|
|
//******************************************// System Trace Definitions// Version 0004.0 18th December 2003//******************************************
// The #typev statement and the #typev statement may be used to convert// messages into user readable forms.// With #typev all parameters are processed as strings and the default string// processing of FormTMessage is used// With #typev wherever possible parameters are processed as their native format// and the %x!x! style of FormatMessage should be used.//// Note Parameter %1 through %9 are predefined// Parameter is #typev// %1 GUID Friendly Name string// %2 GUID SubType Name string// %3 Thread ID ULONG_PTR// %4 System Time String// %5 Kernel Time or User Time String// %6 User Time or NULL String// %7 Sequence Number LONG// %8 Unused String// %9 CPU Number LONG// %10 and above are the user parameters// %255 Is reserved//// Note these parameters are always present, but may not be valid // depending on the source.//// User defined messages always start at message number 10// Messages 0 through 9 are reserved for system use.// Message number 255 is reserved.//// Available formats for user arguments are -////Name Description #typev Format//ItemChar CHAR//ItemUChar UCHAR//ItemCharShort USHORT//ItemCharSign SHORT//ItemShort Signed Short SHORT//ItemUShort Unsigned Short USHORT//ItemLong Signed Long, decoded as decimal LONG//ItemULong Unsigned Long, decoded as decimal ULONG//ItemULongX Unsigned Long, seen as hexadecimal ULONG//ItemLongLong Signed 64 Bit value LONGLONG//ItemULongLong Unsigned 64 Bit value ULONGLONG//ItemRString Reduced Ascii String String// (\t, \n, \r, \,, converted to space, trailing sp removed)//ItemWString Unicode String, null terminated String//ItemPString Counted Ascii String String//ItemPWString Counted Unicode String String//ItemMLString Multi-Line Ascii String String//ItemSid Security identifier String//ItemChar4 CHAR4//ItemIPAddr IP Address String (If needed raw, use ItemUlong)// (string of form xxx.xxx.xxx.xxx)//ItemPort String (If needed raw use ItemUshort)//ItemNWString Non-null terminated Wide Char String String//ItemListByte (element1,element2,....) String// byte index into a list of strings//ItemListShort(element1,element2,....) String// short index into a list of strings//ItemListLong (element1,element2,....) String// Long index into a list of strings//ItemGUID Normal GUID format String//ItemNTerror Translates a ULONG error code to the String// NT Error Text//ItemNTSTATUS Converts NTSTATUS to symbolic name String//ItemWINERROR Converts WINERROR to symbolic name String//ItemNETEVENT Converts NETEVENT to symbolic name String//ItemMerror module.ext String// Translates a ULONG error code using the // module specified.//ItemTimeStamp Treats a LONGLONG as a timestamp String//ItemUnknown String
ce5b1020-8ea9-11d0-a4ec-00a0c9062910 TraceDp#typev Start 1 "TraceDp TID=0x%3 Start"#typev End 2 "TraceDp TID=0x%3End"{}
68fdd900-4a3e-11d1-84f4-0000f80464e3 EventTrace#typev Header 0 "%0EventTrace Header"{}
2cb15d1d-5fc1-11d2-abe1-00a0c911f518 Image#typev Load 10 "%0ImageLoad of %13!s! (Process= %12!d!, Base=0x%10!X!,size=0x%11!X!)"{ Base Address, ItemPtr Module Size, ItemPtr ProcessId, ItemUlong Image Filename, ItemWString}
3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c Process#typev Start 1 "%0Started Process %11!04X!.%12!04X! %16!s! :: %15!s! (Session=%13!d!) "#typev End 2 "%0Ended Process %11!04X!.%12!04X! %16!s! :: %15!s! (Session=%13!d!) Exit Status %14!X!" #typev DCStart 3 "%0Data Collection Started of %11!04X!.%12!04X! %16!s! :: %15!s! (Session=%13!d!)"#typev DCEnd 4 "%0Data Colection Ended for %11!04X!.%12!04X! %16!s! :: %15!s! (Session=%13!d!)"#typev Load 5 "%0Load of %11!04X!.%12!04X! %16!s! :: %15!s! (Session=%13!d!)"{ PageDirectoryBase, ItemPtr Process Id, ItemULong Parent Id, ItemULong Session Id, ItemULong Exit Status, ItemUlong User SID, ItemSid Image FileName, ItemString}
3d6fa8d1-fe05-11d0-9dda-00c04fd7ba7c Thread#typev Start 1 "%0Started Thread %10!04X!.%11!04X!"#typev DCStart 3 "%0Data Collection Started for %10!04X!.%11!04X!"{ Process Id, ItemULong Thread Id, ItemULong StackBase, ItemPtr StackLimit, ItemPtr UserStackBase, ItemPtr UserStackLimit, ItemPtr StartAddr, ItemPtr Win32StartAddr, ItemPtr WaitMode, ItemChar}#typev End 2 "%0Ended Thread %10!04X!.%11!04X!"#typev DCEnd 4 "%0Data Collection Ended for %10!04X!.%11!04X!"{ Process Id, ItemULong Thread Id, ItemULong}
3d6fa8d3-fe05-11d0-9dda-00c04fd7ba7c PageFault#typev TransitionFault 10 "%0Pagefault Transition VA=0x%10!08X!, PC=0x%11!08X!"#typev DemandZeroFault 11 "%0Pagefault DemandZero VA=0x%10!08X!, PC=0x%11!08X!"#typev CopyOnWrite 12 "%0Pagefault CopyOnWrite VA=0x%10!08X!, PC=0x%11!08X!"#typev GlobalPageFault 13 "%0Pagefault GuardPageFault VA=0x%10!08X!, PC=0x%11!08X!"#typev Hard 14 "%0Pagefault Hard VA=0x%10!08X!, PC=0x%11!08X!, in %12!016X!"#typev Notification 15 "%0Pagefault Notification VA=0x%10!08X!, PC=0x%11!08X!, in %12!016X!"{ Virtual Address,ItemULongX Program Counter,ItemUlongX Byte Offset, ItemLongLong File Object, ItemUlongX Byte Count, ItemUlong HotFile Name, ItemNWString}
01853a65-418f-4f36-aefc-dc0f1d2fd235 Config#typev CPU 10 "%0%15!s!(%16!s!) :: CPU # %11!d!, Speed %10!d!Mhz, Memory %12!d!K, PageSize %13!d!K, AllocationGranularity %14!d!"{ MHz, ItemULong //10 NumberOfProcessors, ItemULong //11 MemSize, ItemULong //12 PageSize, ItemULong //13 AllocationGranularity, ItemULong //14 ComputerName, ItemWChar[256] //15 DomainName, ItemWChar[132] //16
}#typev PhyDisk 11 "%0Phsical Disk %10!d!(%19!s!), SectorSize: %11!d!, SectorsperTrack: %12!d!, TracksPerCylinder %13!d! Cylinders %14!d!, SCSI (Port=%15!d!, Path %16!d!, Target=%17!d!, Lun=%18!d!)" { DiskNumber, ItemULong //10 BytesPerSector, ItemULong //11 SectorsPerTrack, ItemULong //12 TracksPerCylinder, ItemULong //13 Cylinders, ItemULongLong //14 SCSIPort, ItemULong //15 SCSIPath, ItemULong //16 SCSITarget, ItemULong //17 SCSILun, ItemULong //18 Manufacturer, ItemWChar[256] //19 PartitionCount, ItemULong //20 WriteCacheEnabled, ItemBool //21 BootDriveLetter, ItemWChar[3] //22}#typev LogDisk 12 "%0Logical Disk %12!d! %15!s! "{ StartOffset, ItemULongLong //10 PartitionSize, ItemULongLong //11 DiskNumber, ItemULong //12 Size, ItemULong //13 DriveType, ItemULong //14 DriveLetterString, ItemWChar[4] //15 Pad, ItemULong //16 PartitionNumber, ItemULong //17 SectorsPerCluster, ItemULong //18 BytesPerSector, ItemULong //19 NumberOfFreeClusters, ItemLongLong //20 TotalNumberOfClusters, ItemLongLong //21 FileSystem, ItemWChar[16] //22 VolumeExt, ItemULong
}#typev NIC 13 "%0NIC %12!d! Name = %10!s! "{ NICName, ItemWChar[256] //10 Index, ItemULong //11 PhysicalAddrLen, ItemULong //12 PhysicalAddr, ItemWChar[8] //13 Size, ItemULong //14 IpAddress, ItemLong //15 SubnetMask, ItemLong //16 DhcpServer, ItemLong //17 Gateway, ItemLong //18 PrimaryWinsServer, ItemLong //19 SecondaryWinsServer, ItemLong //20 DnsServer1, ItemLong //21 DnsServer2, ItemLong //21 DnsServer3, ItemLong //23 DnsServer4, ItemLong //24 Data, ItemULong}#typev Video 14 "%0Video %17!s!"{ MemorySize, ItemULong //10 XResolution, ItemULong //11 YResolution, ItemULong //12 BitsPerPixel, ItemULong //13 VRefresh, ItemULong //14 ChipType, ItemWCHAR[256] //15 DACType, ItemWCHAR[256] //16 AdapterString, ItemWCHAR[256] //17 BiosString, ItemWCHAR[256] //18 DeviceId, ItemWCHAR[256] //19 StateFlags, ItemULong}#typev Services 15 "%0Service (PID=%13!d!) %10!s! %11!s! %12!s!"{ ServiceName, ItemWCHAR[34] DisplayName, ItemWCHAR[256] ProcessName, ItemWCHAR[34] ProcessId, ItemULong}#typev Power 16 "%0Power Configuration"{ S1, ItemBool S2, ItemBool S3, ItemBool S4, ItemBool S5, ItemBool Pad1, ItemChar Pad2, ItemChar Pad3, ItemChar}
3d6fa8d4-fe05-11d0-9dda-00c04fd7ba7c DiskIo#typev Read 10 "%0Read of %12!5d! bytes (FileObj=0x%15!08X!)"#typev Write 11 "%0Write of %12!5d! bytes (FileObj=0x%15!08X!)"{ Disk Number, ItemULong Irp Flags, ItemULongX Transfer Size, ItemULong QueueDepth, ItemULong Byte Offset, ItemLongLong File Object, ItemULongX}AE53722E-C863-11d2-8659-00C04FA321A1 Registry#typev Create 10 "%0Create of %14!s! Handle = 0x%11!08X! Status = %10!0X!"#typev Open 11 "%0Open of %14!s! Handle = 0x%11!08X! Status = %10!0X!"#typev Delete 12 "%0Delete of Handle = 0x%11!08X!(%14!s!) Status = %10!0X!"#typev Query 13 "%0Query of (%14!s!) Handle = 0x%11!08X! Status = %10!0X!"#typev SetValue 14 "%0SetValue of %14!s! Handle = 0x%11!08X!(%14!s!)8X! Status = %10!0X! (TID =%3!0X!)"#typev QueryValue 16 "%0QueryValue of (%14!s!) Handle = 0x%11!08X! Status = %10!0X!"#typev EnumerateKey 17 "%0EnumerateKey of %14!s! Handle = 0x%11!08X! Status = %10!0X!"#typev EnumerateValueKey 18 "%0EnumerateValueKey of %14!s! Handle = 0x%11!08X! Status = %10!0X!"#typev QueryMultipleValue 19 "%0QueryMultiple of %14!s! Handle = 0x%11!08X! Status = %10!0X!"#typev SetInformation 20 "%0SetInformation of %14!s! Handle = 0x%11!08X! Status = %10!0X!"#typev Flush 21 "%0Flush of %14!s! Handle = 0x%11!08X! Status = %10!0X!"#typev RunDown 22 "%0Rundown"{ Status,ItemUlongX Key Handle, ItemULongX Elapsed Time, ItemLongLong Index, ItemULong KeyName, ItemWString}90cbdc39-4a3e-11d1-84f4-0000f80464e3 FileIo#typev Name 0 "%0Filio for %11 (FileObj=0x%10!X!)"#typev FileCreate 32 "%0File Create of %11 (FileObj=0x%10!X!)"{ File Object, ItemPtr File Name, ItemWString}
9a280ac0-c8e0-11d1-84e2-00c04fb998a2 TcpIp#typev Send 10 "%0TCPIP Send to %12!13s!:%14!05d! from %13!13s!:%15!05d! of %11!5d! bytes" #typev Recv 11 "%0TCPIP Receive from %12!13s!:%14!05d! to %13!13s!:%15!05d! of %11!5d! bytes" #typev Connect 12 "%0TCPIP Connect to %12:%14!05d! from %13:%15!05d!" #typev Disconnect 13 "%0TCPIP Discon From %12:%14!05d! to %13:%15!05d!" #typev Retransmit 14 "%0TCPIP Retransmit to %12:%14!05d!" #typev Accept 15 "%0TCPIP Accept From %12:%14!05d!"#typev Reconnect 16 "%0TCPIP Reconnect To %12:%14!05d!"{ PID, ItemULong /10 size, ItemULong /11 daddr, ItemIPAddr /12 saddr, ItemIPAddr /13 dport, ItemUshort /14 sport, ItemUshort /15}
bf3a50c5-a9c9-4988-a005-2df0b7c80f80 UdpIp#typev Send 10 "%0UDP Send to %12!13s!:%14!05d! from %13!13s!:%15!05d! of %11!5d! bytes (Pid= %10!08X!)" #typev Recv 11 "%0UDP Receive from %12!13s!:%14!05d! to %13!13s!:%15!05d! of %11!5d! bytes (Pid= %10!08X!)" { PID, ItemULong /10 size,ItemUlong /11 destaddr, ItemIPAddr /12 srcdaddr, ItemIPAddr /13 destport, ItemUshort /14 srcport, ItemUshort /15}
//******************************************// Test Events// d58c126f-b309-11d1-969e-0000f875a5bc//******************************************ce5b1020-8ea9-11d0-a4ec-00a0c9062910 TraceDp#typev Start 1#typev End 2{ UserData, ItemULong}
f2e0e060-bf32-4b88-b8e4-5cad15af6ae9 ACPI#typev One 1 "%0%10!s!"{ String,ItemString}#typev two 2 "%0%10!s!"{ String,ItemString}
|
