tracelog gives no output

[Monk3yDLuffy]

Hi, I was trying to get output of bpf_printk on cmd and tried as mentioned in getting started doc but got following output with no further results from my bpf_printk.

C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64>tracelog.exe -start MyTrace -guid ../../../../../../Users/Protolab_win_ebpf/ebpf-for-windows/scripts/ebpf-all.guid -rt

Logger Started...
Enabling 394f321c-5cf4-404c-aa34-4df1428a7f9c (Flags = 0x00000000 Level = 0  ) to logger 43
Enabling f2f2ca01-ad02-4a07-9e90-95a2334f3692 (Flags = 0x00000000 Level = 0  ) to logger 43
Operation Status:       0L      The operation completed successfully.

Logger Name:            MyTrace
Logger Id:              0x2b
Logger Thread Id:       00000000000005B4
Guid:                   59c96f0a-0854-11ed-94d6-000d3a99c6aa
Session Security:       D:(A;;0x1800;;;WD)(A;;0x120fff;;;SY)(A;;0x120fff;;;LS)(A;;0x120fff;;;NS)(A;;0x120fff;;;BA)(A;;0xee5;;;LU)(A;;LC;;;MU)(A;;0x1800;;;AC)(A;;0x1800;;;S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187)
Buffer Size:            64 Kb
Maximum Buffers:        26
Minimum Buffers:        4
Number of Buffers:      4
Free Buffers:           4
Buffers Written:        0
Events Lost:            0
Log Buffers Lost:       0
Real Time Buffers Lost: 0
Real Time Consumers:    0
ClockType:              PerfCounter
Log Mode:               Sequential Realtime
Hybrid Shutdown:        Stop
Maximum File Size:      not set
Buffer Flush Timer:     1 secs
Log Filename:

C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64>tracefmt -rt MyTrace -displayonly -jsonMeta 0

Setting RealTime mode for  MyTrace
Examining C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64\default.tmf for message formats,  3 found.
Searching for TMF files on path: C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x64

Is there anything i need to change with my setup?

[Dave Thaler (dthaler)]

All of the output you pasted looks normal. Since you used ebpf-all.guid not just ebpf-printk.guid, you ought to then see additional output whenever the ebpf driver does anything, such as loading a program. For example:

C:\Temp>tracefmt -rt MyTrace -displayonly -jsonMeta 0
Setting RealTime mode for  MyTrace
Examining C:\Temp\default.tmf for message formats,  none found, file not found
Searching for TMF files on path: C:\Temp
[2]072C.08A8::08/12/2022-09:57:37.887 [EbpfForWindowsProvider]{"Message":"ebpf_api_initiate returned success"}
[1]072C.08A8::08/12/2022-09:57:37.891 [EbpfForWindowsProvider]{"<==":"_ebpf_program_descriptor_free"}
[1]072C.08A8::08/12/2022-09:57:37.891 [EbpfForWindowsProvider]{"==>":"_ebpf_program_descriptor_free"}
[1]072C.08A8::08/12/2022-09:57:37.891 [EbpfForWindowsProvider]{"<==":"_ebpf_program_descriptor_free"}
[1]072C.08A8::08/12/2022-09:57:37.891 [EbpfForWindowsProvider]{"==>":"_ebpf_program_descriptor_free"}
...

If you don't, can you provide more information about how you installed ebpf, and what "sc query ebpfcore" shows?