question on persisting WPP tracing using Autologger across reboots

NTFSD
1

Hi,

I am using WPP logging from my minifilter and am setting it up using
Autologger. I find that it is not persisted across reboots. The file is
cleaned up every time the machine is restarted. I am tying to find out
options to have a behavior which enables circular logging with a file size.

I have tried the following LogFileMode options mentioned in the msdn
article (http://msdn.microsoft.com/en-us/library/aa364080(v=vs.85).aspx):

  1. EVENT_TRACE_FILE_MODE_CIRCULAR: this is a circular log and I can specify
    a MaxFileSize after which it writes in a circular fashion. This is what I
    would like to get but with persistence across reboots.

  2. EVENT_TRACE_FILE_MODE_APPEND | EVENT_TRACE_FILE_MODE_SEQUENTIAL: This is
    persisted across reboots but as per documentation logging stops when the
    maximum size is reached.

  3. EVENT_TRACE_FILE_MODE_NEWFILE: I could work with this but this is not
    allowed for AutoLogger mechanism as per documentation and a trial shows
    that it doesn’t work.

  4. Using MaxFileSize and FileMax: this could work but unfortunately a new
    log is created on every reboot, not when the MaxFileSize is reached.

I basically need EVENT_TRACE_FILE_MODE_CIRCULAR with persistence. Is this
possible with AutoLogger ?

Thanks,

2

Ping. I think this should be a commonly encountered issue but couldn’t find
anything on the net and the documentation is not very clear.
Experimentation shows the EVENT_TRACE_FILE_MODE_APPEND |
EVENT_TRACE_FILE_MODE_SEQUENTIAL does what I want but the tracing stops
when the size limit is reached. The only option seems to be to keep an
unlimited size which is unclean.

Any help would be greatly appreciated.

Thanks,

On Tue, Jan 6, 2015 at 11:00 PM, Arun M. Krishnakumar
wrote:

> Hi,
>
> I am using WPP logging from my minifilter and am setting it up using
> Autologger. I find that it is not persisted across reboots. The file is
> cleaned up every time the machine is restarted. I am tying to find out
> options to have a behavior which enables circular logging with a file size.
>
> I have tried the following LogFileMode options mentioned in the msdn
> article (http://msdn.microsoft.com/en-us/library/aa364080(v=vs.85).aspx):
>
> 1. EVENT_TRACE_FILE_MODE_CIRCULAR: this is a circular log and I can
> specify a MaxFileSize after which it writes in a circular fashion. This
> is what I would like to get but with persistence across reboots.
>
> 2. EVENT_TRACE_FILE_MODE_APPEND | EVENT_TRACE_FILE_MODE_SEQUENTIAL: This
> is persisted across reboots but as per documentation logging stops when the
> maximum size is reached.
>
> 3. EVENT_TRACE_FILE_MODE_NEWFILE: I could work with this but this is not
> allowed for AutoLogger mechanism as per documentation and a trial shows
> that it doesn’t work.
>
> 4. Using MaxFileSize and FileMax: this could work but unfortunately a new
> log is created on every reboot, not when the MaxFileSize is reached.
>
> I basically need EVENT_TRACE_FILE_MODE_CIRCULAR with persistence. Is this
> possible with AutoLogger ?
>
>
> Thanks,
>
>