Error Message
While working on Accelerated Windows Software Trace Analysis training50 we discovered some missing patterns needed for completeness despite their triviality. One of them is called Error Message. Here an error is reported either explicitly (”operation failed”) or implicitly as an operation status result such as 0xC00000XX. Sometimes, a trace message designer specifies that the number value is supplied for information only and should be ignored. Some error messages may contain information that is not relevant for the current software incident, the so called false positive errors (Volume 5, page 303). Some tracing architectures and tools include message information category for errors, such as Citrix CDF (ETW-based), where we can filter by error category51 to get an adjoint thread (Volume 5, page 283). Please note that the association of a trace statement with an error category is left at the discretion of an engineer writing code and information category messages may contain implicit errors such as last error and return status reports.
50 http://www.patterndiagnostics.com/accelerated-software-trace-analysis