diff options
| author | Barry Golden <[email protected]> | 2019-09-18 19:11:43 -0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2019-09-18 19:11:43 -0700 |
| commit | 1238743debbcd302221eb77842053bfcea46656f (patch) | |
| tree | ff233ee38714af0d4912c84976e43846fcec32bb /general/tracing | |
| parent | 76ec9d210b0668d558f4a6ed5a82978fa65326ba (diff) | |
Diffstat (limited to 'general/tracing')
| -rw-r--r-- | general/tracing/SystemTraceControl/README.md | 17 | ||||
| -rw-r--r-- | general/tracing/evntdrv/README.md | 45 | ||||
| -rw-r--r-- | general/tracing/tracedriver/README.md | 38 |
3 files changed, 28 insertions, 72 deletions
diff --git a/general/tracing/SystemTraceControl/README.md b/general/tracing/SystemTraceControl/README.md index ff5e52f6..009df087 100644 --- a/general/tracing/SystemTraceControl/README.md +++ b/general/tracing/SystemTraceControl/README.md @@ -8,23 +8,12 @@ products: - windows-wdk --- - - -<!--- - name: System Trace Control - platform: Application - language: cpp - category: General Tracing - description: Demonstrates how to use event tracing control APIs to collect events from the system trace provider. - samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617725 ----> - # SystemTraceProvider This sample application demonstrates how to use event tracing control APIs to collect events from the system trace provider. -The sample code provided shows how to start an [Event Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/bb968803) for Windows trace session and how to enable system events with stacks. When you build and run the application, it collects the trace data for 30 seconds and then stops. The sample application writes the results to a file, Systemtrace.etl. For more information, see [Tools for Software Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/ff552961). +The sample code provided shows how to start an [Event Tracing]https://docs.microsoft.com/windows/win32/etw/event-tracing-portal) for Windows trace session and how to enable system events with stacks. When you build and run the application, it collects the trace data for 30 seconds and then stops. The sample application writes the results to a file, Systemtrace.etl. For more information, see [Tools for Software Tracing](https://docs.microsoft.com/windows-hardware/drivers/devtest/tools-for-software-tracing). -You can process the Systemtrace.etl file using Tracerpt.exe, a command-line trace tool included in Windows that formats trace events. It also analyzes the events and generates summary reports. For more information about how to use this tool, see [Tracerpt](http://go.microsoft.com/fwlink/p/?linkid=179389) topic on the TechNet website. +You can process the Systemtrace.etl file using Tracerpt.exe, a command-line trace tool included in Windows that formats trace events. It also analyzes the events and generates summary reports. For more information about how to use this tool, see [Tracerpt](https://docs.microsoft.com/windows-server/administration/windows-commands/tracerpt_1). -You can also process the file using the [Windows Performance Toolkit](http://go.microsoft.com/fwlink/p/?linkid=250774) (WPT), which is available in the SDK. +You can also process the file using the [Windows Performance Toolkit](https://docs.microsoft.com/windows-hardware/test/wpt/) (WPT), which is available in the SDK. diff --git a/general/tracing/evntdrv/README.md b/general/tracing/evntdrv/README.md index bc7c5cba..392681f1 100644 --- a/general/tracing/evntdrv/README.md +++ b/general/tracing/evntdrv/README.md @@ -8,36 +8,25 @@ products: - windows-wdk --- - - -<!--- - name: Eventdrv - platform: Application - language: cpp - category: General Tracing - description: Demonstrates the use of the Event Tracing for Windows (ETW) API in a driver. - samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617724 ----> - # Eventdrv -Eventdrv is a sample kernel-mode trace provider and driver. The driver does not control any hardware; it simply generates trace events. It is designed to demonstrate the use of the [Event Tracing for Windows (ETW)](http://msdn.microsoft.com/en-us/library/windows/hardware/ff545699) API in a driver. +Eventdrv is a sample kernel-mode trace provider and driver. The driver does not control any hardware; it simply generates trace events. It is designed to demonstrate the use of the [Event Tracing for Windows (ETW)](https://docs.microsoft.com/windows-hardware/drivers/devtest/event-tracing-for-windows--etw-) API in a driver. -Evntdrv registers as a provider by calling the [**EtwRegister**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff545603) API. If the registration is successful, it logs a StartEvent with the device's name, the length of the name, and the status code. Then, when the sample receives a DeviceIOControl call, it logs a SampleEventA event. Finally, when the driver gets unloaded, it logs an UnloadEvent event with a pointer to the device object +Evntdrv registers as a provider by calling the [**EtwRegister**](https://docs.microsoft.com/windows-hardware/drivers/ddi/content/wdm/nf-wdm-etwregister) API. If the registration is successful, it logs a StartEvent with the device's name, the length of the name, and the status code. Then, when the sample receives a DeviceIOControl call, it logs a SampleEventA event. Finally, when the driver gets unloaded, it logs an UnloadEvent event with a pointer to the device object -**Note** The Windows Pre-Processor (WPP) Tracing tools such as TraceView.exe cannot be used to start, stop, or view traces. +> [!NOTE] +> The Windows Pre-Processor (WPP) Tracing tools such as TraceView.exe cannot be used to start, stop, or view traces. ## Run the sample 1. Install the manifest (Evntdrv.xml), which is located in the Evntdrv\\Eventdrv folder. Open a Visual Studio Command window (Run as administrator) and use the following command: - ``` - wevtutil im evntdrv.xml - ``` + `wevtutil im evntdrv.xml` Installing the manifest creates registry keys that enable tools to find the resource and message files that contain event provider information. For further details about the WevtUtil.exe tool, see the MSDN Library. - - **Note** Using a Visual Studio Command windows sets up the environment variables you need to run the tracing tools for this sample. + + > [!NOTE] + > Using a Visual Studio Command windows sets up the environment variables you need to run the tracing tools for this sample. 1. Make a folder in the system directory called ETWDriverSample (for example, C:\\ETWDriverSample). @@ -47,32 +36,24 @@ Evntdrv registers as a provider by calling the [**EtwRegister**](http://msdn.mic 1. Use Tracelog to start a trace session that is called "TestEventdrv." The following command starts the trace session and creates a trace log file, Eventdrv.etl, in the local directory. - ``` - Tracelog -start TestEventdrv -guid #b5a0bda9-50fe-4d0e-a83d-bae3f58c94d6 -f Eventdrv.etl - ``` + `tracelog -start TestEventdrv -guid #b5a0bda9-50fe-4d0e-a83d-bae3f58c94d6 -f Eventdrv.etl` 1. To generate trace messages, run Evntctrl.exe. Each time you type a character other than **Q** or **q**, Evntctrl sends an IOCTL to the driver that signals it to generate trace messages. To stop Evntctrl, type **Q** or **q**. 1. To stop the trace session, run the following command: - ``` - tracelog -stop TestEventdrv - ``` + `tracelog -stop TestEventdrv` 1. To display the traces collected in the Tracedrv.etl file, run the following command: - ``` - tracerpt Eventdrv.etl - ``` + `tracerpt Eventdrv.etl` This command creates two files: Summary.txt and Dumpfile.xml. Dumpfile.xml will contain the event information in an XML format. 1. To uninstall the manifest, run the following command: - ``` - wevtutil um evntdrv.xml - ``` + `wevtutil um evntdrv.xml` ## Notes -If you are building the Eventdrv sample to test on a 64-bit version of Windows, you need to sign the driver. All 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202). +If you are building the Eventdrv sample to test on a 64-bit version of Windows, you need to sign the driver. All 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](https://docs.microsoft.com/windows-hardware/drivers/develop/signing-a-driver) and [Signing a Driver During Development and Testing](https://docs.microsoft.com/windows-hardware/drivers/install/signing-drivers-during-development-and-test). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](https://docs.microsoft.com/windows-hardware/drivers/install/the-testsigning-boot-configuration-option) and [**BCDEdit /set**](https://docs.microsoft.com/windows-hardware/drivers/devtest/bcdedit--set). diff --git a/general/tracing/tracedriver/README.md b/general/tracing/tracedriver/README.md index 17f9e04f..3d32e0b6 100644 --- a/general/tracing/tracedriver/README.md +++ b/general/tracing/tracedriver/README.md @@ -8,33 +8,23 @@ products: - windows-wdk --- - - -<!--- - name: Tracedrv - platform: Application - language: cpp - category: General Tracing - description: A sample driver instrumented for software tracing. - samplefwlink: http://go.microsoft.com/fwlink/p/?LinkId=617726 ----> - # Tracedrv Tracedrv is a sample driver instrumented for software tracing. The driver does not control any hardware; it simply generates trace messages. It is designed to show how to use WPP software tracing macros in a driver. Tracedrv initializes tracing (by using WPP\_INIT\_TRACING) and, when it receives a DeviceIOControl call, it starts a thread that logs 100 trace messages. The WPP software tracing directives, calls, and macros in the code are accompanied by comments that explain their purpose -While examining Tracedrv, read the [WPP Software Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/ff556204) in the Windows Driver Kit (WDK). This section includes a reference section that describes the directives, macros, and calls required for WPP software tracing. +While examining Tracedrv, read the [WPP Software Tracing](https://docs.microsoft.com/windows-hardware/drivers/devtest/wpp-software-tracing) in the Windows Driver Kit (WDK). This section includes a reference section that describes the directives, macros, and calls required for WPP software tracing. ## Run the sample To test the Tracedrv event tracing provider, use the following procedure. 1. Copy the Tracectl.exe file that was created when you built the Tracedrv solution from the Tracectl directory (for example, \\Documents\\Visual Studio 2015\\Projects\\tracedrv\\tracectl\\*platform*) to the Tracedrv directory (for example, \\Documents\\Visual Studio 2015\\Projects\\tracedrv\\tracedrv\\*platform*). + 1. Use Tracepdb to create a trace message format (TMF) file and a trace message control (TMC) file from the Tracedrv.pdb file. Tracepdb is located in the C:\\Program Files (x86)\\Windows Kits\\10\\bin\\*platform* directory. The PDB file that is used in this command is created when you the build the solution. Open a Visual Studio Command prompt window and navigate to the target build platform and configuration directory. Type the following command: - **tracepdb -f tracedrv.pdb** + `tracepdb -f tracedrv.pdb` 1. In the same Tracedrv target build directory, create a control GUID file for Tracedrv by opening a text file, adding the following content, and saving the file as Tracedrv.ctl. @@ -44,26 +34,22 @@ To test the Tracedrv event tracing provider, use the following procedure. 1. Use Tracelog to start a trace session that is called *TestTracedrv*. Tracelog is located in the C:\\Program Files (x86)\\Windows Kits\\10\\bin\\*platform* directory. The Tracedrv.ctl file that is used in this command was created in the previous step. The following command starts a trace session and creates a trace log file, tracedrv.etl, in the local directory. - ``` - tracelog -start TestTracedrv -guid tracedrv.ctl -f tracedrv.etl -flag 1 - ``` + `tracelog -start TestTracedrv -guid tracedrv.ctl -f tracedrv.etl -flag 1` - **Note** Without the -flag parameter, Tracedrv will not generate any trace messages. + > [!NOTE] + > Without the -flag parameter, Tracedrv will not generate any trace messages. 1. To generate trace messages, run Tracectl.exe. This executable file is built when you build the solution. Each time you type a character, other than **Q** or **q**, Tracectl sends an IOCTL to the driver that signals it to generate trace messages. To stop Tracectl, type **Q** or **q**. + 1. To stop the trace session, use the following Tracelog command. - ``` - tracelog -stop TestTracedrv - ``` + `tracelog -stop TestTracedrv` 1. To display the trace messages in the Tracedrv.etl file, use Tracefmt.exe. Tracefmt.exe is located in the C:\\Program Files (x86)\\Windows Kits\\10\\bin\\*platform*. The TMF file used in this command was created by Tracepdb.exe in step 2. The **-p** option specifies the directory of the TMF file. In this case, the TMF file is in the current directory. Type the following command: - ``` - tracefmt tracedrv.etl -p . -o Tracedrv.out - ``` + `tracefmt tracedrv.etl -p . -o Tracedrv.out` -The resulting Tracedrv.out file is a human-readable text file of the Tracedrv trace messages. To interpret the trace messages, in the Tracedrv.c file, search for the [**DoTraceMessage**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544918) macros. +The resulting Tracedrv.out file is a human-readable text file of the Tracedrv trace messages. To interpret the trace messages, in the Tracedrv.c file, search for the [**DoTraceMessage**](https://docs.microsoft.com/previous-versions/windows/hardware/previsioning-framework/ff544918(v=vs.85)) macros. ## Notes @@ -71,6 +57,6 @@ This sample driver should not be used in a production environment. Also, because it is not a Plug and Play driver, Tracedrv does not demonstrate tracing in a Plug and Play environment. -Tracedrv demonstrates the basic elements required for software tracing. It does not demonstrate more advanced tracing techniques, such as writing customized tracing calls (variations of [**DoTraceMessage**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544918)), or the use of WMI calls for software tracing. +Tracedrv demonstrates the basic elements required for software tracing. It does not demonstrate more advanced tracing techniques, such as writing customized tracing calls (variations of [**DoTraceMessage**](https://docs.microsoft.com/previous-versions/windows/hardware/previsioning-framework/ff544918(v=vs.85))), or the use of WMI calls for software tracing. -If you are building the Tracedrv sample to test on a 64-bit version of Windows, you need to sign the driver. All 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202). +If you are building the Tracedrv sample to test on a 64-bit version of Windows, you need to sign the driver. All 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](https://docs.microsoft.com/windows-hardware/drivers/develop/signing-a-driver) and [Signing a Driver During Development and Testing](https://docs.microsoft.com/windows-hardware/drivers/install/signing-drivers-during-development-and-test). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](https://docs.microsoft.com/windows-hardware/drivers/install/the-testsigning-boot-configuration-option) and [**BCDEdit /set**](https://docs.microsoft.com/windows-hardware/drivers/devtest/bcdedit--set). |
