How to Capture Kernel DbgPrint Output

Watch kernel DbgPrint and user-mode OutputDebugString together.

Kernel DbgPrint output is one of the most direct ways to see what a driver is doing, but you normally need a kernel debugger attached to read it. DbgPrintViewer captures it live on the running machine, and can show user-mode OutputDebugString in the same list so you see both sides of an interaction at once. This guide walks through the capture.

Download DbgPrintViewer (free)

Run Elevated

Kernel DbgPrint capture requires administrator privileges, so start DbgPrintViewer elevated. User-mode OutputDebugString capture does not require elevation, but running elevated lets you enable both sources together.

Enable the Sources

Turn on the sources you want. Each can be toggled independently at any time:

Kernel DbgPrint for kernel-mode driver and component output.
OutputDebugString for user-mode application output in the same list.

DbgPrintViewer showing combined OutputDebugString and DbgPrint output with process, PID, TID, and source — Kernel DbgPrint and OutputDebugString capture enabled together.

Use Verbose Kernel Mode When You Need Detail

Standard kernel capture is enough for most work. When you need deeper diagnostics, enable verbose kernel mode to raise the output level. It produces a much larger volume of messages, so it is best used for a focused session with filtering ready. Enabling it while a capture is already running restarts the capture at the new verbosity level.

Reproduce and Filter

With capture running, trigger the activity you are investigating: load or exercise the driver, run the operation that misbehaves. Then bring the stream under control:

Use the quick filter to narrow by any field as you type.
Build a compound filter to combine conditions with AND/OR logic.
Add highlight rules so the lines you care about stand out.
Use Find with regex or whole-word options to jump to a specific message.

Pause the display when output is moving too fast to read, and resume when you are ready. You can save the buffer to share a focused log, or reopen a saved ETL trace later.