questions about WPP tracing

WINDBG
1

My driver is instrumented with TraceEvents, but I’m considering
replacing them all with simple KDPrints. TraceView seems to be quite
difficult to use. The only way I can get it to log anything is to point
it at my PDB file (manually entering my guid looks like it works, but
then nothing gets logged), set the “Flags and Level” to verbose (I want
all logging turned on), then run my driver. Each time I recompile my
driver, though, I have to go through this whole process again. I tried
saving and reloading my workspace, but nothing get logged when I do
that. The only way to get TraceView to give me any output is to create a
new workspace each time I recompile.
Is this behavior expected? Is there some easier way to do this? Is there
an easy way to route all trace messages to DbgView or WinDbg? I would
really like to see the messages in DbgView, because then they would be
interleaved with the logging from my usermode app that controls my driver.

Thanks,
–Jeremy

2

Well if you

#define WPP_DEBUG(m) KdPrint(m)

You will basically turn the trace statements into debug print statements,
and still allow them to be used with TraceView. The behavior you describe
is expected, because the data for tracing is pulled out of the PDB so it has
to match the compiled driver.

–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

“Jeremy Chaney” wrote in message
news:xxxxx@windbg…
> My driver is instrumented with TraceEvents, but I’m considering replacing
> them all with simple KDPrints. TraceView seems to be quite difficult to
> use. The only way I can get it to log anything is to point it at my PDB
> file (manually entering my guid looks like it works, but then nothing gets
> logged), set the “Flags and Level” to verbose (I want all logging turned
> on), then run my driver. Each time I recompile my driver, though, I have
> to go through this whole process again. I tried saving and reloading my
> workspace, but nothing get logged when I do that. The only way to get
> TraceView to give me any output is to create a new workspace each time I
> recompile.
> Is this behavior expected? Is there some easier way to do this? Is there
> an easy way to route all trace messages to DbgView or WinDbg? I would
> really like to see the messages in DbgView, because then they would be
> interleaved with the logging from my usermode app that controls my driver.
>
> Thanks,
> --Jeremy
>

3

Is there some way to get TraceView to reload the PDB without having to
create a new workspace?
–Jeremy

Don Burn wrote:

Well if you

#define WPP_DEBUG(m) KdPrint(m)

You will basically turn the trace statements into debug print statements,
and still allow them to be used with TraceView. The behavior you describe
is expected, because the data for tracing is pulled out of the PDB so it has
to match the compiled driver.

4

Yes there is

You can use the command line tools instead.

With simple cmd files you can enable/disable tracing and view the
corresponding log file.

The trace tools are part of the WDK/DDK:
Tracelog.exe
Tracepdb.exe
Tracefmt.exe

Here is a simple cmd file:

del *.tmf
tracelog.exe -start mySession -guid #mycontrolguid -f tracefile.log
-flags FLAGS -level Level

This will start a trace session called mySession and it will enable the
mycontrolguid with flags=FLAGS and level=LEVEL. The flags are the ones
you define in WPP_CONTROL_GUIDS, this parameter can be a file instead
of a single guid.
See MSDN for all the options.

You can also use Logman to start the trace session, the tool is part of
the OS.

Then run your driver.

Tracelog -stop mySession

To view the events:

Tracepdb -f driver.pdb // you can provide the path where the pdb for the
driver is, and the destination. See tracepdb documentation

This command will decode the tracefile
tracefmt -display -p . tracefile.log // here the path to the TMF
files is in the same local directory but you can change that.

You can have a script that generates the TMF files out of the PDB as
part of yuou build process.

Thanks,

Jose Sua

Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeremy Chaney
Sent: Tuesday, September 05, 2006 11:16 AM
To: Kernel Debugging Interest List
Subject: Re:[windbg] questions about WPP tracing

Is there some way to get TraceView to reload the PDB without having to
create a new workspace?
–Jeremy

Don Burn wrote:

Well if you

#define WPP_DEBUG(m) KdPrint(m)

You will basically turn the trace statements into debug print
statements,
and still allow them to be used with TraceView. The behavior you
describe
is expected, because the data for tracing is pulled out of the PDB so
it has
to match the compiled driver.

You are currently subscribed to windbg as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

ok. Thank you. I may use this method for some of my testing. What are my
options, though, for seeing the messages real-time?
Thanks,
–Jeremy

Jose Sua wrote:

Yes there is

You can use the command line tools instead.

With simple cmd files you can enable/disable tracing and view the
corresponding log file.

The trace tools are part of the WDK/DDK:
Tracelog.exe
Tracepdb.exe
Tracefmt.exe

Here is a simple cmd file:

del *.tmf
tracelog.exe -start mySession -guid #mycontrolguid -f tracefile.log
-flags FLAGS -level Level

This will start a trace session called mySession and it will enable the
mycontrolguid with flags=FLAGS and level=LEVEL. The flags are the ones
you define in WPP_CONTROL_GUIDS, this parameter can be a file instead
of a single guid.
See MSDN for all the options.

You can also use Logman to start the trace session, the tool is part of
the OS.

Then run your driver.

Tracelog -stop mySession

To view the events:

Tracepdb -f driver.pdb // you can provide the path where the pdb for the
driver is, and the destination. See tracepdb documentation

This command will decode the tracefile
tracefmt -display -p . tracefile.log // here the path to the TMF
files is in the same local directory but you can change that.

You can have a script that generates the TMF files out of the PDB as
part of yuou build process.

Thanks,

Jose Sua

Microsoft Corporation

This posting is provided “AS IS” with no warranties and confers no
rights.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeremy Chaney
Sent: Tuesday, September 05, 2006 11:16 AM
To: Kernel Debugging Interest List
Subject: Re:[windbg] questions about WPP tracing

Is there some way to get TraceView to reload the PDB without having to
create a new workspace?
–Jeremy

Don Burn wrote:
> Well if you
>
> #define WPP_DEBUG(m) KdPrint(m)
>
> You will basically turn the trace statements into debug print
statements,
> and still allow them to be used with TraceView. The behavior you
describe
> is expected, because the data for tracing is pulled out of the PDB so
it has
> to match the compiled driver.
>
>

You are currently subscribed to windbg as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

6

Take a look at all the options for the tools on MSDN

Tracelog -rt // creates a real-time session, need to include all the
other options tracelog -? For all the options

Tracefmt -rt // tracefmt -? For all the options

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Jeremy Chaney
Sent: Tuesday, September 05, 2006 3:56 PM
To: Kernel Debugging Interest List
Subject: Re:[windbg] questions about WPP tracing

ok. Thank you. I may use this method for some of my testing. What are my
options, though, for seeing the messages real-time?
Thanks,
–Jeremy

Jose Sua wrote:
> Yes there is
>
> You can use the command line tools instead.
>
> With simple cmd files you can enable/disable tracing and view the
> corresponding log file.
>
> The trace tools are part of the WDK/DDK:
> Tracelog.exe
> Tracepdb.exe
> Tracefmt.exe
>
>
> Here is a simple cmd file:
>
>
> del *.tmf
> tracelog.exe -start mySession -guid #mycontrolguid -f tracefile.log
> -flags FLAGS -level Level
>
> This will start a trace session called mySession and it will enable
the
> mycontrolguid with flags=FLAGS and level=LEVEL. The flags are the ones
> you define in WPP_CONTROL_GUIDS, this parameter can be a file instead
> of a single guid.
> See MSDN for all the options.
>
> You can also use Logman to start the trace session, the tool is part
of
> the OS.
>
> Then run your driver.
>
> Tracelog -stop mySession
>
>
> To view the events:
>
>
> Tracepdb -f driver.pdb // you can provide the path where the pdb for
the
> driver is, and the destination. See tracepdb documentation
>
> This command will decode the tracefile
> tracefmt -display -p . tracefile.log // here the path to the TMF
> files is in the same local directory but you can change that.
>
> You can have a script that generates the TMF files out of the PDB as
> part of yuou build process.
>
> Thanks,
>
> Jose Sua
>
> Microsoft Corporation
>
>
> This posting is provided “AS IS” with no warranties and confers no
> rights.
>
>
>
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Jeremy Chaney
> Sent: Tuesday, September 05, 2006 11:16 AM
> To: Kernel Debugging Interest List
> Subject: Re:[windbg] questions about WPP tracing
>
> Is there some way to get TraceView to reload the PDB without having to
> create a new workspace?
> --Jeremy
>
>
> Don Burn wrote:
>> Well if you
>>
>> #define WPP_DEBUG(m) KdPrint(m)
>>
>> You will basically turn the trace statements into debug print
> statements,
>> and still allow them to be used with TraceView. The behavior you
> describe
>> is expected, because the data for tracing is pulled out of the PDB so
> it has
>> to match the compiled driver.
>>
>>
>
> —
> You are currently subscribed to windbg as:
xxxxx@windows.microsoft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

—
You are currently subscribed to windbg as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com