Understanding Tracefmt

Trace providers record trace messages in binary form for efficiency. To display the trace messages in readable form, Tracefmt applies the formatting instructions for each message, and then displays the messages or saves them in a text file.

The formatting instructions for trace messages are included in the source code of trace providers that use WPP software tracing and then are compiled into the private or full versions of the PDB symbol file for the trace provider. The WPP preprocessor extracts the formatting instructions from the private symbols and places them in a trace message format (.tmf) file for the provider.

To format the trace messages, Tracefmt requires a TMF file. You can provide the TMF file to Tracefmt or direct Tracefmt to create a TMF file for you. Use any of the following methods to provide the required input.

Use Default.tmf. Because most applications and drivers use standard message formats, their messages can be formatted by using information in Default.tmf, a file included in the WDK.

Provide a TMF file. You can specify a particular TMF file by supplying its path and file name.

Provide the path to a directory of TMF files. Tracefmt can use the message GUID of the trace messages to identify the TMF file that contains formatting instructions for the message in a directory of TMF files. The TMF file names consist of the message GUID with a .tmf file name extension.

Direct Tracefmt to create a TMF file. Tracefmt can use the image file (.exe, .dll, or .sys) for the trace provider to find the private PDB symbol file for the trace provider in a directory or by using an internal symbol server. It then creates a TMF file from the data in the PDB file and uses the TMF file to format the trace messages. When it creates a TMF file, Tracepdb creates a MOF (.mof) file that contains the control GUID and the trace levels of each trace provider that are represented in the PDB file. The name of the MOF file is the module name of the trace provider.

After formatting the trace messages, Tracefmt can display the trace messages at the command line and it can create the following files:

• An output file of formatted trace messages. The messages appear in the order that they were generated by the trace provider. Each message is preceded by a trace prefix. For information, see Trace Message Prefix.

• A summary message file of information about the trace session during which the trace messages were generated.

For more information about event tracing, see the Microsoft Windows SDK documentation. For information about using event tracing in drivers, see WPP Software Tracing.