Using Event Viewer to Trace Media Foundation

  • Article

It is an unfortunate fact of life that sometimes things do not work as expected. Luckily, when bad things happen, the Event Viewer is there to help narrow down the issue and figure out the root cause of the problem.

Without these traces, finding when and why a failure happened in Media Foundation can be very tricky, because:

  • Media Foundation is asynchronous.
  • Many components come into play when processing media data (the pipeline, codecs, sources, sinks, etc.).
  • Some applications, such as Windows Media Player, use fallback mechanisms to be able to play as many files as possible.

This means that errors may get reported a long time after the failure actually took place, and the component that reports the error might not be related to the component that actually caused the failure.

Enabling Media Foundation traces in Event Viewer

Event Viewer can be found by typing ‘event’ in the search box of the Start menu:

image

To log Media Foundation traces, the verbosity of Event Viewer must be increased from its default. To do so, go to the View menu and select Show Analytic and Debug Logs:

image

The Media Foundation logs can be found in the left pane of Event Viewer, under Event Viewer (Local) > Applications and Services Logs > Microsoft > Windows. They are grouped into five categories:

  • MediaFoundation
  • MediaFoundation-MFReadWrite (Source Reader, Sink Writer)
  • MediaFoundation-Performance
  • MediaFoundation-Platform
  • MediaFoundation-PlayAPI (MFPlay API)

image

Clicking on a log will show some options on the right pane of Event Viewer related to this log. Two of them are particularly useful: Enable Log starts collecting traces, and Refresh forces Event Viewer to display the traces received so far.

image

Analyzing traces

After traces have been collected, the next step is to figure out which ones are of interest and how to interpret them. As a starting point, the following FAQ lists some questions that can be answered by looking at the logs, and which traces to look for.

Which API did Windows Media Player use for playback?

Windows Media Player relies either on Media Foundation, DirectShow, or the Format SDK, depending on the type of content being processed. To figure out which API was used, view the log named ‘MediaFoundation-Platform > Media Foundation Platform,’ and look for:

Windows Media Player Playback URL=C:\Users\Public\Videos\Sample Videos\Wildlife.wmv Graph Type=3 hr=0x0

The graph type can be:

  1. Media Foundation was run inside a secure Protected-Media-Path process (usually for DRM content).
  2. Media Foundation was run inside a non-secure Protected-Media-Path process. This type of graph is used for increased reliability. If a component crashes, it does not crash the main process.
  3. Media Foundation was run inside the main process.
  4. The Format SDK was used.
  5. DirectShow was used.

Was Media Foundation started or shut down?

In log named ‘MediaFoundation-Platform > Media Foundation Platform,’ look for:

MFStartup returned 0x0

Start MFShutdown

End MFShutdown - return code 0x0

Could the content be opened?

In the log named ‘MediaFoundation-Platform > Media Foundation Platform,’ look for events similar to the following:

Source Resolver Context(0x7318128) Resolve C:\Users\user1\Videos\Video1.45.wmv flags 0x21

Source Resolver Context(0x7318128) Trying Scheme Handler "File Scheme Handler"

Source Resolver Context(0x7318128) Trying Byte Scheme Handler CLSID("ASF Byte Stream Handler")

Source Resolver Context(0x7318128) SchemeHandler Result 0x0

Source Resolver Context(0x7318128) Byte stream Handler Result 0x0

Source Resolver Context(0x7318128) Resolving file:///C:/Users/user1/Videos/Video1.wmv returned 0x0

Were transforms found to decode/encode the content?

In the log named ‘MediaFoundation-Platform > Media Foundation Platform,’ look for events similar to the following:

MFTEnumEx flags 0x57, category {d6c02d4b-6833-45b4-971a-05a4b04bab91} for input type ({73646976-0000-0010-8000-00aa00389b71},{33564d57-0000-0010-8000-00aa00389b71}), output type ({00000000-0000-0000-0000-000000000000},{00000000-0000-0000-0000-000000000000})

Found matching software MFT "WMVideo Decoder DMO"

MFTEnumEx returned code 0x0, found 0 local MFTs, 0 hardware MFTs and 1 MFT CLSIDs

Did the topology resolution succeed?

In the log named ‘MediaFoundation > Media Foundation Pipeline,’ look for:

IMFTopoLoader::Load start

This event will be followed by

IMFTopoLoader::Load returned 0x0

in case of success, or

IMFTopoLoader::Load returned 0xc00d5212

in case of failure. (The exact error code may vary.)

Did the Media Session start?

In the log named ‘MediaFoundation-Performance > Media Foundation Performance,’ look for:

Media Session Begin Start Tag=MsBp Object=0x88cec88 Parameter=0x0

Did transforms process data?

In the log named ‘MediaFoundation-Performance > Media Foundation Performance,’ look for events similar to the following:

ProcessInput Tag=AfMs Object=0x62ddec0 Object Category=9 Sample=0x8686e28 Buffer Size=65536 Sample Time=0 Processing Time=149

ProcessOutput Tag=AfMs Object=0x62ddec0 Object Category=9 Sample=0x70efdd0 Buffer Size=62335 Sample Time=330000 Processing Time=17

That’s it. Do you find this article useful? Do you have questions on tracing your Media Foundation code? Please leave a comment.