How to gather (but not read) logs for Microsoft’s USB Audio 1.0 class driver

I’ve blogged before about how to gather and read logs for Microsoft’s USB Audio 2.0 class driver usbaudio2.sys. But what about USB Audio 1.0?

Microsoft’s USB Audio 1.0 class driver usbaudio.sys also has logs you can gather. You can’t read them, but you can send them to Microsoft, and then we can read them, because we have the necessary symbols to decode them.

  1. Download usb-audio.wprp (right-click the link and Save.) This actually grabs both USB Audio 1.0 and USB Audio 2.0 logs.
  2. Open an elevated Command Prompt or PowerShell window.
  3. wpr.exe -start usb-audio.wprp
  4. Repro the scenario (e.g. plug in the USB Audio 1.0 device)
  5. wpr.exe -stop some-filename.etl
  6. Send us some-filename.etl

Collecting audio logs the REALLY old-fashioned way – on Windows 7

I’ve blogged before about how to collect audio logs using Windows Performance Recorder profiles (WPRP files), among other things:

I’ve blogged before about what to do if you have an audio problem on Windows 7:

I’ve blogged before about the Trusted Audio Drivers audio digital rights management feature:

Recently I was involved in a Windows 7 audio support issue that involved SHA-1 deprecation and Trusted Audio Drivers. It was very handy to be able to collect audio logs and Code Integrity logs on Windows 7, but it turns out the Windows 7 version of Windows Performance Recorder has slightly different syntax requirements for WPRP files.

Here are the WPRP files we used:

How to grab a kernel memory dump during upgrade

Sometimes Windows gets stuck during upgrade – the spinny dots move, but no progress is made. If you force a reboot then Windows will roll the upgrade back, but in order to figure out why the problem is happening, it is very useful to grab a memory dump of the problem while the upgrade is in the stuck state.

To do this, follow the steps on Forcing a System Crash from the Keyboard (reworded here)

  1. Prior to the upgrade, use Registry Editor to create the following two values
    • Within the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters key, create a REG_DWORD value named CrashOnCtrlScroll, and set it to 1
    • Within the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters key, create a REG_DWORD value named CrashOnCtrlScroll, and set it to 1
  2. Reboot so that the registry change takes effect
  3. You should now be able to force a Blue Screen of Death or Green Screen of Death, at will, by holding down the rightmost Ctrl key and pressing the Scroll Lock key twice; the stop code will be MANUALLY_INITIATED_CRASH and the resulting memory dump will be at C:\Windows\MEMORY.DMP
  4. Attempt the upgrade and let it get to the point where it gets stuck
  5. Now, at the key point, hold down the rightmost Ctrl key and press the Scroll Lock key twice – you should see the Blue Screen of Death or Green Screen of Death
  6. Let it create the memory dump and roll back
  7. As described in Resolution procedures, the rollback process will move the C:\Windows\MEMORY.DMP file to C:\$Windows.~bt\Sources\Rollback\setupmem.dmp (note that C:\$Windows.~bt is a hidden folder)
  8. Depending on your memory dump settings, the file may be quite large, but even if so, it should compress well

Once you have gotten the dump file, you can go back into Registry Editor and delete the two CrashOnCtrlScroll values, then reboot.

So I have this audio problem on Windows 7…

I’ve blogged a number of times about how to use the Feedback Hub to report problems and suggest features. But if you’re using Windows 7, you don’t have the Feedback Hub. What can you do? Here’s a couple of suggestions.

  1. Try a Windows 10 machine and see if the problem still exists (or if the feature you want to suggest is still not added.) If so, great! Now you have the Feedback Hub, use it.
  2. Open a support request on
  3. Note that Windows 7 exited mainstream support on January 13, 2015, and will exit extended support on January 14, 2020, though if you’re really married to Windows 7 you will still be able to purchase extended security updates until 2023
  4. Microsoft Support has a lifecycle database you can search to see the support lifecycle for any Microsoft product. For example, it looks like Windows Embedded Standard 7 Service Pack 1 exits extended support October 13 2020

EDIT 2018-10-03: added link to lifecycle database

How to gather and read logs for Microsoft’s USB Audio 2.0 class driver

I have blogged before about the Microsoft class driver for USB Audio 2.0 hardware.

If you are a hardware vendor, and you make USB Audio 2.0 hardware, you should expect your hardware to work with this driver.

If it doesn’t, you may be interested in understanding why – maybe it’s a bug on our end, or on your end, or perhaps a difference of interpretation in the spec.

To help shed light on these issues, we have logging in the driver that uses Event Tracing for Windows (ETW)’s Windows Software Trace Preprocessor (WPP).

For example, you could gather the logging from usbaudio2.sys into an .etl file using a Windows Performance Recorder Profile that includes this provider:

<EventProvider Id="WPP/usbaudio2.sys" Name="641f2b2d-ea1d-4b67-9b3c-e7da318898ae" Level="5" NonPagedMemory="true">
        <Keyword Value="0x7FFFFFFF"/>

Here’s the complete usbaudio2-log.wprp – right-click the link and save, rather than opening it in the browser. You can take logs with it as follows. From an elevated command prompt or PowerShell window:

  1. wpr.exe -start usbaudio2-log.wprp
  2. Do your repro – for example, plug in the USB Audio 2.0 device
  3. wpr.exe -stop some-output-log-file.etl

You can stop a running trace session with wpr.exe -cancel and check whether there is a running trace session with wpr.exe -status

To actually read the logs, though, you need to decode them. You can decode WPP logs using a “program database” (PDB) file with full information (a so-called “private” PDB file), or using a collection of trace-format (TMF) files.

We at Microsoft have access to the private usbaudio2.pdb files, so we can decode them. And we have published a “public” usbaudio2.pdb, but it does not contain sufficient information to decode the WPP logs.

So to enable audio hardware vendors to read usbaudio2.sys logs, we are publishing the TMF files for usbaudio2.sys. The .zip file includes TMF files for the following versions of Windows:

  • Windows 10 version 1703 (AKA Creators Update AKA 10.0.15063.*)
  • Windows 10 version 1709 (AKA Fall Creators Update AKA 10.0.16299.*)
  • Windows 10 version 1803 (AKA April 2018 Update AKA 10.0.17134.*)
  • Windows 10 version 1809 (AKA October 2018 Update AKA 10.0.17763.*)
  • Windows 10 version 1903 (AKA May 2019 Update AKA 10.0.18362.*)
    • Note that these symbols also work for Windows 10 version 1909 AKA 10.0.18363.*
  • Windows 10 version 2004 (AKA 10.0.19041.*)

With the TMF files in hand, you can decode the logs using a tool like tracefmt.exe which comes with the SDK and WDK. The command line to decode will be something like tracefmt.exe input-file.etl -p X:\path\to\folder\containing\tmf\files -o output-file.txt

EDIT 2018-02-26: added .wprp as an attachment, listed command lines to trace and decode, added link to tracefmt.exe documentation

EDIT 2018-09-05: added TMF files for Windows 10 April 2018 Update

EDIT 2018-10-05: added TMF files for Windows 10 October 2018 Update

EDIT 2019-03-26: moved WPRP and TMF files to

EDIT 2019-04-22: added TMF files for Windows 10 May 2019 Update

EDIT 2020-08-25: added TMF files for Windows 10 version 2004

Collecting audio logs the old-fashioned way

In previous blog posts I have showed how to use the Feedback Hub to file a new problem report with logs, and to add logs to an existing problem report.

It can also be useful to gather the logs outside of the Feedback Hub environment. For example, there is a current issue in the Feedback Hub which affects builds 14996 through 15006 (it is fixed in 15007) that breaks log collection.

  1. Download
  2. Extract it to a folder
  3. From the extracted folder, launch CollectAudioLogs.cmd
  4. This will prompt for elevation; allow it.
  5. You will receive two yes/no questions. Answer y to the first if you can reproduce the issue. Always answer y to the second.
  6. The script will run for several minutes and eventually create a .zip file right next to itself. The last line of the script output will refer to the .zip file, something like this:
    Logs are located at C:\Users\mateer\Desktop\Temp\CollectAudioLogs\

EDIT 2017-04-12: updated script

EDIT 2017-05-01: updated script to run WOW64

EDIT 2017-06-01: replace “media issues” .wprp with “audio glitches” .wprp

EDIT 2017-06-06: updated powershell to work even if run WOW64

EDIT 2017-07-28: various ETW provider changes (added ACPI, removed IE, added some driver-specific providers)

EDIT 2018-01-05: more ETW provider changes (added Capability Access Manager)

EDIT 2018-02-21: allow spaces in the script path and temporary path

EDIT 2018-03-05: update ETW providers for Intel audio drivers

EDIT 2018-04-04: more ETW provider changes (added inbox effects)

EDIT 2018-12-28: grab ksthunk service registry key

EDIT 2019-03-26: move to

EDIT 2019-09-23: more ETW provider changes (added Windows Error Reporting providers)

EDIT 2019-10-20: add DdoDiag and PnpUtil. More ETW provider changes.

EDIT 2020-03-13: more ETW providers for driver frameworks and DirectSound

EDIT 2020-04-10: add System.evtx

EDIT 2020-06-04: add Application.evtx and more ETW providers for inbox drivers and driver frameworks

EDIT 2020-08-20: remove Microsoft.Windows.Audio.Service provider to avoid hang in ETW callback

EDIT 2020-12-02: put Microsoft.Windows.Audio.Service provider back now that the hang fix has been serviced

EDIT 2020-12-18: add some Realtek ETW providers

EDIT 2021-05-05: add some audio processing object ETW providers

Getting larger bluescreen memory dumps on your PC

If your PC hits a blue screen of death (or if you’re an Insider, a green screen of death) then Windows will (usually) create a C:\Windows\memory.dmp file that captures the state of the machine at the time of the crash.

Sometimes this file has enough in it to determine what the cause of the crash was; sometimes not.

There is a setting you can tweak on your PC to determine how much goes into this dump file:

Start > Settings > Search “View advanced system settings” > View advanced system settings > Startup and Recovery > Settings… > System failure > Write debugging information


From the dropdown, choose the setting you would like to apply. A good default is “Automatic memory dump”.

There is some documentation on MSDN which outlines the differences between the various types of kernel dump.

Adding logs to a reported problem in Feedback Hub

Last time I talked about how to report problems (with logs) and make suggestions in the Feedback Hub. I mentioned how to add logs when reporting a problem for the first time.

You can also add logs to problems that have already been reported.

  1. Start > Feedback Hub > Feedback | Find the problem report you want to add logs to. Note you have various filtering and sorting options.
  2. Click/tap on the specific problem report in question > Add feedback details > Recreate my problem > Start capture
  3. Make the problem happen; monitoring will continue in the background. This will go into a circular buffer. It’s OK if it takes a long time for the problem to happen; new data will overwrite old data.
  4. Come back to the Feedback Hub > Stop capture. It’s important to do this as soon as you can, once the problem has happened.
  5. Use the Submit or Submit and upvote to send us the logs. (You will see Submit and upvote if someone else submitted the feedback originally, and you have not yet upvoted it. If you submitted the issue originally, or you have already upvoted it, you will see Submit.)

EDIT: 2016-11-01 The screenshot shows “Audio and sound” and “Media Issues”. Since taking the screenshot we have removed “Audio and sound”; use “Media Issues” instead.

EDIT: 2017-10-11 We have now added an “Audio Glitches”. Use that instead.

EDIT: 2018-05-29 We’re back to “Audio and sound” again, and the UI has changed considerably. Updated screenshots and removed references to Phone.

Report problems, with logs, and suggest features, with the Feedback Hub

If you run into a problem with Windows 10, or if you would like to make a suggestion, you can use the Feedback Hub app.

(Xbox has a similar but not identical mechanism for reporting problems, called the Xbox Insider Hub)

  1. Launch the Feedback Hub app. Do a search for the thing you’re looking for. I used “usb” as an example.
  2. You can filter the category and subcategory down to make searching simpler. Note in the screenshot I have filtered down to Category: Devices and Drivers and Subcategory: Audio and sound.
  3. If you see your problem or suggestion listed already, use Upvote to reinforce it, and you’re done!
  4. If it isn’t there, congratulations – you are a pioneer! Use + Add new feedback
  5. You can select whether this is a problem or a suggestion. Give a quick summary in the title and more detail in the description. You can also attach screenshots or other files.
  6. If you are reporting a problem, it is very helpful for developers to have logs of the problem as it is happening.
    1. Use Recreate my problem > Start capture to start the log collection. Start capture will change to Stop capture.
    2. Make the problem happen.
    3. As soon as possible after the problem has happened, come back to the Feedback Hub and Stop capture. A “Recorded diagnostic data” file will be automatically attached to the feedback.
  7. Submit

If you want to share a direct link to the feedback you filed, you can use the Copy link feature.

But how do you find it again?

Well, you could search for it. But there’s a trick to make it easier. You can limit search results to feedback you have filed by clicking My feedback in the search screen. Use Sort: Most recent to get your most recently filed feedback at the top.

EDIT 2018-05-29: updated screenshots, removed references to Phone

Taking audio glitch traces on Windows 10: phone edition

Related blog post: Taking audio glitch traces on Windows 10: desktop edition

Sometimes if audio is glitching we will reach out to people and ask them to take glitch traces so we can look at them and try to figure out what is going on.

One of the tools we use to take audio glitch traces on Windows 10 phone editions is Field Medic; this is an app in the Windows Store.

To take audio glitch traces on a Windows 10 phone:

  1. On the phone:
    1. Install the Field Medic app
    2. Start | All apps | Field Medic
    3. Agree to the EULA
    4. Advanced
    5. Choose which ETW providers to use
    6. From the “…” menu, choose unselect all
    7. Under Default Group check the Multimedia-Verbose checkbox
    8. Hit the Back button to return to Advanced
    9. Hit the Back button again to return to the main Field Medic screen
    10. Hit Start Logging
    11. Note that Start Logging has become Stop Logging and a counter is advancing
    12. Reproduce the problem. The logging will continue in the background. It’s OK if it takes a while to reproduce the problem – the logging goes into a circular buffer, and old data is overwritten with new data. It is important, though, that once you do hit the issue, you should stop the logging as soon as possible (say, within 10 seconds.)
    13. Go back the Field Medic app | Stop Logging
    14. Enter a title, repro steps, attach images etc.
  2. Plug the phone into the computer via USB
  3. On the computer:
    1. Start | File Explorer | This PC | Windows phone | Phone | Documents | FieldMedic | reports
    2. You will see a subfolder containing your report
    3. Copy the whole subfolder over to the computer
    4. Right-click | Send to | Compressed (zipped) folder

At this point you have a .zip file containing your report text, images, and a FieldMedic-Multimedia-Verbose.etl file. This last can be analyzed using any tool that consumes .etl files, including:

  • Windows Performance Analyzer, which is part of the Windows Performance Toolkit
  • Media eXperience Analyzer

Both are part of the Windows Assessment and Deployment Kit (ADK)

EDIT 9/19/2016

  • Changed Multimedia + Performance to Multimedia-Verbose
  • Removed old “profile exclusivity” warning
  • Media eXperience Analyzer is now part of the ADK