I added wpp to fs project(windows xp).when system crashed, I wanted to get the wpp Trace output via windbg.but I failed.
(1)
windbg version: 6.5.0003.7.
kd> .sympath
Symbol search path is: srv*DownstreamStore*http://msdl.microsoft.com/download/symbols
kd> !load wmitrace
kd> !wmitrace.strdump
(WmiTracing)StrDump Generic
LoggerContext Array @ 0x8055AD80 [64 Elements]
Logger Id 2 @ 0x80F9E000 Named ‘’
kd> !wmitrace.logsave 2
WMI Trace Save: Debugger Extension. LoggerId = 2, Save File = ‘LogData.elg’
LoggerMode is 0
unable to get NT!EtwCPUSpeedInMHz
unable to get NT!EtwpBootTime
unable to get NT!EtwPerfFreq
Unable to determine buffer mechanism. Check for complete symbol availability.
Saved 0 Buffers
kd> lm
start end module name
804d8000 806ce100 nt (pdb symbols) DownstreamStore\ntkrnlpa.pdb\BD8F451F3E754ED8A34B50560CEB08E31\ntkrnlpa.pdb
806cf000 806ef380 hal (deferred)
…
(is there no symbol of NT!EtwCPUSpeedInMHz?where can i find it?)
(2)
windbg version: 6.8.0004.0
kd> !load wmitrace
kd> !wmitrace.strdump
(WmiTracing)StrDump Generic
LoggerContext Array @ 0x8055AD80 [0 Elements]
kd> !wmitrace.logsave 2 c:\like.txt
WMI Trace Save: Debugger Extension. LoggerId = 2, Save File = ‘c:\like.txt’
Failed to Find Logger
Is there somthing wrong with my methods?