Edit

!wdfkd.wdflogdump

  • Article

The !wdfkd.wdflogdump extension displays the WDF In-flight Recorder log records, if available, for a KMDF driver or a UMDF 2 driver. You can use this command with a complete memory dump, a kernel memory dump, or a live kernel-mode target.

KMDF

!wdfkd.wdflogdump [DriverName][WdfDriverGlobals][-d | -f | -a LogAddress]

UMDF

!wdfkd.wdflogdump  [DriverName.dll][HostProcessId][-d | -f | -m]

Parameters

DriverName

  • KMDF: The name of a KMDF driver. The name must not include the .sys filename extension.
  • UMDF: The name of a UMDF 2 driver. The name must include the .dll filename extension.

Parameter2

  • KMDF: WdfDriverGlobals - The address of the WdfDriverGlobals structure. You can determine this address by running !wdfkd.wdfldr and looking for the field labeled "WdfGlobals". Or, you can supply @@(Driver!WdfDriverGlobals) as the address value, where Driver is the name of the driver. If any WdfDriverGlobals address is supplied, DriverName is ignored (although it must nevertheless be supplied).

  • UMDF: HostProcessId - The process ID of an instance of wudfhost.exe. If you supply the process ID, this command displays the log records for that process. If you do not supply the process ID, this command displays a list of commands in this form:

    !wdflogdump DriverName **** ProcessID

    If a single process can be determined it will automatically be chosen.

Options KMDF:

-d Displays only the driver logs.

-f Displays only the framework logs.

-a LogAddressDisplays a specific driver log. If this option is used, the LogAddress must be provided.

UMDF:

-d Displays only the driver logs.

-f Displays only the framework logs.

-m Merges framework and driver logs in their recorded order.

DLL

Wdfkd.dll

Frameworks

KMDF 1, UMDF 2

Remarks

If you omit the DriverName parameter, the default driver name is used. Use the !wdfkd.wdfgetdriver extension to display the default driver name, and use the !wdfkd.wdfsetdriver extension to set the default driver name.

To display the framework's error log records from a small memory dump, use the !wdfkd.wdfcrashdump extension.

For information about setting information that the debugger needs to format WPP tracing messages, see !wdfkd.wdftmffile and !wdfkd.wdfsettraceprefix.

Additional Information

For information about enabling the inflight trace recorder for your driver, see Using Inflight Trace Recorder (IFR) in KMDF and UMDF 2 Drivers. For more information about debugging WDF drivers, see Debugging WDF Drivers. For information about KMDF debugging, see Kernel-Mode Driver Framework Debugging.

See also

!wdfkd.wdfcrashdump

!wdfkd.wdfsettraceprefix