Tracing During Boot

You can use features of the software tracing components in Microsoft Windows to trace the activity of the Windows kernel, and the activity of drivers and other trace providers, during the Windows boot process.

This section doesn't describe new tools. Instead, it describes methods for using existing software tracing tools and Event Tracing for Windows (ETW) features to perform this valuable task.

This section describes the following methods of tracing during boot:

• Boot-Time Global Logger Session

  Traces Windows kernel activity during the boot process by converting a Global Logger trace session to an NT Kernel Logger trace session.

• Logging to the Global Logger Session

  Traces the activity of a driver, or other trace provider, during boot. The provider must be instrumented for tracing. Only one Global Logger session can run at a time.

• AutoLogger

  This is the preferred method for tracing the activity of a driver or other trace provider during boot. The provider must be instrumented for tracing. The AutoLogger provides callback notification to the driver. Multiple AutoLoggers can run concurrently. This feature is available in Windows Vista and later versions of Windows. For information about tracing the activity of a driver with the AutoLogger, see Configuring and Starting an AutoLogger Session.

When using the Global Logger trace session, be sure that you are aware of its limitations. For information, see Limitations of the Global Logger trace session.