Viewing Boot Events With Readlog (Windows Embedded CE 6.0)
1/5/2010
CeLog logs events pertaining to device boot if you enable the collection zone CELZONE_BOOT_TIME. For example, CeLog will capture events that indicate when various drivers and processes load and initialize. When you have enabled this zone and collected data during boot, the boot events will be saved in the log file. Kernel Tracker does not display these events, so you must use the Readlog viewing tool to see them.
Two important processes log events during boot: device.exe and filesys.exe.
Device.exe logs events as it synchronously calls into the driver initialization routines.
Filesys.exe logs events as it synchronously or asynchronously launches the processes that are listed in the device registry under HKEY_LOCAL_MACHINE\init. Filesys.exe may or may not wait for each application to call SignalStarted, based on whether any other applications set the Depends value to indicate that they depend on previous applications. For more information, see Configuring the Process Boot Phase.
Note that when you are capturing data during boot, you are likely to encounter data loss, especially if you have not increased the RAM buffer size, reduced the collection zones you use, or taken any other steps to prevent it. If your log has lost data, Readlog.exe prints a warning. To analyze the lost data, it is also important to determine what span of time was lost.
For more information, see Enabling CeLog Zones During Boot and Capturing CeLog Data During Boot.
To view boot events
From a command window, navigate to the flat release directory.
At the command prompt, type Readlog celog.clg output.txt
Readlog celog.clg output.txtThis causes Readlog to convert the binary log file celog.clg to a text file called output.txt.
From a text editor such as Notepad or Wordpad, open output.txt.
If the output file is very large, you may want to use a text editor that processes large files faster.
To find the boot events, search for the strings "nk.exe:", "filesys.dll:", and "device.exe:".
Example
The following example shows the contents of an output text file from a log that was recorded during boot with only CELZONE_BOOT_TIME was enabled:
0:00:15.015.193 : nk.exe: Launching filesys.exe
0:00:15.106.055 : filesys.exe: Object store initalized
0:00:16.525.745 : filesys.exe: Registry initialized
0:00:16.636.559 : filesys.exe: Files initialized
0:00:16.699.603 : filesys.exe: Database initialized
0:00:16.699.839 : filesys.exe: File system initialized
0:00:16.727.518 : filesys.exe: Launching CeLogFlush.exe
0:00:16.779.136 : filesys.exe: Launching shell.exe
0:00:17.091.626 : filesys.exe: Launching device.exe
0:00:18.038.225 : device.exe: Activating Drivers\BuiltIn
0:00:18.126.507 : device.exe: Activating Drivers\BuiltIn\notify
0:00:18.187.368 : device.exe: Activating Drivers\BuiltIn\WaveDev
0:00:18.321.403 : device.exe: Activating Drivers\BuiltIn\Serial
0:00:18.379.351 : device.exe: Activating Drivers\BuiltIn\NLed
0:00:18.389.546 : device.exe: Activating Drivers\BuiltIn\DMA4
0:00:18.406.115 : device.exe: Activating Drivers\BuiltIn\DMA5
0:00:18.414.685 : device.exe: Activating Drivers\BuiltIn\DMA6
0:00:18.423.285 : device.exe: Activating Drivers\BuiltIn\DMA7
0:00:18.433.297 : device.exe: Activating Drivers\BuiltIn\EMS
0:00:18.447.427 : device.exe: Activating Drivers\BuiltIn\NDIS
0:00:18.899.361 : device.exe: Activating Drivers\BuiltIn\TAPI
0:00:18.931.035 : device.exe: Activating Drivers\BuiltIn\WAPIMAN
0:00:19.286.392 : device.exe: Activating TCPIP\IPDevice
0:00:19.294.154 : device.exe: Activating TCPIP\TCPDevice
0:00:19.960.906 : device.exe: Activating Drivers\BuiltIn\NDISUIO
0:00:19.986.069 : device.exe: Activating Drivers\BuiltIn\autoras
0:00:19.998.966 : device.exe: Activating Drivers\BuiltIn\NdisPower
0:00:20.011.025 : device.exe: Activating Drivers\BuiltIn\Ethman
0:00:20.021.475 : device.exe: Activating Drivers\BuiltIn\credsvc
0:00:20.076.284 : device.exe: Activating Drivers\BuiltIn\TIMESVC
0:00:20.115.738 : device.exe: Finished initializing
0:00:20.316.650 : filesys.exe: Launching gwes.dll
0:00:20.342.957 : filesys.exe: Launching ceemulsrv.exe
0:00:21.562.620 : filesys.exe: Launching explorer.exe
0:00:21.731.785 : filesys.exe: PSLs notified of system started