This section describes how to use the default operation of the Windows software trace preprocessor (WPP) to trace a driver's operation. WPP software tracing is supported on Microsoft Windows 2000 and later.

WPP software tracing in kernel-mode drivers supplements and enhances WMI event tracing by adding conventions and mechanisms that simplify tracing a driver's operation. It is an efficient mechanism for user-mode applications and kernel-mode drivers to log real-time binary messages. The logged messages can subsequently be converted to a human-readable trace of the driver's operation.

Logging messages with WPP software tracing is similar to using Windows event logging services. The driver logs a message ID and unformatted binary data in a log file. Subsequently, a postprocessor converts the information in the log file to a human-readable form. However, WPP software tracing supports message formats that are more capable and flexible than that supported by the event logging services. For example, WPP software tracing has built-in support for IP addresses, GUIDs, system IDs, time stamps, and other useful data types. In addition, users can add types relevant to their application.

This section contains the following topics:

For general information about event tracing for Windows, WPP software tracing for user-mode applications, and the options available with WPP software tracing, see the Windows SDK documentation.

For information about the WMI library support routines that support WPP software tracing, see:

Note  Event Tracing for Windows (ETW) and the Windows Trace Preprocessor (WPP) support most types of kernel-mode and user-mode drivers. However, ETW and WPP use types that are not available for certain types of drivers, such as miniport drivers. To determine whether a particular driver type is supported, add basic WPP macros to the driver, such as WPP_INIT_TRACING and WPP_CLEANUP. If the code does not compile because the types that are used are not defined, ETW and WPP cannot support the driver type.