Search code examples
windowscmddriverdrivers

Run Microsoft TraceView from CMD

I try to run Microsoft traceview from CMD, with all flags, verbose level and saving to file. I tried many combinations but anytime I get a file without real data.

I found Trace View Control Command here but I still not success to run it well via CMD. In additional, it's seems like data is missed. For example, you should found -flag or -level but how you enable the flags or how you choose the level? in the example you should see -flag 0x7 - what does this mean?

So my question is how can I run Trace View from CMD, to create a new session and still run an existing workspace.

Until now I tried a lot of variations of the command and I still get an "empty" log file. These are some of the variations I tried:

traceview -start myTracee -pdb myDriver.pdb
traceview -start myTracee -rt -b 1024 -pdb myDriver.pdb -f log.etl
traceview -start myTracee -rt -b 1024 -ft 180 -pdb myDriver.pdb  -f log.etl
traceview -start myTracee -rt -enable -b 512 -ft 180 -pdb myDriver.pdb  -f log.etl
traceview -start myTracee -rt -level verbose -b 512 -ft 180 -pdb myDriver.pdb  -f log.etl
Solution

  • Use this command:

    traceview -start myTrace -rt -pdb myDriver.pdb  -f my.etl -level 7 -flag 0x7fff

    The log will be saved in my.etl

    You must set -level and -flag as described in traceview help, the -level and -flag is 0 by default, which will block all trace log.

    To set the level and flag values define them in the myDriver.pdb file using this command: 

    traceview.exe -parsepdb myDriver.pdb

    A *.tmc file will be created, open it with notepad and find the trace level and flag definition inside. With -level 7 and -flag 0x7fff you can get some trace log at least.

    To translate the etl file to txt format, use this command:

    traceview -process my.etl -pdb myDriver.pdb -o mytrace.txt