Closed santagada closed 5 years ago
Can you try going to Settings and checking "Use other kernel logger" to see if that helps? If it does help then I can add that to the suggestions in the error message (or automatically try the other kernel logger on failures).
Apparently I don't have the Multi-* providers UIforETW asks for. any way to install them?
changing to the other kernel logger didn't make a difference.
Apparently I don't have the Multi-* providers UIforETW asks for. any way to install them?
Where did you get UIforETW from? There should be an etwpackage\bin directory which contains UIforETW.exe and also ETWProviders.dll. That is what it is looking for. These files all come from etwpackage1.50.zip.
I was running it from the default zip file... I will try again
actually you were right, I couldn't reproduct with 1.50
got the same problem with 1.56 - i am aware that 1.56 in general works. but somehow a fresh extracted etwpackage complains about that error in this older windows. is there some way to get more information?
tried the "other" solution in this post, did not work either.
Where did you get the UIforETW install from? The .zip file from the releases page should contain all of the necessary files.
If you're getting the Invalid Flags message then that means that UIforETW is requesting that ETW record some data which that version of Windows cannot record. What I do when I hit bugs like this is build UIforETW from source and keep commenting out flags until it works. The sets of flags that are most likely to be the problems are these two:
Latency+POWER+DISPATCHER+DISK_IO_INIT+FILE_IO+FILE_IO_INIT+VIRT_ALLOC+MEMINFO
Microsoft-Windows-Win32k:0xfdffffffefffffff+Multi-MAIN+Multi-FrameRate+Multi-Input+Multi-Worker+Microsoft-Windows-Kernel-Memory:0xE0+Microsoft-Windows-Kernel-Power
I'd start with the second one.
You can also experiment by copying the command line that is printed when Show commands is checked and running it from an administrator batch file. That allows experimentation without having to build from source. Be aware, however, that once you get it working you'll have to figure out how to stop tracing, because otherwise it will run indefinitely and fill your hard drive. UIforETW can be used to stop it, or you can reboot.
Somehow when trying UIforETW I can't get it to start on a machine, the error is: