PETERSSON
Sent: Friday, May 06, 2005 8:41 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Error logging

You can open a file from the driver and write to it. It is possible to
write to the system log too, but it’s more complicated and less “free”
in
what message you write. If you use a file, you can just write whatever
you
fancy in the file (either binary or clear text).

Use ZwCreateFile, ZwWriteFile and ZwCloseFile for this.


Mats

xxxxx@lists.osr.com wrote on 05/06/2005 04:30:04 PM:

Hello,
Is there a way to write out a log message to a standard system log
file from an NDIS miniport. I am hitting a condition that happens
unpredictably and only after running my driver for a long time. I
can’t tell if it is an assert in my code or if it is a null-pointer
reference or something like that. Either way, I see my machine reset
itself. I’d like to throw in some log messages at potential suspect
points in my driver and see the event log after rebooting the system
back
up.
Is this possible to do?
Thanks
Ravi


Questions? First check the Kernel Driver FAQ at http://www.
osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
ForwardSourceID:NT000127A6


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@intel.com
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

I am not sure, you might have already thought about this, but DbgPrint can
also help a lot in debugging such kind of issues.
-Kiran

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Murty, Ravi
Sent: Friday, May 06, 2005 9:30 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Error logging

Thanks, this helps. Couple of more questions:

  1. How do I view (after a reboot) messages my driver logged before dying
    using NdisWriteErrorLogEntry()? Can I view these messages using the system
    Event Viewer app?

  2. My guess at this point is that my problem happens in the deferred
    interrupt handler (MiniportHandleInterrupt()) and since this runs at
    DISPATCH, I can’t really use ZwCreateFile etc.

Thanks,
Ravi

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mats PETERSSON
Sent: Friday, May 06, 2005 8:41 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Error logging

You can open a file from the driver and write to it. It is possible to write
to the system log too, but it’s more complicated and less “free”
in
what message you write. If you use a file, you can just write whatever you
fancy in the file (either binary or clear text).

Use ZwCreateFile, ZwWriteFile and ZwCloseFile for this.


Mats

xxxxx@lists.osr.com wrote on 05/06/2005 04:30:04 PM:

Hello,
Is there a way to write out a log message to a standard system log
file from an NDIS miniport. I am hitting a condition that happens
unpredictably and only after running my driver for a long time. I
can’t tell if it is an assert in my code or if it is a null-pointer
reference or something like that. Either way, I see my machine reset
itself. I’d like to throw in some log messages at potential suspect
points in my driver and see the event log after rebooting the system
back
up.
Is this possible to do?
Thanks
Ravi


Questions? First check the Kernel Driver FAQ at http://www.
osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
ForwardSourceID:NT000127A6


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@intel.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

You say … “I can’t tell if it is an assert in my code or if it is a
null-pointer reference or something like that. Either way, I see my
machine reset itself.”

I am guessing you have no debugger attached to your test machine and it
is configured to automatically reboot when it hits an error.

Here is what you should do. First configure the machine not to reboot
itself when it encounters an error. This can be done by going to
properties of ‘My Computer’ -> Advanced -> ‘Settings’ under ‘Startup and
Recovery’. In this unclick the tick mark against ‘Automatically restart’
under System Failure option. Select complete memory dump under ‘Write
debugging information’ option.

This will give you crashdump or if WinDbg is already connected you can
start debugging to see if this is an Assert or Null pointer reference as
you suspect.

If you still think you need to see a log of sequence of events that
happened before crash then apart from the ways already suggested you can
also try this. Allocate a memory buffer (and a global variable to store
the offset), the address of which you can print during driver
initialization and use that buffer as circular buffer to log the events.
And when the machine crashed you can access the buffer through debugger
and using the offset variable have a rough log of events.

Pretty crude but easy. :slight_smile:

Susaant

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Kiran Joshi
Sent: Monday, May 09, 2005 12:07 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Error logging

I am not sure, you might have already thought about this, but DbgPrint
can
also help a lot in debugging such kind of issues.
-Kiran

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Murty, Ravi
Sent: Friday, May 06, 2005 9:30 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Error logging

Thanks, this helps. Couple of more questions:

  1. How do I view (after a reboot) messages my driver logged before dying
    using NdisWriteErrorLogEntry()? Can I view these messages using the
    system
    Event Viewer app?

  2. My guess at this point is that my problem happens in the deferred
    interrupt handler (MiniportHandleInterrupt()) and since this runs at
    DISPATCH, I can’t really use ZwCreateFile etc.

Thanks,
Ravi

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mats PETERSSON
Sent: Friday, May 06, 2005 8:41 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Error logging

You can open a file from the driver and write to it. It is possible to
write
to the system log too, but it’s more complicated and less “free”
in
what message you write. If you use a file, you can just write whatever
you
fancy in the file (either binary or clear text).

Use ZwCreateFile, ZwWriteFile and ZwCloseFile for this.


Mats

xxxxx@lists.osr.com wrote on 05/06/2005 04:30:04 PM:

Hello,
Is there a way to write out a log message to a standard system log
file from an NDIS miniport. I am hitting a condition that happens
unpredictably and only after running my driver for a long time. I
can’t tell if it is an assert in my code or if it is a null-pointer
reference or something like that. Either way, I see my machine reset
itself. I’d like to throw in some log messages at potential suspect
points in my driver and see the event log after rebooting the system
back
up.
Is this possible to do?
Thanks
Ravi


Questions? First check the Kernel Driver FAQ at http://www.
osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag
argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
ForwardSourceID:NT000127A6


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@intel.com To
unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@adaptec.com
To unsubscribe send a blank email to xxxxx@lists.osr.com