How to gather and read logs for Microsoft’s USB Audio 2.0 class driver

I have blogged before about the Microsoft class driver for USB Audio 2.0 hardware.

If you are a hardware vendor, and you make USB Audio 2.0 hardware, you should expect your hardware to work with this driver.

If it doesn't, you may be interested in understanding why - maybe it's a bug on our end, or on your end, or perhaps a difference of interpretation in the spec.

To help shed light on these issues, we have logging in the driver that uses Event Tracing for Windows (ETW)'s Windows Software Trace Preprocessor (WPP).

For example, you could gather the logging from usbaudio2.sys into an .etl file using a Windows Performance Recorder Profile that includes this provider:

<EventProvider Id="WPP/usbaudio2.sys" Name="641f2b2d-ea1d-4b67-9b3c-e7da318898ae" Level="5" NonPagedMemory="true">


<Keyword Value="0x7FFFFFFF"/>



Here's the complete - you can take logs with it as follows. From an elevated command prompt or PowerShell window:

  1. wpr.exe -start usbaudio2.wprp
  2. Do your repro - for example, plug in the USB Audio 2.0 device
  3. wpr.exe -stop some-output-log-file.etl

You can stop a running trace session with wpr.exe -cancel and check whether there is a running trace session with wpr.exe -status

To actually read the logs, though, you need to decode them. You can decode WPP logs using a "program database" (PDB) file with full information (a so-called "private" PDB file), or using a collection of trace-format (TMF) files.

We at Microsoft have access to the private usbaudio2.pdb files, so we can decode them. And we have published a "public" usbaudio2.pdb, but it does not contain sufficient information to decode the WPP logs.

So to enable audio hardware vendors to read usbaudio2.sys logs, we are publishing the TMF Files for usbaudio2.sys. The .zip file includes TMF files for the Creators Update (AKA 1703 AKA 10.0.15063.*) and the Fall Creators Update (AKA 1709 AKA 10.0.16299.*)

With the TMF files in hand, you can decode the logs using a tool like tracefmt.exe which comes with the SDK and WDK. The command line to decode will be something like tracefmt.exe input-file.etl -p X:\path\to\folder\containing\tmf\files -o output-file.txt

EDIT 2018-02-26: added .wprp as an attachment, listed command lines to trace and decode, added link to tracefmt.exe documentation

Comments (2)

  1. Clement says:

    Could you provide the .wprp file for the recording ? I tried to include your event provider in an already existing wprp file but it doesn’t seem to work. I’m able to do a recording, but when I open the .etl file (with traceview) I end up with hundred of messages “unknown […] (No Information found)”.

    Thank you

    1. <?xml version="1.0" standalone=’yes’?>
      Company="Microsoft Corporation"
      Copyright="Microsoft Corporation"
      <EventCollector Id="EventCollector-NonpagedPool" Name="Event Collector NonpagedPool">
      <BufferSize Value="256"/>
      <Buffers Value="3" PercentageOfTotalMemory="true" MaximumBufferSpace="64"/>

      <EventProvider Id="WPP/usbaudio2.sys" Name="641f2b2d-ea1d-4b67-9b3c-e7da318898ae" Level="5" NonPagedMemory="true">
      <Keyword Value="0x7FFFFFFF"/>

      <Profile Id="Generated.Verbose.Memory" LoggingMode="Memory" Name="Generated" DetailLevel="Verbose" Description="Generated profile">

      <EventCollectorId Value="EventCollector-NonpagedPool">
      <EventProviderId Value="WPP/usbaudio2.sys"/>



Skip to main content