diff options
| author | Barry Golden <[email protected]> | 2015-07-30 16:03:24 -0700 |
|---|---|---|
| committer | Barry Golden <[email protected]> | 2015-07-30 16:03:24 -0700 |
| commit | 4dc90ad04d5e40851e2e370f487b7cc9a3be071b (patch) | |
| tree | c2e74dd18a743893c555d311f29ad9fba77b60c6 /general/tracing | |
| parent | d3abcb10a801986a2956d6bbdfeb652bda1d9a74 (diff) | |
Update README.md
Diffstat (limited to 'general/tracing')
| -rw-r--r-- | general/tracing/SystemTraceControl/ReadMe.md | 2 | ||||
| -rw-r--r-- | general/tracing/evntdrv/ReadMe.md | 12 | ||||
| -rw-r--r-- | general/tracing/tracedriver/ReadMe.md | 50 |
3 files changed, 25 insertions, 39 deletions
diff --git a/general/tracing/SystemTraceControl/ReadMe.md b/general/tracing/SystemTraceControl/ReadMe.md index f581e52e..eb044ddb 100644 --- a/general/tracing/SystemTraceControl/ReadMe.md +++ b/general/tracing/SystemTraceControl/ReadMe.md @@ -5,7 +5,7 @@ This sample application demonstrates how to use event tracing control APIs to co The sample code provided shows how to start an [Event Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/bb968803) for Windows trace session and how to enable system events with stacks. When you build and run the application, it collects the trace data for 30 seconds and then stops. The sample application writes the results to a file, Systemtrace.etl. For more information, see [Tools for Software Tracing](http://msdn.microsoft.com/en-us/library/windows/hardware/ff552961). -You can process the Systemtrace.etl file using Tracerpt.exe. Tracerpt.exe is a command-line trace tool that formats trace events. It also analyzes the events and generates summary reports. Tracerpt is included in Windows XP and later versions of Windows. For more information about how to use this tool, see [Tracerpt](http://go.microsoft.com/fwlink/p/?linkid=179389) topic on the TechNet website. +You can process the Systemtrace.etl file using Tracerpt.exe, a command-line trace tool included in Windows that formats trace events. It also analyzes the events and generates summary reports. For more information about how to use this tool, see [Tracerpt](http://go.microsoft.com/fwlink/p/?linkid=179389) topic on the TechNet website. You can also process the file using the [Windows Performance Toolkit](http://go.microsoft.com/fwlink/p/?linkid=250774) (WPT), which is available in the SDK. diff --git a/general/tracing/evntdrv/ReadMe.md b/general/tracing/evntdrv/ReadMe.md index f5780ef6..a560a0a4 100644 --- a/general/tracing/evntdrv/ReadMe.md +++ b/general/tracing/evntdrv/ReadMe.md @@ -13,7 +13,7 @@ Run the sample 1. Install the manifest (Evntdrv.xml), which is located in the Evntdrv\\Eventdrv folder. Open a Visual Studio Command window (Run as administrator) and use the following command: - ``` {.syntax xml:space="preserve"} + ``` wevtutil im evntdrv.xml ``` @@ -29,7 +29,7 @@ Run the sample 3. Use Tracelog to start a trace session that is called "TestEventdrv." The following command starts the trace session and creates a trace log file, Eventdrv.etl, in the local directory. - ``` {.syntax xml:space="preserve"} + ``` Tracelog -start TestEventdrv -guid #b5a0bda9-50fe-4d0e-a83d-bae3f58c94d6 -f Eventdrv.etl ``` @@ -37,13 +37,13 @@ Run the sample 5. To stop the trace session, run the following command: - ``` {.syntax xml:space="preserve"} + ``` tracelog -stop TestEventdrv ``` 6. To display the traces collected in the Tracedrv.etl file, run the following command: - ``` {.syntax xml:space="preserve"} + ``` tracerpt Eventdrv.etl ``` @@ -51,12 +51,12 @@ Run the sample 7. To uninstall the manifest, run the following command: - ``` {.syntax xml:space="preserve"} + ``` wevtutil um evntdrv.xml ``` Notes ----- -If you are building the Eventdrv sample to test on a 64-bit version of Windows, you need to sign the driver. Starting with Windows Vista, all 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202). +If you are building the Eventdrv sample to test on a 64-bit version of Windows, you need to sign the driver. All 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202). diff --git a/general/tracing/tracedriver/ReadMe.md b/general/tracing/tracedriver/ReadMe.md index 99c46dd5..3e95d383 100644 --- a/general/tracing/tracedriver/ReadMe.md +++ b/general/tracing/tracedriver/ReadMe.md @@ -12,49 +12,37 @@ Run the sample To test the Tracedrv event tracing provider, use the following procedure. -1. Copy the Tracectl.exe file that was created when you built the Tracedrv solution from the Tracectl directory (for example, \\Documents\\Visual Studio 2013\\Projects\\tracedrv\\tracectl\\*platform*) to the Tracedrv directory (for example, \\Documents\\Visual Studio 2013\\Projects\\tracedrv\\tracedrv\\*platform*). -2. Use Tracepdb to create a trace message format (TMF) file and a trace message control (TMC) file from the Tracedrv.pdb file. Tracepdb is located in the C:\\Program Files (x86)\\Windows Kits\\8.1\\bin\\*platform* directory. The PDB file that is used in this command is created when you the build the solution. Open a Visual Studio Command prompt window and navigate to the target build platform and configuration directory. Type the following command: +1. Copy the Tracectl.exe file that was created when you built the Tracedrv solution from the Tracectl directory (for example, \\Documents\\Visual Studio 2015\\Projects\\tracedrv\\tracectl\\*platform*) to the Tracedrv directory (for example, \\Documents\\Visual Studio 2015\\Projects\\tracedrv\\tracedrv\\*platform*). +2. Use Tracepdb to create a trace message format (TMF) file and a trace message control (TMC) file from the Tracedrv.pdb file. Tracepdb is located in the C:\\Program Files (x86)\\Windows Kits\\10\\bin\\*platform* directory. The PDB file that is used in this command is created when you the build the solution. Open a Visual Studio Command prompt window and navigate to the target build platform and configuration directory. Type the following command: **tracepdb -f tracedrv.pdb** 3. In the same Tracedrv target build directory, create a control GUID file for Tracedrv by opening a text file, adding the following content, and saving the file as Tracedrv.ctl. - <table> - <colgroup> - <col width="100%" /> - </colgroup> - <thead> - <tr class="header"> - <th align="left">Text</th> - </tr> - </thead> - <tbody> - <tr class="odd"> - <td align="left"><pre><code>d58c126f-b309-11d1-969e-0000f875a5bc </code></pre></td> - </tr> - </tbody> - </table> + ```txt + d58c126f-b309-11d1-969e-0000f875a5bc + ``` -4. Use Tracelog to start a trace session that is called *TestTracedrv*. Tracelog is located in the C:\\Program Files (x86)\\Windows Kits\\8.1\\bin\\*platform* directory. The Tracedrv.ctl file that is used in this command was created in the previous step. The following command starts a trace session and creates a trace log file, tracedrv.etl, in the local directory. +4. Use Tracelog to start a trace session that is called *TestTracedrv*. Tracelog is located in the C:\\Program Files (x86)\\Windows Kits\\10\\bin\\*platform* directory. The Tracedrv.ctl file that is used in this command was created in the previous step. The following command starts a trace session and creates a trace log file, tracedrv.etl, in the local directory. - ``` {.syntax xml:space="preserve"} - tracelog -start TestTracedrv -guid tracedrv.ctl -f tracedrv.etl -flag 1 - ``` + ``` + tracelog -start TestTracedrv -guid tracedrv.ctl -f tracedrv.etl -flag 1 + ``` - **Note** Note: Without the -flag parameter, Tracedrv will not generate any trace messages. + **Note** Note: Without the -flag parameter, Tracedrv will not generate any trace messages. 5. To generate trace messages, run Tracectl.exe. This executable file is built when you build the solution. Each time you type a character, other than **Q** or **q**, Tracectl sends an IOCTL to the driver that signals it to generate trace messages. To stop Tracectl, type **Q** or **q**. 6. To stop the trace session, use the following Tracelog command. - ``` {.syntax xml:space="preserve"} - tracelog -stop TestTracedrv - ``` + ``` + tracelog -stop TestTracedrv + ``` -7. To display the trace messages in the Tracedrv.etl file, use Tracefmt.exe. Tracefmt.exe is located in the C:\\Program Files (x86)\\Windows Kits\\8.1\\bin\\*platform*. The TMF file used in this command was created by Tracepdb.exe in step 2. The **-p** option specifies the directory of the TMF file. In this case, the TMF file is in the current directory. Type the following command: +7. To display the trace messages in the Tracedrv.etl file, use Tracefmt.exe. Tracefmt.exe is located in the C:\\Program Files (x86)\\Windows Kits\\10\\bin\\*platform*. The TMF file used in this command was created by Tracepdb.exe in step 2. The **-p** option specifies the directory of the TMF file. In this case, the TMF file is in the current directory. Type the following command: - ``` {.syntax xml:space="preserve"} - tracefmt tracedrv.etl -p . -o Tracedrv.out - ``` + ``` + tracefmt tracedrv.etl -p . -o Tracedrv.out + ``` The resulting Tracedrv.out file is a human-readable text file of the Tracedrv trace messages. To interpret the trace messages, in the Tracedrv.c file, search for the [**DoTraceMessage**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544918) macros. @@ -63,11 +51,9 @@ Notes This sample driver should not be used in a production environment. -Tracedrv is designed for Windows XP and later versions of Windows. It does not demonstrate how to add WPP software tracing to a Windows 2000 driver. (For information about adding WPP software tracing to a Windows 2000 driver, see the [Software Tracing FAQ](http://msdn.microsoft.com/en-us/library/windows/hardware/ff551795) topic in the Windows DDK documentation.) - Also, because it is not a Plug and Play driver, Tracedrv does not demonstrate tracing in a Plug and Play environment. Tracedrv demonstrates the basic elements required for software tracing. It does not demonstrate more advanced tracing techniques, such as writing customized tracing calls (variations of [**DoTraceMessage**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff544918)), or the use of WMI calls for software tracing. -If you are building the Tracedrv sample to test on a 64-bit version of Windows, you need to sign the driver. Starting with Windows Vista, all 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202). +If you are building the Tracedrv sample to test on a 64-bit version of Windows, you need to sign the driver. All 64-bit versions of Windows require driver code to have a digital signature for the driver to load. See [Signing a Driver](http://msdn.microsoft.com/en-us/library/windows/hardware/ff554809) and [Signing a Driver During Development and Testing](http://msdn.microsoft.com/en-us/library/windows/hardware/hh967733). You might also need to configure the test computer so that it can load test-signed kernel mode code, see [The TESTSIGNING Boot Configuration Option](http://msdn.microsoft.com/en-us/library/windows/hardware/ff553484) and [**BCDEdit /set**](http://msdn.microsoft.com/en-us/library/windows/hardware/ff542202). |
