ETW at boot time???

Hi there,

I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.

Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but was
intimidated by the ‘symbol not found’ no matter what symbols I’ve loaded.

Has anybody got it working? Am I missing something obvious?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

To use this feature requires the component to use the “Global Logger”,
so there are three things you must do.

-Build your driver to be global logging aware.

Add the following definition to the driver code

define WPP_GLOBALLOGGER

  • Start the Global Logger
    TraceLog -start GlobalLogger

-Enable your driver’s control GUID on the Global logger

Under the GlobalLogger registry key
(HKLM\System\CurrentControlSet\Control\WMI\GlobalLogger), add a key for
your GUID. Enclose the control GUID in braces ( { } ).
The Tracelog -start command adds the GlobalLogger key to the registry.
The ControlGUID key establishes the driver as provider for the Global
Logger trace session

To configure your provider add Flags as REG_DWORD value, and Level as a
REG_DWORD value.

Restart the system. This starts the global logger trace session, and the
driver logs to it every time you restart the system.

When you are done, delete your GUID key from the registry or Set the
value of the Start Entry in the GlobalLogger key to 0


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 12:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] ETW at boot time???

Hi there,

I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.

Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but
was intimidated by the ‘symbol not found’ no matter what symbols I’ve
loaded.

Has anybody got it working? Am I missing something obvious?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Ok, but it didn’t work for me in the first place. As I stepped into the
WppInitGlobalLogger, I found it trying to access WMI\GUID instead of
WMI{GUID}

mydrv!WppInitGlobalLogger+0x1b3:
f738f3f3 6a00 push 0x0
kd> db GRegValueName
f796ab50 57 00 4d 00 49 00 5c 00-47 00 6c 00 6f 00 62 00 W.M.I..G.l.o.b.
f796ab60 61 00 6c 00 4c 00 6f 00-67 00 67 00 65 00 72 00 a.l.L.o.g.g.e.r.
f796ab70 5c 00 61 00 63 00 63 00-37 00 66 00 32 00 65 00 .a.c.c.7.f.2.e.
f796ab80 31 00 2d 00 66 00 61 00-32 00 34 00 2d 00 34 00 1.-.f.a.2.4.-.4.
f796ab90 38 00 64 00 62 00 2d 00-62 00 64 00 63 00 30 00 8.d.b.-.b.d.c.0.
f796aba0 2d 00 65 00 36 00 61 00-63 00 62 00 64 00 30 00 -.e.6.a.c.b.d.0.
f796abb0 66 00 30 00 32 00 38 00-31 00 00 00 bb 00 00 c0 f.0.2.8.1

So I removed the enclosing braces, then my driver can send output into the
%system32%\Logfiles\wmi\trace.log and I can use traceview to see the logged
messages.

But I don’t know how to redirect the messages to KD on my host as I did in a
non-global log session. I’ve tried tracelog -start GlobalLogger -kd…but
doesn’t seem to work. Any idea?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 16, 2004 4:43 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

To use this feature requires the component to use the “Global Logger”, so
there are three things you must do.
-Build your driver to be global logging aware.
Add the following definition to the driver code

define WPP_GLOBALLOGGER

  • Start the Global Logger
    TraceLog -start GlobalLogger

-Enable your driver’s control GUID on the Global logger

Under the GlobalLogger registry key
(HKLM\System\CurrentControlSet\Control\WMI\GlobalLogger), add a key for your
GUID. Enclose the control GUID in braces ( { } ).
The Tracelog -start command adds the GlobalLogger key to the registry.
The ControlGUID key establishes the driver as provider for the Global Logger
trace session

To configure your provider add Flags as REG_DWORD value, and Level as a
REG_DWORD value.

Restart the system. This starts the global logger trace session, and the
driver logs to it every time you restart the system.

When you are done, delete your GUID key from the registry or Set the value
of the Start Entry in the GlobalLogger key to 0


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 12:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] ETW at boot time???
Hi there,
I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.
Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but was
intimidated by the ‘symbol not found’ no matter what symbols I’ve loaded.
Has anybody got it working? Am I missing something obvious?
Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

use your controlGUID to start the logger, that will switch tracing to
your logger.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 6:05 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Ok, but it didn’t work for me in the first place. As I stepped into the
WppInitGlobalLogger, I found it trying to access WMI\GUID instead of
WMI{GUID}

mydrv!WppInitGlobalLogger+0x1b3:
f738f3f3 6a00 push 0x0
kd> db GRegValueName
f796ab50 57 00 4d 00 49 00 5c 00-47 00 6c 00 6f 00 62 00
W.M.I..G.l.o.b.
f796ab60 61 00 6c 00 4c 00 6f 00-67 00 67 00 65 00 72 00
a.l.L.o.g.g.e.r.
f796ab70 5c 00 61 00 63 00 63 00-37 00 66 00 32 00 65 00
.a.c.c.7.f.2.e.
f796ab80 31 00 2d 00 66 00 61 00-32 00 34 00 2d 00 34 00
1.-.f.a.2.4.-.4.
f796ab90 38 00 64 00 62 00 2d 00-62 00 64 00 63 00 30 00
8.d.b.-.b.d.c.0.
f796aba0 2d 00 65 00 36 00 61 00-63 00 62 00 64 00 30 00
-.e.6.a.c.b.d.0.
f796abb0 66 00 30 00 32 00 38 00-31 00 00 00 bb 00 00 c0 f.0.2.8.1

So I removed the enclosing braces, then my driver can send output into
the %system32%\Logfiles\wmi\trace.log and I can use traceview to see the
logged messages.

But I don’t know how to redirect the messages to KD on my host as I did
in a non-global log session. I’ve tried tracelog -start GlobalLogger
-kd…but doesn’t seem to work. Any idea?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 16, 2004 4:43 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

To use this feature requires the component to use the “Global Logger”,
so there are three things you must do.
-Build your driver to be global logging aware.
Add the following definition to the driver code

define WPP_GLOBALLOGGER

  • Start the Global Logger
    TraceLog -start GlobalLogger

-Enable your driver’s control GUID on the Global logger

Under the GlobalLogger registry key
(HKLM\System\CurrentControlSet\Control\WMI\GlobalLogger), add a key for
your GUID. Enclose the control GUID in braces ( { } ).
The Tracelog -start command adds the GlobalLogger key to the registry.
The ControlGUID key establishes the driver as provider for the Global
Logger trace session

To configure your provider add Flags as REG_DWORD value, and Level as a
REG_DWORD value.

Restart the system. This starts the global logger trace session, and the
driver logs to it every time you restart the system.

When you are done, delete your GUID key from the registry or Set the
value of the Start Entry in the GlobalLogger key to 0


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 12:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] ETW at boot time???
Hi there,
I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.
Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but
was intimidated by the ‘symbol not found’ no matter what symbols I’ve
loaded.
Has anybody got it working? Am I missing something obvious?
Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument:
‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Thanks Jose.
I guess I want to see the output in my host debugger BEFORE the target is
fully up since my driver might have crashed the system before I can do
anything on the target. Is there any option to configure the global logger
to put message to KD by default?

Thanks again,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 17, 2004 1:38 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

use your controlGUID to start the logger, that will switch tracing to your
logger.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 6:05 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???
Ok, but it didn’t work for me in the first place. As I stepped into the
WppInitGlobalLogger, I found it trying to access WMI\GUID instead of
WMI{GUID}

mydrv!WppInitGlobalLogger+0x1b3:
f738f3f3 6a00 push 0x0
kd> db GRegValueName
f796ab50 57 00 4d 00 49 00 5c 00-47 00 6c 00 6f 00 62 00 W.M.I..G.l.o.b.
f796ab60 61 00 6c 00 4c 00 6f 00-67 00 67 00 65 00 72 00 a.l.L.o.g.g.e.r.
f796ab70 5c 00 61 00 63 00 63 00-37 00 66 00 32 00 65 00 .a.c.c.7.f.2.e.
f796ab80 31 00 2d 00 66 00 61 00-32 00 34 00 2d 00 34 00 1.-.f.a.2.4.-.4.
f796ab90 38 00 64 00 62 00 2d 00-62 00 64 00 63 00 30 00 8.d.b.-.b.d.c.0.
f796aba0 2d 00 65 00 36 00 61 00-63 00 62 00 64 00 30 00 -.e.6.a.c.b.d.0.
f796abb0 66 00 30 00 32 00 38 00-31 00 00 00 bb 00 00 c0 f.0.2.8.1

So I removed the enclosing braces, then my driver can send output into the
%system32%\Logfiles\wmi\trace.log and I can use traceview to see the logged
messages.

But I don’t know how to redirect the messages to KD on my host as I did in a
non-global log session. I’ve tried tracelog -start GlobalLogger -kd…but
doesn’t seem to work. Any idea?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 16, 2004 4:43 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

To use this feature requires the component to use the “Global Logger”, so
there are three things you must do.
-Build your driver to be global logging aware.
Add the following definition to the driver code

define WPP_GLOBALLOGGER

  • Start the Global Logger
    TraceLog -start GlobalLogger

-Enable your driver’s control GUID on the Global logger

Under the GlobalLogger registry key
(HKLM\System\CurrentControlSet\Control\WMI\GlobalLogger), add a key for your
GUID. Enclose the control GUID in braces ( { } ).
The Tracelog -start command adds the GlobalLogger key to the registry.
The ControlGUID key establishes the driver as provider for the Global Logger
trace session

To configure your provider add Flags as REG_DWORD value, and Level as a
REG_DWORD value.

Restart the system. This starts the global logger trace session, and the
driver logs to it every time you restart the system.

When you are done, delete your GUID key from the registry or Set the value
of the Start Entry in the GlobalLogger key to 0


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 12:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] ETW at boot time???
Hi there,
I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.
Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but was
intimidated by the ‘symbol not found’ no matter what symbols I’ve loaded.
Has anybody got it working? Am I missing something obvious?
Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Ok, I think my problems were:

  1. My driver starts far earlier than the storage adapter does, I guess no
    message could be written to the log at that point of time.
  2. The logged message kept getting thrown to the GlobalLogger (log file)
    until I do ‘tracelog -start MYGUID -kd’ on the target machine.

I still think that there must be a way to solve problem 2). Can anybody shed
some light?

I’d better keep DbgPrint(Ex) in my driver for now. Can the logger store the
message in memory and write it to disk later after the FSD is up?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Calvin Guan [mailto:xxxxx@ati.com]
Sent: September 17, 2004 9:54 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Thanks Jose.
I guess I want to see the output in my host debugger BEFORE the target is
fully up since my driver might have crashed the system before I can do
anything on the target. Is there any option to configure the global logger
to put message to KD by default?

Thanks again,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 17, 2004 1:38 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

use your controlGUID to start the logger, that will switch tracing to your
logger.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 6:05 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???
Ok, but it didn’t work for me in the first place. As I stepped into the
WppInitGlobalLogger, I found it trying to access WMI\GUID instead of
WMI{GUID}

mydrv!WppInitGlobalLogger+0x1b3:
f738f3f3 6a00 push 0x0
kd> db GRegValueName
f796ab50 57 00 4d 00 49 00 5c 00-47 00 6c 00 6f 00 62 00 W.M.I..G.l.o.b.
f796ab60 61 00 6c 00 4c 00 6f 00-67 00 67 00 65 00 72 00 a.l.L.o.g.g.e.r.
f796ab70 5c 00 61 00 63 00 63 00-37 00 66 00 32 00 65 00 .a.c.c.7.f.2.e.
f796ab80 31 00 2d 00 66 00 61 00-32 00 34 00 2d 00 34 00 1.-.f.a.2.4.-.4.
f796ab90 38 00 64 00 62 00 2d 00-62 00 64 00 63 00 30 00 8.d.b.-.b.d.c.0.
f796aba0 2d 00 65 00 36 00 61 00-63 00 62 00 64 00 30 00 -.e.6.a.c.b.d.0.
f796abb0 66 00 30 00 32 00 38 00-31 00 00 00 bb 00 00 c0 f.0.2.8.1

So I removed the enclosing braces, then my driver can send output into the
%system32%\Logfiles\wmi\trace.log and I can use traceview to see the logged
messages.

But I don’t know how to redirect the messages to KD on my host as I did in a
non-global log session. I’ve tried tracelog -start GlobalLogger -kd…but
doesn’t seem to work. Any idea?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 16, 2004 4:43 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

To use this feature requires the component to use the “Global Logger”, so
there are three things you must do.
-Build your driver to be global logging aware.
Add the following definition to the driver code

define WPP_GLOBALLOGGER

  • Start the Global Logger
    TraceLog -start GlobalLogger

-Enable your driver’s control GUID on the Global logger

Under the GlobalLogger registry key
(HKLM\System\CurrentControlSet\Control\WMI\GlobalLogger), add a key for your
GUID. Enclose the control GUID in braces ( { } ).
The Tracelog -start command adds the GlobalLogger key to the registry.
The ControlGUID key establishes the driver as provider for the Global Logger
trace session

To configure your provider add Flags as REG_DWORD value, and Level as a
REG_DWORD value.

Restart the system. This starts the global logger trace session, and the
driver logs to it every time you restart the system.

When you are done, delete your GUID key from the registry or Set the value
of the Start Entry in the GlobalLogger key to 0


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 12:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] ETW at boot time???
Hi there,
I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.
Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but was
intimidated by the ‘symbol not found’ no matter what symbols I’ve loaded.
Has anybody got it working? Am I missing something obvious?
Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

The macro that is auto generated for tracing by WPP (DoTraceMessage) is
defined in such a way that if you’ll do

#define WPP_DEBUG KdPrint

Every call to that macro will translate to an event trace AND a debugger
print.

This feature is not documented anywhere though, I figured it out myself from
reading the .tmh files,

So I guess it might disappear in future versions.

Shahar


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Saturday, September 18, 2004 1:25 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Ok, I think my problems were:

  1. My driver starts far earlier than the storage adapter does, I guess no
    message could be written to the log at that point of time.

  2. The logged message kept getting thrown to the GlobalLogger (log file)
    until I do ‘tracelog -start MYGUID -kd’ on the target machine.

I still think that there must be a way to solve problem 2). Can anybody shed
some light?

I’d better keep DbgPrint(Ex) in my driver for now. Can the logger store the
message in memory and write it to disk later after the FSD is up?

Thanks,

Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: Calvin Guan [mailto:xxxxx@ati.com]
Sent: September 17, 2004 9:54 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Thanks Jose.

I guess I want to see the output in my host debugger BEFORE the target is
fully up since my driver might have crashed the system before I can do
anything on the target. Is there any option to configure the global logger
to put message to KD by default?

Thanks again,

Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 17, 2004 1:38 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

use your controlGUID to start the logger, that will switch tracing to your
logger.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 6:05 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Ok, but it didn’t work for me in the first place. As I stepped into the
WppInitGlobalLogger, I found it trying to access WMI\GUID instead of
WMI{GUID}

mydrv!WppInitGlobalLogger+0x1b3:

f738f3f3 6a00 push 0x0

kd> db GRegValueName

f796ab50 57 00 4d 00 49 00 5c 00-47 00 6c 00 6f 00 62 00 W.M.I..G.l.o.b.

f796ab60 61 00 6c 00 4c 00 6f 00-67 00 67 00 65 00 72 00 a.l.L.o.g.g.e.r.

f796ab70 5c 00 61 00 63 00 63 00-37 00 66 00 32 00 65 00 .a.c.c.7.f.2.e.

f796ab80 31 00 2d 00 66 00 61 00-32 00 34 00 2d 00 34 00 1.-.f.a.2.4.-.4.

f796ab90 38 00 64 00 62 00 2d 00-62 00 64 00 63 00 30 00 8.d.b.-.b.d.c.0.

f796aba0 2d 00 65 00 36 00 61 00-63 00 62 00 64 00 30 00 -.e.6.a.c.b.d.0.

f796abb0 66 00 30 00 32 00 38 00-31 00 00 00 bb 00 00 c0 f.0.2.8.1

So I removed the enclosing braces, then my driver can send output into the
%system32%\Logfiles\wmi\trace.log and I can use traceview to see the logged
messages.

But I don’t know how to redirect the messages to KD on my host as I did in a
non-global log session. I’ve tried tracelog -start GlobalLogger -kd…but
doesn’t seem to work. Any idea?

Thanks,

Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 16, 2004 4:43 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

To use this feature requires the component to use the “Global Logger”, so
there are three things you must do.

-Build your driver to be global logging aware.

Add the following definition to the driver code

define WPP_GLOBALLOGGER

  • Start the Global Logger

TraceLog -start GlobalLogger

-Enable your driver’s control GUID on the Global logger

Under the GlobalLogger registry key

(HKLM\System\CurrentControlSet\Control\WMI\GlobalLogger), add a key for your
GUID. Enclose the control GUID in braces ( { } ).

The Tracelog -start command adds the GlobalLogger key to the registry.

The ControlGUID key establishes the driver as provider for the Global Logger
trace session

To configure your provider add Flags as REG_DWORD value, and Level as a
REG_DWORD value.

Restart the system. This starts the global logger trace session, and the
driver logs to it every time you restart the system.

When you are done, delete your GUID key from the registry or Set the value
of the Start Entry in the GlobalLogger key to 0


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 12:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] ETW at boot time???

Hi there,

I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.

Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but was
intimidated by the ‘symbol not found’ no matter what symbols I’ve loaded.

Has anybody got it working? Am I missing something obvious?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

In release builds I use ETW and in debug builds I use DbgPrint. This way I
get the best of both worlds. When I need boot up info (which In my case is
not very often) I pass out the debug version like I did before, but in the
vast majority of cases I just have them enable logging, repro the problem,
disable and email me the log.

I had to modify the sources file like so (I use w2k method for 32 bit, and
the w2003 way for 64bit)

!if “$(DEBUG_BUILD)” == “1”

no wpp on debug builds

!else

!if “$(_BUILDARCH)” == “IA64”

RUN_WPP=$(SOURCES) \

-km -dll\

-func:Debug(LEVEL,(MSG,…))

!else

!if “$(_BUILDARCH)” == “AMD64”

RUN_WPP=$(SOURCES) \

-km -dll\

-func:Debug(LEVEL,(MSG,…))

!else

must be ia32

!ifndef DO_NT_4

RUN_WPP=$(SOURCES) \

-km -dll\

-gen:{km-w2k.tpl}*.tmh \

-func:Debug(LEVEL,(MSG,…))

!endif ## nt4

!endif ## AMD64

!endif ## ia64

!endif ## debug

Thanks,

Rob

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Friday, September 17, 2004 7:25 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Ok, I think my problems were:

  1. My driver starts far earlier than the storage adapter does, I guess no
    message could be written to the log at that point of time.

  2. The logged message kept getting thrown to the GlobalLogger (log file)
    until I do ‘tracelog -start MYGUID -kd’ on the target machine.

I still think that there must be a way to solve problem 2). Can anybody shed
some light?

I’d better keep DbgPrint(Ex) in my driver for now. Can the logger store the
message in memory and write it to disk later after the FSD is up?

Thanks,

Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: Calvin Guan [mailto:xxxxx@ati.com]
Sent: September 17, 2004 9:54 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Thanks Jose.

I guess I want to see the output in my host debugger BEFORE the target is
fully up since my driver might have crashed the system before I can do
anything on the target. Is there any option to configure the global logger
to put message to KD by default?

Thanks again,

Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 17, 2004 1:38 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

use your controlGUID to start the logger, that will switch tracing to your
logger.


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 6:05 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

Ok, but it didn’t work for me in the first place. As I stepped into the
WppInitGlobalLogger, I found it trying to access WMI\GUID instead of
WMI{GUID}

mydrv!WppInitGlobalLogger+0x1b3:

f738f3f3 6a00 push 0x0

kd> db GRegValueName

f796ab50 57 00 4d 00 49 00 5c 00-47 00 6c 00 6f 00 62 00 W.M.I..G.l.o.b.

f796ab60 61 00 6c 00 4c 00 6f 00-67 00 67 00 65 00 72 00 a.l.L.o.g.g.e.r.

f796ab70 5c 00 61 00 63 00 63 00-37 00 66 00 32 00 65 00 .a.c.c.7.f.2.e.

f796ab80 31 00 2d 00 66 00 61 00-32 00 34 00 2d 00 34 00 1.-.f.a.2.4.-.4.

f796ab90 38 00 64 00 62 00 2d 00-62 00 64 00 63 00 30 00 8.d.b.-.b.d.c.0.

f796aba0 2d 00 65 00 36 00 61 00-63 00 62 00 64 00 30 00 -.e.6.a.c.b.d.0.

f796abb0 66 00 30 00 32 00 38 00-31 00 00 00 bb 00 00 c0 f.0.2.8.1

So I removed the enclosing braces, then my driver can send output into the
%system32%\Logfiles\wmi\trace.log and I can use traceview to see the logged
messages.

But I don’t know how to redirect the messages to KD on my host as I did in a
non-global log session. I’ve tried tracelog -start GlobalLogger -kd…but
doesn’t seem to work. Any idea?

Thanks,

Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com

-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: September 16, 2004 4:43 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] ETW at boot time???

To use this feature requires the component to use the “Global Logger”, so
there are three things you must do.

-Build your driver to be global logging aware.

Add the following definition to the driver code

define WPP_GLOBALLOGGER

  • Start the Global Logger

TraceLog -start GlobalLogger

-Enable your driver’s control GUID on the Global logger

Under the GlobalLogger registry key

(HKLM\System\CurrentControlSet\Control\WMI\GlobalLogger), add a key for your
GUID. Enclose the control GUID in braces ( { } ).

The Tracelog -start command adds the GlobalLogger key to the registry.

The ControlGUID key establishes the driver as provider for the Global Logger
trace session

To configure your provider add Flags as REG_DWORD value, and Level as a
REG_DWORD value.

Restart the system. This starts the global logger trace session, and the
driver logs to it every time you restart the system.

When you are done, delete your GUID key from the registry or Set the value
of the Start Entry in the GlobalLogger key to 0


From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Calvin Guan
Sent: Thursday, September 16, 2004 12:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] ETW at boot time???

Hi there,

I was told I could view boot-time ETW messages but I couldn’t find any
information how to do that.

Currently I can’t see ETW message until I started a trace session on the
target system. I’d played with the wmitrace.dll dbgext for sometime but was
intimidated by the ‘symbol not found’ no matter what symbols I’ve loaded.

Has anybody got it working? Am I missing something obvious?

Thanks,
Calvin

Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com