WPP trace order question

NTDEV
1

Hello. I’ve noticed something strange about the ordering of my WPP traces,
at least using traceview 2.0.14. Sometimes, rarely, I see my “DriverUnload”
trace precede my “WMIUnregister” trace. Clearly, unregistering for WMI
takes place at remove device time, well before driver unload. I’m using
traceview to monitor my traces. Has anyone seen this? I quickly scanned
the archives, but did not find a discussion on this aspect (I hope I did not
miss it).

I understand that the traces are not synchronous, but I would have thought
that ordering was preserved. Not sure if this is relevant, but I noticed
that the trace which was obviously out of order was on another CPU (as
reported by traceview 2.0.14). Any ideas on why this ordering is not being
kept?

thanks,

Philip Lukidis < mailto:xxxxx@guillemot.com>
Software Engineer - Guillemot R&D inc. http://www.guillemot.com
Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558
5800 St-Denis, Suite 1102, Montreal, Quebec, H2S 3L5, Canada

2

This a happens on XP systems and it does not in W2K3.

The problem happens when processing the trace file(etl) to view the
events, this is a bug that will be fixed in the next XP SP.

If you view the file in W2K3 you will not see the events out of order.

If you get this effect which is very obvious by looking at the
Sequence# column of traceview, you can sort the events.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Philip Lukidis
Sent: Wednesday, September 29, 2004 11:14 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] WPP trace order question

Hello. I’ve noticed something strange about the ordering of my WPP
traces, at least using traceview 2.0.14. Sometimes, rarely, I see my
“DriverUnload”
trace precede my “WMIUnregister” trace. Clearly, unregistering for WMI
takes place at remove device time, well before driver unload. I’m using
traceview to monitor my traces. Has anyone seen this? I quickly
scanned the archives, but did not find a discussion on this aspect (I
hope I did not miss it).

I understand that the traces are not synchronous, but I would have
thought that ordering was preserved. Not sure if this is relevant, but
I noticed that the trace which was obviously out of order was on another
CPU (as reported by traceview 2.0.14). Any ideas on why this ordering
is not being kept?

thanks,

Philip Lukidis < mailto:xxxxx@guillemot.com> Software Engineer -
Guillemot R&D inc. http://www.guillemot.com
Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558 5800 St-Denis, Suite
1102, Montreal, Quebec, H2S 3L5, Canada

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thanks for your very fast reply. Like you say, traceview viewing is not a
big problem, but in the future when we start getting feedback from customers
in the field, we’ll have a server 2k3 machine up and running to view the log
files.

thanks,

Philip Lukidis < mailto:xxxxx@guillemot.com>
Software Engineer - Guillemot R&D inc. http://www.guillemot.com
Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558
5800 St-Denis, Suite 1102, Montreal, Quebec, H2S 3L5, Canada

-----Original Message-----
From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
Sent: Wednesday, September 29, 2004 3:02 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] WPP trace order question

This a happens on XP systems and it does not in W2K3.

The problem happens when processing the trace file(etl) to view the
events, this is a bug that will be fixed in the next XP SP.

If you view the file in W2K3 you will not see the events out of order.

If you get this effect which is very obvious by looking at the
Sequence# column of traceview, you can sort the events.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Philip Lukidis
Sent: Wednesday, September 29, 2004 11:14 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] WPP trace order question

Hello. I’ve noticed something strange about the ordering of my WPP
traces, at least using traceview 2.0.14. Sometimes, rarely, I see my
“DriverUnload”
trace precede my “WMIUnregister” trace. Clearly, unregistering for WMI
takes place at remove device time, well before driver unload. I’m using
traceview to monitor my traces. Has anyone seen this? I quickly
scanned the archives, but did not find a discussion on this aspect (I
hope I did not miss it).

I understand that the traces are not synchronous, but I would have
thought that ordering was preserved. Not sure if this is relevant, but
I noticed that the trace which was obviously out of order was on another
CPU (as reported by traceview 2.0.14). Any ideas on why this ordering
is not being kept?

thanks,

Philip Lukidis < mailto:xxxxx@guillemot.com> Software Engineer -
Guillemot R&D inc. http://www.guillemot.com
Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558 5800 St-Denis, Suite
1102, Montreal, Quebec, H2S 3L5, Canada

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Have Traceview sort the messages by time and not by message number which is
the default.

–Mark

–
Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/
“Philip Lukidis” wrote in message
news:xxxxx@ntdev…
> Thanks for your very fast reply. Like you say, traceview viewing is not a
> big problem, but in the future when we start getting feedback from
> customers
> in the field, we’ll have a server 2k3 machine up and running to view the
> log
> files.
>
> thanks,
>
> Philip Lukidis < mailto:xxxxx@guillemot.com>
> Software Engineer - Guillemot R&D inc. http://www.guillemot.com
> Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558
> 5800 St-Denis, Suite 1102, Montreal, Quebec, H2S 3L5, Canada
>
>
> -----Original Message-----
> From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
> Sent: Wednesday, September 29, 2004 3:02 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] WPP trace order question
>
>
> This a happens on XP systems and it does not in W2K3.
>
> The problem happens when processing the trace file(etl) to view the
> events, this is a bug that will be fixed in the next XP SP.
>
> If you view the file in W2K3 you will not see the events out of order.
>
> If you get this effect which is very obvious by looking at the
> Sequence# column of traceview, you can sort the events.
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Philip Lukidis
> Sent: Wednesday, September 29, 2004 11:14 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] WPP trace order question
>
> Hello. I’ve noticed something strange about the ordering of my WPP
> traces, at least using traceview 2.0.14. Sometimes, rarely, I see my
> “DriverUnload”
> trace precede my “WMIUnregister” trace. Clearly, unregistering for WMI
> takes place at remove device time, well before driver unload. I’m using
> traceview to monitor my traces. Has anyone seen this? I quickly
> scanned the archives, but did not find a discussion on this aspect (I
> hope I did not miss it).
>
> I understand that the traces are not synchronous, but I would have
> thought that ordering was preserved. Not sure if this is relevant, but
> I noticed that the trace which was obviously out of order was on another
> CPU (as reported by traceview 2.0.14). Any ideas on why this ordering
> is not being kept?
>
> thanks,
>
> Philip Lukidis < mailto:xxxxx@guillemot.com> Software Engineer -
> Guillemot R&D inc. http://www.guillemot.com
> Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558 5800 St-Denis, Suite
> 1102, Montreal, Quebec, H2S 3L5, Canada
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@microsoft.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

5

You’re right of course for traceview. Sorting by sequence number instead of
the default message number does the trick.

I was more worried about logfiles gathered on customer machines, but
apparently that problem can be solved as Jose Sua mentioned, by viewing on
server 2k3. Traditionally, as none of our customers use server OS, I’ve
never used server 2k3 except for briefly testing my driver (with CUV in
particular). That will change now.

thanks,

Philip Lukidis < mailto:xxxxx@guillemot.com>
Software Engineer - Guillemot R&D inc. http://www.guillemot.com
Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558
5800 St-Denis, Suite 1102, Montreal, Quebec, H2S 3L5, Canada

-----Original Message-----
From: Mark Cariddi [mailto:xxxxx@osr.com]
Sent: Wednesday, September 29, 2004 4:35 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] WPP trace order question

Have Traceview sort the messages by time and not by message number which is
the default.

–Mark

–
Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/
“Philip Lukidis” wrote in message
news:xxxxx@ntdev…
> Thanks for your very fast reply. Like you say, traceview viewing is not a
> big problem, but in the future when we start getting feedback from
> customers
> in the field, we’ll have a server 2k3 machine up and running to view the
> log
> files.
>
> thanks,
>
> Philip Lukidis < mailto:xxxxx@guillemot.com>
> Software Engineer - Guillemot R&D inc. http://www.guillemot.com
> Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558
> 5800 St-Denis, Suite 1102, Montreal, Quebec, H2S 3L5, Canada
>
>
> -----Original Message-----
> From: Jose Sua [mailto:xxxxx@windows.microsoft.com]
> Sent: Wednesday, September 29, 2004 3:02 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] WPP trace order question
>
>
> This a happens on XP systems and it does not in W2K3.
>
> The problem happens when processing the trace file(etl) to view the
> events, this is a bug that will be fixed in the next XP SP.
>
> If you view the file in W2K3 you will not see the events out of order.
>
> If you get this effect which is very obvious by looking at the
> Sequence# column of traceview, you can sort the events.
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Philip Lukidis
> Sent: Wednesday, September 29, 2004 11:14 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] WPP trace order question
>
> Hello. I’ve noticed something strange about the ordering of my WPP
> traces, at least using traceview 2.0.14. Sometimes, rarely, I see my
> “DriverUnload”
> trace precede my “WMIUnregister” trace. Clearly, unregistering for WMI
> takes place at remove device time, well before driver unload. I’m using
> traceview to monitor my traces. Has anyone seen this? I quickly
> scanned the archives, but did not find a discussion on this aspect (I
> hope I did not miss it).
>
> I understand that the traces are not synchronous, but I would have
> thought that ordering was preserved. Not sure if this is relevant, but
> I noticed that the trace which was obviously out of order was on another
> CPU (as reported by traceview 2.0.14). Any ideas on why this ordering
> is not being kept?
>
> thanks,
>
> Philip Lukidis < mailto:xxxxx@guillemot.com> Software Engineer -
> Guillemot R&D inc. http://www.guillemot.com
> Tel: (514) 279-9960 ext:4111 Fax: (514) 279-2558 5800 St-Denis, Suite
> 1102, Montreal, Quebec, H2S 3L5, Canada
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@microsoft.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@guillemot.com
To unsubscribe send a blank email to xxxxx@lists.osr.com