busTRACE This WEB page comes from the busTRACE 9.0 User's Manual. (Table of Contents)

Previous Topic Next Topic

busTRACE 9.0 has the ability to filter captured I/O activity. This allows you to view only the types of I/O requests you are interested in analyzing.

busTRACE provides you two methods for filtering requests. The first is our Kernel Mode CDB Filter. This filter lets the busTRACE device driver know which Command Descriptor Blocks should be captured and which should be skipped. The I/Os are not captured nor do they take up memory. This feature is discussed in detail in our Kernel Mode CDB Filter section.

The second method is busTRACE's ability to filter captured I/O activity from view. These I/O requests are still stored in memory, just filtered from the I/O Capture List. The filtered I/Os are still in memory and you can readjust the filter to view them again.

Context Based Filtering

The simplest and fastest way to filter I/O activity is to right click on an I/O in the I/O Capture List. Two filter menu options will appear. The first option allows you to filter out the selected I/O based on one of four criteria:

  • If you right click on the Error Indicator icon for the I/O, you can filter out all I/O that produce that same result.
  • If you right click on the Device icon for the I/O, you can filter out all I/O that was processed by that device.
  • If you right click on the Originator driver name for the I/O, you can filter out all I/O that was generated by that driver.
  • if you right click anywhere else on the I/O, you can filter out all I/Os that have the same name (e.g. all "Test Unit Ready" commands).

The second menu option allows you to Remove I/O Filters. This setting will turn off all filtered settings and show you all of the captured I/O activity.

Filtered Commands Dialog Box

You can also filter I/O activity by viewing our Filtered Commands dialog box. Simly right click on any captured I/O, in the I/O Capture List, and choose the Filter I/O Activity option. You will see a dialog box come up with four different options to choose from: General, Command/Status, Originator, and Devices.

The filtering options only filter I/O activity from view. They still remain in memory and can be viewed again by adjusting your filter settings.

General Filter Options

You can filter out General I/O activity that applies to all devices.

Group consecutive identical I/Os together

By placing a checkmark on this option, you are configuring busTRACE to group identical I/Os together. For example, let's say you have captured I/O activity and there is a burst of 25+ Test Unit Ready commands being sent at regular intervals (not uncommon in Windows). The I/O Capture List window will be filled with Test Unit Ready commands interspersed with other commands that you might be more interested in analyzing. If you place a checkmark on this option, busTRACE will collapse all identical Test Unit Ready commands into a single entry.

Filter out non-execution SCSI Request Blocks (SRBs)

You can also Filter out non-execution SCSI Request Blocks (SRBs). For storage class devices (e.g. hard drives, tape drives, CD/DVD drives), Windows drivers build up SCSI Request Blocks (SRBs) to deliver a CDB (Command Descriptor Block) to a device. Embedded within the SRB structure is a Function field. The SRB function specifies the operation to be performed. Typically, this value is set to SRB_FUNCTION_EXECUTE_SCSI which is used to send a CDB to a device. However, the function field might also be used to abort a command, reset a device, flush any data, and more.

You may find that all the non-execution SRBs that busTRACE has captured are getting in the way of you analyzing the CDBs that were sent. If so, simply place a checkmark on this option and busTRACE will filter out all non-execution SRBs (i.e. all SRBs that do not have function SRB_FUNCTION_EXECUTE_SCSI).

This filtering only applies to storage class devices. It does not affect your device if you're only capturing low-level USB data (i.e. URBs). If you would like more details on available SRB functions, please refer to Microsoft's Windows Driver Development Kit.

Filter out user injected messages

By placing a checkmark on this option, you are configuring busTRACE to filter out all user injected messages. These are messages you inserted from the Capture Status window, or messages you injected from your own software.

Command/Status Filter Options

A particularly powerful filtering option is busTRACE's ability to filter out specific commands or specific status. By default, all commands captured and all status seen have a checkmark next to them indicating that they are currently being viewed in the I/O Capture List window.

By removing a checkmark, you are instructing busTRACE to no longer show any I/O with that command sent, or any I/O with the return status, in the I/O Capture List window.

Originator Filter Options

busTRACE has the ability to detect which driver originated the I/O activity. The Originator tab allows you to configure busTRACE to filter out any I/O activity that was sent from a specific driver.

By default, busTRACE places a checkmark on all I/O originators indicating that you want no I/O activity filtered. Simply remove the checkmark from I/Os generated by the given Originator to filter out its I/O activity.

Devices Filter Options

In most configurations, you are capturing I/O activity for only one device (the device you are interested in analyzing). What if all devices had their I/O activity captured but you were only interested in one specific device? This may occur if someone else captures I/O activity and sends you the capture file for analysis.

There are multiple ways for you to get to the device I/O you are interested in. One of the simplest is to use the Devices filtering option.

In its default configuration, a checkmark appears next to all devices. This tells busTRACE to show the I/O activity that was captured for all devices. If you are interested in viewing I/O activity for only one device, simply remove the checkmark from all other devices.

LBA Range Filter Options

You may only want to view Read/Write requests that access sectors within a given LBA range. That is what the LBA Range filter setting is for. You can specify an LBA range and busTRACE will filter from view any Read/Write Sector request that does not access data within that range.

The Start LBA and End LBA specify the LBA range. You can optionally configure the settings to only show you Read requests, Write requests, or Verify/Seek requests.

Load/Save Cached Filters

Once you have configured busTRACE to filter out I/O activity, you may want to save those settings to our Filtered Commands cache. This allows you to quickly reuse the same filter settings at a later time.

To get to this feature, you need to click on the drop down arrow on the right part of the Filter toolbar button. When you do, a drop-down menu with the available options will appear.

The first entry is to "Load/Save Cached Filters..." If you select this option, a dialog box will appear letting you Load, Remove, or Save the current filter settings. If you have previously saved any filter settings, the most recently used list will appear below the "Load/Save Cached Filters..." menu item. You can simply select the item to immediately apply the previously cached filter settings.

Selecting the "Load/Save Cached Filters..." menu item will bring you to our Cached Filtered Commands options:

If you have previously saved any filtered settings, they will appear in the "Previously saved filtered commands" window. The following options are available:

Load Filter

If you have previously saved any filter settings, you can select this option to load the filter settings and have them applied to your current capture. You may find it faster to simply select the option from the "Filter" toolbar drop down menu (see description above).

Remove Filter

If you want to remove one or more previously saved filters, simply select one or more items and then select this Remove Filter button.

Save Filter

Once you enter a filter description, you can then select this option to add the current capture's filter settings to our Cached Filtered Commands. The newly added item is automatically inserted at the front of the list.

If there is an existing entry with the same description, you will be prompted to make sure you want to overwrite the previously cached setting.

See Also: