For event logging in a production driver, I’d recommend ETW tracing. One
major advantage of ETW tracing is you can enable a variety of different ETW
event providers and get unified timing across all the providers. It helps
debugging in end user environments to see selectable other trace data along
with the data from your driver. Your text log file will only have events for
your driver.
ETW event writes can also happen at higher IRQL levels. You will have to
write to memory buffers and then have a worker thread that flushes them out
to a disk file if you do this yourself. Look at the IRQL limitations on the
file write API’s.
ETW data is also structured, which when you generate large logs becomes
important for analysis. Looking at a gigabyte text log is not much fun, but
loading the ETW events into a database, and filtering them based on event
patterns or time is doable.
People doing OS support also know how to create ETW logs, and will not
instantly know to deal with your custom logs.
ETW logs also store the raw data, so don’t have the performance overhead of
printf style formatting generally used for text logs. This can make a big
difference if you’re debugging performance issues.
There is a tool in the Windows SDK for making ETW manifest files. I believe
there are samples of ETW driver tracing in the WDK. Making ETW tracing takes
a little extra time upfront, like a day of development fiddling, but then
gives benefits afterwards. It would be nice of the WDK just came with
precreated ETW tracing files that allowed you to output text strings, so the
initial time to use it would be almost nothing to get a “hello world” trace
event.
There are a number of viewers for ETW trace files, I’ve been using Microsoft
Network Monitor 3.4 recently, because I’ve been debugging networks and it’s
very handy to have trace events interleaved with network packets, which are
decoded by Network Monitor. Anybody know where I can find the ETW Ethernet
packet record definitions, so I can make my device spit out ETW packet
events that Network Monitor will decode? I actually LOVE to be able to spit
out ETW packet events with extra meta data (like the packet OOB data).
I suppose a downside of ETW tracing is I think it’s not (or is poorly)
supported in pre Vista OS’s.
Jan
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Sarbojit Sarkar
Sent: Thursday, August 19, 2010 3:25 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] To get logs in kernel driver, is file writing is the good
choice?
Hi,
I am developing display driver. I wanted to add logs in driver so that it
will get to know if any thing went wrong in release mode of driver. I am
planning for file writing. Is there any better way than this? If yes, please
let me know.
As file writing is the only option that I know, I am planning to use
ZwCreateFile(),ZwWriteFile()… APIs but I am confused between
CreateFile() and ZwCreateFile(), because I want to log function calls in the
.DLL not in .SYS.
May be my doubt is very basic but please help me to get it cleared.
/sarbojit
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and
other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the
List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer