# How to gather and read logs for Microsoft’s USB Audio 2.0 class driver

I have blogged before about the Microsoft class driver for USB Audio 2.0 hardware.

If you are a hardware vendor, and you make USB Audio 2.0 hardware, you should expect your hardware to work with this driver.

If it doesn’t, you may be interested in understanding why – maybe it’s a bug on our end, or on your end, or perhaps a difference of interpretation in the spec.

To help shed light on these issues, we have logging in the driver that uses Event Tracing for Windows (ETW)’s Windows Software Trace Preprocessor (WPP).

For example, you could gather the logging from usbaudio2.sys into an .etl file using a Windows Performance Recorder Profile that includes this provider:

<EventProvider Id="WPP/usbaudio2.sys" Name="641f2b2d-ea1d-4b67-9b3c-e7da318898ae" Level="5" NonPagedMemory="true">
<Keywords>
<Keyword Value="0x7FFFFFFF"/>
</Keywords>
</EventProvider>

Here’s the complete usbaudio2-log.wprp – right-click the link and save, rather than opening it in the browser. You can take logs with it as follows. From an elevated command prompt or PowerShell window:

1. wpr.exe -start usbaudio2-log.wprp
2. Do your repro – for example, plug in the USB Audio 2.0 device
3. wpr.exe -stop some-output-log-file.etl

You can stop a running trace session with wpr.exe -cancel and check whether there is a running trace session with wpr.exe -status

To actually read the logs, though, you need to decode them. You can decode WPP logs using a “program database” (PDB) file with full information (a so-called “private” PDB file), or using a collection of trace-format (TMF) files.

We at Microsoft have access to the private usbaudio2.pdb files, so we can decode them. And we have published a “public” usbaudio2.pdb, but it does not contain sufficient information to decode the WPP logs.

So to enable audio hardware vendors to read usbaudio2.sys logs, we are publishing the TMF files for usbaudio2.sys. The .zip file includes TMF files for the following versions of Windows:

• Windows 10 version 1703 (AKA Creators Update AKA 10.0.15063.*)
• Windows 10 version 1709 (AKA Fall Creators Update AKA 10.0.16299.*)
• Windows 10 version 1803 (AKA April 2018 Update AKA 10.0.17134.*)
• Windows 10 version 1809 (AKA October 2018 Update AKA 10.0.17763.*)
• Windows 10 version 1903 (AKA May 2019 Update AKA 10.0.18362.*)
• Note that these symbols also work for Windows 10 version 1909 AKA 10.0.18363.*
• Windows 10 version 2004 (AKA 10.0.19041.*)

With the TMF files in hand, you can decode the logs using a tool like tracefmt.exe which comes with the SDK and WDK. The command line to decode will be something like tracefmt.exe input-file.etl -p X:\path\to\folder\containing\tmf\files -o output-file.txt

EDIT 2018-02-26: added .wprp as an attachment, listed command lines to trace and decode, added link to tracefmt.exe documentation

EDIT 2018-09-05: added TMF files for Windows 10 April 2018 Update

EDIT 2018-10-05: added TMF files for Windows 10 October 2018 Update

EDIT 2019-03-26: moved WPRP and TMF files to https://github.com/mvaneerde/blog

EDIT 2019-04-22: added TMF files for Windows 10 May 2019 Update

EDIT 2020-08-25: added TMF files for Windows 10 version 2004

## One thought on “How to gather and read logs for Microsoft’s USB Audio 2.0 class driver”

1. Chris Fryer says:

This looks very useful. Is there a quicker way to get tracefmt.exe than installing the entire WDK?

Like