Joya Systems

Call Us: 1-877-DEV-KERNEL

Using WppViewer with EtwMessagesWithStack

FAQ for viewing ETW messages with stack context.

The EtwMessagesWithStack library is a useful companion sample when you want to verify that WppViewer Studio can collect ETW messages, resolve symbols, and show the call path that produced an event. We recommend using this type of message generation sparingly and not as a replacement for WPP tracing.

The exact provider names, build commands, and sample arguments live in the GitHub repository. The WppViewer workflow is the same each time: run an elevated viewer, add the sample provider, point the workspace at the sample's decode metadata and symbols, generate events, then inspect the resulting rows, source, and stack panes.

Open sample libraryDownload WppViewer demoAsk about Studio

Quick Start

  1. Clone and build the EtwMessagesWithStack sample from GitHub.
  2. Keep the generated PDB, TMF, or other trace decode metadata from that build.
  3. Start WppViewer Studio as administrator.
  4. Create a workspace and add the sample ETW provider documented by the repository.
  5. Add the sample output folder to WppViewer's PDB or TMF search paths.
  6. Add the cloned repository folder to WppViewer's source search paths.
  7. Enable stack collection for the trace session when you need call stacks.
  8. Start capture, run the sample code, then stop capture or keep the live session open.
  9. Filter the event list to the sample provider and inspect the message, source, and stack panes.
  10. Save the workspace so the same provider and path setup can be reused.

FAQ

What is this FAQ for?
This FAQ explains the practical workflow for using WppViewer Studio with the EtwMessagesWithStack library: build or run the sample, start a WppViewer capture for the library provider, generate events, and inspect the resulting ETW messages with stack context.
Where do I get the sample library?
The sample is published at https://github.com/JoyaSystemsLLC/EtwMessagesWithStack. Use the repository README for the exact clone, build, provider, and sample-run commands.
Do I need WppViewer Studio or is the demo enough?
Use a licensed WppViewer Studio build when you want stack inspection, source view, kernel trace support, multi-provider live sessions, or large trace history. The demo can open ETL files and show WPP events, but source view, stack dump, kernel stack support, and DbgPrint stack workflows are disabled.
Why should I run WppViewer elevated?
Stack capture and kernel context depend on system-wide ETW logger features. Running WppViewer as administrator gives it the access needed to start those sessions and collect the context used for stack resolution.
What files should I give WppViewer for symbols and source?
Point WppViewer at the PDB or TMF metadata produced by the sample build, and configure source paths that include the checked-out EtwMessagesWithStack source tree. That lets the viewer format trace payloads and, when metadata is available, show file, line, and function context.
Why do I see messages but no stacks?
Check that you are using a licensed Studio build, WppViewer is elevated, stack collection is enabled for the trace session, symbols can be resolved, and the events you are viewing are ETW events that carry stack data. WPP messages themselves do not generate stack data.
Can I save the setup?
Yes. Save the WppViewer workspace after adding the provider, decode paths, source paths, and stack settings. Reopen that workspace the next time you need to capture the sample or compare a changed build.

Troubleshooting Checklist

  • If events are missing, confirm the provider GUID and level/keyword settings from the sample repository.
  • If messages are unformatted, verify the PDB or TMF path points at the current build output.
  • If source locations are empty, add the checked-out source folder and rebuild with source metadata.
  • If stacks are missing, run elevated and use a licensed Studio build with stack capture enabled.
  • If symbols do not resolve, add your local symbol path or symbol server and reload the trace.

Stack traces are available for ETW messages and DbgPrint events. WPP messages do not generate stack data.