typedef struct _IO_ERROR_LOG_PACKET { UCHAR MajorFunctionCode; UCHAR RetryCount; USHORT DumpDataSize; USHORT NumberOfStrings; USHORT StringOffset; USHORT EventCategory; NTSTATUS ErrorCode; ULONG UniqueErrorValue; NTSTATUS FinalStatus; ULONG SequenceNumber; ULONG IoControlCode; LARGE_INTEGER DeviceOffset; ULONG DumpData[1]; } IO_ERROR_LOG_PACKET, *PIO_ERROR_LOG_PACKET;
The driver should fill in an error log packet with the following data:
RetryCount is a zero-based value. That is, the driver should set it to
zero when an error is first encountered for the current IRP.
The specified value should be an integral multiple of sizeof(ULONG).
The NT error-logging thread can use these driver-supplied, zero-terminated Unicode strings to fill in messages written into the Win32 event log, where it can be examined using the Win32 event viewer. The I/O Manager assumes that the initial insertion string, if any, is either the name of the driver or of the device on which the error occurred.
Insertion strings provided by a driver should be language independent. Drivers that log errors and use insertion strings should use strings read from the registry or use names which are language independent or are the same in any language, for example, file names.
In most cases, NT device and intermediate drivers can simply log I/O errors
without having to supply insertion strings for a higher-level event-logging
component and/or without having to set up a driver-specific event-logging
component. Of the system-supplied NT drivers, only network device drivers
currently supply insertion strings in error log packets.
If a driver supplies this data, each string must be a zero-terminated Unicode
string.
Most NT device and intermediate drivers set this value to zero. For more
information about setting up an event-logging component, see Section
16.8.4.
This is a system-defined or driver-defined constant, as described in Section
16.6.5.
For more information about I/O control codes and device I/O control requests,
see the Kernel-Mode Driver Reference.
Any driver-supplied insertion strings must be supplied immediately following the dump data, starting at StringOffset.