How to enable Kernel Traces in WinDBg

Question

I have already referred to this post:

But didn't help. Issuing

ed Kd_DEFAULT_Mask 8

didn't cause any change. and I don't know how to add a DWORD here HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter called DEFAULT with a value of 8, Because I can't see Debug Print Filter under my registry?

I have a way to verify whether the debug driver for my hardware is installed or not, But even after verifying that, I can't seem to get Kernel traces in windbg. There is a tool called DbgView.exe in that I have enabled following Capture options:

Capture Win32
Capture Global Win32
Capture Kernel
Enable Verbose Kernel Output
Pass-through
Capture events

I was hoping this would enable kernel traces but without help.

Could someone tell me the standard way to doing this?

Brubaker

Answer 1

How to add Debug print key registry

:>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter"

Error: The system was unable to find the specified registry key or value

:>reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" /V DEFAULT /t REG_DWORD /d 0xf

The operation completed successfully

:>reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter"

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter DEFAULT REG_DWORD 0xf

Bradwell

I didn't even know you could do "reg add" from the cmd line, very handy! – Relieve

It's "Debug Print Filter", not "Debug Print" – Hellebore

Answer 2

Have you tried setting the default mask to 0xF? Are you sure that your driver is actually generating trace messages after you have changed the kd_default_mask variable?

In terms of the registry based approach, you just create the Debug Print Filter key if it isn't already there.

Maneating

Answer 3

You need to create this key. This key does not exist by default HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter The set the Default Value to 0xf. That will enable all messages.

More information can be found in "Setting the Component Filter Mask".

There is also a description how to set this for a single debugger session

Pea