The following software tracing tools are included in the WDK (in the \tools\tracing directory), in Debugging Tools for Windows, or in Windows.

Adding tracing to a driver or application

• TraceWPP is a command-line tool that runs the Windows software trace preprocessor (WPP) on the source files of trace providers. An alternative to running the WPP in the WDK Build utility, TraceWPP processes trace macros in a source file and creates a header file to enable WPP tracing. TraceWPP (tracewpp.exe) is included in the WDK in the \bin\x86 directory. The command-line options for TraceWPP are the same as those for RUN_WPP and are described in the WPP Preprocessor topic. For more information about using TraceWPP, see the Microsoft Windows SDK documentation.

Controlling trace sessions (trace controllers)

• TraceView is a GUI-based trace controller and trace consumer designed especially for real-time displays of trace messages. It enables, configures, starts, updates, and stops tracing sessions, and formats, filters, and displays trace messages from real-time trace sessions and trace logs. TraceView combines and extends the features of Tracepdb, Tracelog, and Tracefmt. For information, start TraceView and, from the Help menu, choose Help Topics.
• Tracelog is a command-line trace controller that enables, configures, starts, updates, and stops real-time and log sessions. Tracelog supports user-mode and kernel-mode trace sessions, NT Kernel Logger trace sessions, the Global Logger (boot) trace session, and tracing to measure time spent in deferred procedure calls (DPCs) and interrupt service routines (ISRs). Tracelog is included in the WDK.
• Logman is a fully functional, GUI-based trace controller designed especially to control the logging of performance counters and event traces. Logman is included in Windows XP and later versions of Windows. For information, see Help and Support.

Creating TMF files

• Tracepdb is a command-line support tool that creates trace message format (TMF) files from the trace message formatting instructions in PDB symbol files. The tools that display trace messages, Tracefmt and TraceView, can use the formatting instructions from the TMF files to format and display trace messages. Tracepdb is included in the WDK.

  Tracefmt, a command-line tool that formats and displays trace messages, can also create TMF files from PDB symbol files. Tracefmt is included in the WDK.

Formatting and displaying trace messages (trace consumers)

• Tracefmt is a command-line trace consumer that formats trace messages (TraceMessage) from real-time trace sessions or trace logs and writes them to files or displays them in the Command Prompt window. Tracefmt is included in the WDK.
• Tracerpt is a command-line trace consumer that formats trace events (TraceEvent) and performance counters and writes them to CSV or XML files. It also analyzes the events and generates summary reports. Tracerpt is included in Windows XP and later versions of Windows. For information, see Help and Support.
• TraceView, a GUI tool, that is a trace controller and a trace consumer, also formats and displays trace messages (TraceMessage) from real-time trace sessions or trace logs. It displays the trace messages in a tabular form, making them easier to filter and browse.

Viewing trace events in a debugger

• Debugging Tools for Windows includes !wmitrace, a specialized debugger extension that displays the trace messages in the trace session buffers before they are written to log files or delivered for display.
• Tracelog and TraceView can redirect trace messages to KD or Windbg, whichever is attached. For more information, see the Tracelog -kd parameter and the TraceView Windbg option.

Analyzing DPC and ISR execution times

• On Windows XP with Service Pack 2 (SP2) and later, you can use Tracelog to log deferred procedure call (DPC) and interrupt service routine (ISR) events in the NT Kernel Logger trace session and then use Tracerpt to create summary reports from the logs. For details, including an example, see Tracelog.