WPP Software Tracing
This section describes how to use the default operation of the Windows software trace preprocessor (WPP) to trace the operation of a software component (trace provider). A trace provider can be one of the following:
A kernel-mode driver.
A user-mode application or dynamic-link library (DLL).
WPP software tracing supplements and enhances WMI event tracing by adding ways to simplify tracing the operation of the trace provider. It is an efficient mechanism for the trace provider to log real-time binary messages. The logged messages can subsequently be converted to a human-readable trace of the operation of the trace provider.
Logging messages with WPP software tracing is similar to using Windows event logging services. The driver logs a message ID and unformatted binary data in a log file. Subsequently, a postprocessor converts the information in the log file to a human-readable form. However, WPP software tracing supports message formats that are more capable and flexible than that supported by the event logging services. For example, WPP software tracing has built-in support for IP addresses, GUIDs, system IDs, time stamps, and other useful data types. In addition, users can add custom data types relevant to their application.
WPP software tracing is supported on Microsoft Windows 2000 and later versions of Windows.
This section includes the following topics:
For information about the WMI library support routines that support WPP software tracing, see:
For more information about ETW, see Event Tracing in the Windows SDK documentation.