16.6.1  Calling IoAllocateErrorLogEntry

When an NT driver discovers an I/O error in processing an IRP, it should call IoAllocateErrorLogEntry as follows:

size = sizeof(IO_ERROR_LOG_PACKET) + (n * sizeof(ULONG))

                                   + sizeof(InsertionStrings);

                    // where n depends on how much

                    // DumpData the driver will supply

errorLogEntry = (PIO_ERROR_LOG_PACKET)IoAllocateErrorLogEntry(

    deviceExtension->DeviceObject,

                            // target device for current operation

    size);

Note that an error log packet is limited in size, and the system-defined limit includes any dump data and insertion strings that the driver supplies with a packet. NT drivers can call IoAllocateErrorLogEntry with a specified EntrySize value that is, at most, ERROR_LOG_MAXIMUM_SIZE.

IoAllocateErrorLogEntry returns a pointer to an error log packet. If the returned pointer is NULL, the driver need not log an error. It should simply continue running and assume that, if the same error occurs again, it can be logged at that point.