hdaudio.sys and hdaudbus.sys log WPP events using the same ETW provider.
You can gather these logs using this .wprp, but you won’t be able to read them
without symbols, and the symbols aren’t public.
https://matthewvaneerde.wordpress.com/2017/01/09/collecting-audio-logs-the-old-fashioned-way/
The interesting part of the .wprp is:
<EventProvider Id="WPP/hdaudio.sys-hdaudbus.sys"
Name="b3a109ec-1cb3-4947-95ed-431033eeb1b4" Level="5" NonPagedMemory="true">
<Keywords>
<Keyword Value="0x7FFFFFFF"/>
</Keywords>
</EventProvider>
From: Tsai Tzung-Dar<mailto:hsinpingwei@xxxxxxxxxxx>
Sent: Sunday, December 29, 2019 8:28 PM
To: wdmaudiodev@xxxxxxxxxxxxx<mailto:wdmaudiodev@xxxxxxxxxxxxx>
Subject: [EXTERNAL] [wdmaudiodev] ETW log for In-Box HDA host controller bus
Driver
Hi all
I want to check does there is FIFO error occur in HDA host controller. Does
there any ETW trace log for In-Box HDA host controller bus driver? Thanks your
advise.
BR,
Hsinpingwei
