Windows和用户模式驱动程序的事件跟踪 [英] Event Tracing for Windows and User Mode Driver

问题描述

我想知道如何在UMD for Vista中实现ETW.据我了解，Vista UMD就像一个应用程序，因此我可以使用ETW代替用于KMD的WPP.这是正确的吗?

 I was wondering on how I should implement ETW in UMD for Vista. As far as I understand, the Vista UMD is like an application so I can use ETW instead of WPP that are used for KMD. Is this correct?

您能为我提供有关UMD的ETW的更多示例吗?

 Can you provide me with more examples on ETW related to UMD?

谢谢

Vlad.

推荐答案

您可以在内核或用户模式下使用ETW.由于WPP是建立在ETW之上的，因此WPP也是如此.

由于UMD只是一个用户模式应用程序，因此请在Windows 7 Beta SDK中引用以下示例:

" ;％MSSDK％\ samples \ winbase \ eventing \ simple；和％MSSDK％\ samples \ winbase \ eventing \ advanced".

You can use ETW in Kernel or User mode. Since WPP is built on top of ETW, same goes for WPP.

Since UMD is just a User Mode application, refer these samples in the Windows 7 Beta SDK:

"%MSSDK%\samples\winbase\eventing\simple" and %MSSDK%\samples\winbase\eventing\advanced".

这篇关于Windows和用户模式驱动程序的事件跟踪的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！