Why doesn't busTRACE capture I/O activity on my peripheral device?

busTRACE only captures I/O activity going on between Windows and any USB device or storage class device (e.g. hard drives, tape drives, CD/DVD/BD drives, etc.). Any other device type will not appear to busTRACE. Is your device a supported device?

If you have a supported device that does not appear to busTRACE, please contact us so that we can assist you.

If busTRACE does see the device, but is unable to capture I/O activity going to the device, select the Driver Settings option under the Tools main menu. Make sure you have Advanced Filtering Enabled checked and try again.

If you are running the checked build of Windows (available with MSDN), please try against the free build to see if that makes a difference.

Lastly, verify that your settings are properly configured in the Driver Settings dialog box (available under the Tools main menu).

Why is busTRACE reporting the number of "Bytes Transferred" as being greater than what I know was actually transferred to/from the device?

The first thing you need to check is whether or not you are seeing this on an IDE/ATAPI bus. There is a limitation with the IDE/ATAPI bus, and some miniport drivers, in that it cannot properly return the number of bytes transferred when configured for DMA mode. The end result is that the miniport driver will report the number of bytes transferred as the number of bytes requested. For example, you pass in a 256 byte data buffer for an Inquiry command, and you only receive 36 bytes. The "Bytes Transferred" would incorrectly return back 256 bytes. Some other miniport drivers also exhibit this limitation.

Sometimes the software bus analyzer shows a different device name than the other applications. Why?

Our other applications send down an actual Inquiry CDB to the device to get its device name. Our software bus analyzer, on the other hand, asks the operating system what the device name is. While these names usually match, they are sometimes different. You will find that busTRACE matches what Windows' Device Manager reports. This is normal behavior.

When running the "busTRACE Remote Server," I receive an error of "Only one usage of each socket address (protocol/network address/port) is normally permitted (00002740h)." Why?

You probably have another application on your system using the same TCP/IP Port (e.g. port 99). You will need to close the other software using the port number, or reconfigure the busTRACE Remote Server to use a different port. When changing port values, be sure that both the remote server and busTRACE application are configured to use the same port number.

Why is my system crashing with a DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS blue screen?

When you are capturing I/O activity with busTRACE 10.0, we have received isolated reports of a DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS blue screen. If you have a kernel debugger attached, the system may be incorrectly reporting that the failure is due to busTRACE. This problem is caused by a bug in some bus drivers, not by busTRACE. Please check your bus driver to ensure it is the latest revision. If you require assistance, please contact us.

Under Windows Server 2008 R2, in a Hyper-V virtual machine, I do not see the read and write CDBs going to my hard drive. Why?

After you install the Hyper-V Integration Services in the Guest OS, a storage filter driver (STORFLT) is installed in the OS that captures the CDBs at a higher level and processes them there for increased performance. The only way around this is to disable the storage filter driver. You might have slightly decreased performance but then CDBs will continue to flow down the I/O stack and busTRACE can capture them. In order to disable STORFLT, you will need to go into the registry of the Guest OS and edit this location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storflt

Change the "Enabled" DWORD from 0x00000001 to 0x00000000. Then reboot the Guest OS. Please note that after you do this, a warning will be logged in the Event Log with each boot. It will state that "The Virtual Storage Filter Driver is disabled through the registry. It is inactive for all disk drives."

See Also: