Readlog Tool (Windows CE 5.0)
Readlog (Readlog.exe) is a command-line tool that performs a conversion of the kernel tracker output, generated in CeLog (.clg) format, into text (.txt) format.
The options available for use with Readlog are divided into two categories: print options and utility options.
- Print options generate output in text (.txt) format.
- Utility options generate a new CeLog file. Read this file by running the Readlog tool again on the new output.
The following code example shows the Readlog syntax:
readlog [ PrintOptions | UtilityOptions ] InfileOutfile
Parameters
InFile
Specifies the name of the CeLog (.clg) file to read.OutFile
Specifies the name of the text file to generate, if the "-sync" option is not used. If the "-sync" option is used, this specifies the name of the new log file.PrintOptions
Specifies formatting options for output in text file format.-v
Prints verbose information.
-s
Print summary of logged events. If a range is provided, the summary includes only events in the range.
-d
Prints timestamps as the length of time elapsed since the last event, rather than absolute times.
-u
Prints Unicode output.
-e
Prints timestamps as comma delimited number of microseconds, which are readable in Excel.
-ids
Prints IDs for all events.
-range <ID1><ID2>
Prints only events from <ID1> to <ID2>, inclusive.
-f <parameter>
Filters out selected events, which are specified using additional parameters. The default setting is no filtering. These are case-sensitive parameters.
The following table shows the parameters that specify which events Readlog removes if the parameter -f is used.
Value Description T Removes thread, reschedule, migrate, and priority-invert events. P Removes process events. I Removes interrupt events. K Removes KCALL entry and exit events. M Removes memtrack events such as heap allocations, reallocations, and frees. C Removes critical section events. S Removes synchronization objects such as semaphores, mutexes, and events. X Removes all system events. This has the same effect as using the TPIKMCS flags in a command. UtilityOptions
Specifies formatting options for output in CeLog format.-sync
Generates a new CeLog file with a sync header at the top.
-fixtime
Generates a new CeLog file where the timestamp does not roll over.
-fixthreads
Generates a new CeLog file with fixed thread names.
-plugin
Generates a new CeLog file with plugin string replacements.
-copy
Generates a new CeLog file with data from events flagged with the -range parameter only.
Examples
The following code example shows a Readlog conversion of Celog.clg data into text without any filters enabled.
readlog celog.clg output.txt
The following code example shows a Readlog conversion of Celog.clg data into text with the -sync option enabled.
readlog -sync celog.clg new.clg
readlog new.clg output.txt
The following code example shows a Readlog conversion of Celog.clg data into text with filters enabled. These filter settings remove KCALL, memtrack, critical section, and synchronization events from the converted data, and then write it to Output.txt.
readlog -f KMCS celog.clg output.txt
Remarks
The -sync parameter is most useful for producing log files that are readable to the Remote Kernel Tracker tool. This tool will not display any data preceding the first sync header in the log.
The CeLogReSync API produces a sync header, which is a listing of all processes, threads, and modules that are currently present in the system. The log file might lack a sync header at the top if the log file is deleted or renamed while data is being collected. If the file is deleted, it will be recreated and a sync header will eventually be added to the log, but the header will not be at the beginning of the file.
You can also create custom filter parameters by setting values in the registry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\CeLog Reader\Filters, using the following format. The "FilterKey" must be a single character, and is case-sensitive.
"FilterKey"="hexID1,hexID2,hexID3,..."
The following code example shows a custom filter that can be used with the "-f c" parameters to remove events with IDs 1, 2, 11, and 12, which correspond to critical section events.
"c"="1,2,b,c"
See Also
Readlog Viewing Tool | CeLog Event Tracking | Remote Kernel Tracker
Send Feedback on this topic to the authors