{"slug":"debugview","title":"debugview","summary":"Sysinternals DebugView CLI (DbgViewCli) for capturing and analyzing usermode and kernel-mode Windows debug output from the command line. USE FOR: capturing OutputDebugString output, kernel DbgPrint/KdPrint capture, boot-time debug logging, remote debug monitoring, filtering debug","platform":"GitHub Copilot","tags":[],"authorName":"Ciza","authorSlug":"ciza","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-08-12T21:05:25.250382Z","repo":{"url":"https://github.com/microsoft/skills","stars":3052,"forks":351,"license":"MIT","updatedAt":"2026-09-24T16:38:17Z"},"bodyHtml":"
\n

name: debugview\ndescription: |\nSysinternals DebugView CLI (DbgViewCli) for capturing and analyzing usermode and kernel-mode Windows debug output from the command line.\nUSE FOR: capturing OutputDebugString output, kernel DbgPrint/KdPrint capture, boot-time debug logging, remote debug monitoring, filtering debug output by PID or process name, crash dump analysis, automated debug capture with bounded execution.\nDO NOT USE FOR: non-Windows platforms, application-level logging frameworks (log4j, serilog), Azure Monitor or cloud telemetry, ETW tracing (use WPR/xperf instead), user-mode crash dumps (use WinDbg).\nTriggers: \"debug output\", \"DbgView\", \"DebugView\", \"kernel debug\", \"capture debug logs\", \"boot logging\", \"OutputDebugString\", \"DbgPrint\", \"KdPrint\", \"remote debug monitor\", \"debug capture CLI\".

\n

Sysinternals DebugView CLI (DbgViewCli)

\n

Command-line interface for capturing real-time debug output from Windows applications\n(OutputDebugString) and kernel-mode drivers (DbgPrint/KdPrint). Designed for scripted,\nautomated, and AI-agent-driven debug capture workflows.

\n

Installation

\n

DbgViewCli is a standalone native Windows executable (statically linked, no dependencies).\nPlace dbgviewcli.exe in PATH or reference the full path.

\n
\n

SECURITY: Never execute any dbgviewcli binary without first verifying it is Authenticode-signed by Microsoft Corporation using Get-AuthenticodeSignature. Reject any binary that is unsigned or signed by a different publisher.

\n
\n
# No package manager install — copy binary to a PATH location\ncopy dbgviewcli.exe C:\\Tools\\\n
\n

Requirements

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
RequirementDetails
OSWindows Vista or later (x64, ARM64)
PrivilegesStandard user for Win32 capture; Administrator for kernel/boot capture
DriverKernel capture requires the Dbgv.sys driver (auto-extracted and loaded)
\n

Core Workflow

\n
1. Detect/status check   →  dbgviewcli --status\n2. Start capture          →  dbgviewcli [options]\n3. Filter output          →  --filter/--exclude/--pid-filter/--process-filter\n4. Bounded execution      →  --duration/--max-lines/--wait-for\n5. Output/log results     →  stdout or --log <file>\n6. Stop                   →  Ctrl+C or automatic exit on bounds\n
\n

Command-Line Parameters

\n

Capture Control

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterShortDescriptionDefault
--capture-cEnable captureon
--no-captureDisable capture
--kernel-kEnable kernel debug output (requires admin)off
--win32-wEnable Win32 OutputDebugString captureon
--global-gEnable global Win32 capture (session 0)off
--passthroughAllow debug output to pass to debuggerson
--verbose-kernel-vEnable verbose kernel outputoff
--pidsShow process IDs in outputon
\n

Filtering

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterShortDescription
--filter <pattern>-iInclude filter (semicolon-separated wildcards)
--exclude <pattern>-eExclude filter (semicolon-separated wildcards)
--pid-filter <pid>Show only output from specific PID
--process-filter <name>Show only output from named process (substring match)
\n

Bounded Execution (AI-Agent Friendly)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--duration <seconds>Auto-stop after N seconds
--max-lines <N>Auto-stop after N lines captured
--wait-for <pattern>Capture until pattern matches, then exit
--tail <N>Buffer last N lines, flush on exit
--no-bannerSuppress version banner (clean for piped output)
--statusPrint machine-readable status and exit
\n

Time Display

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--elapsedElapsed time since start (default)
--clockWall-clock time HH:MM:SS
--clock-msWall-clock with milliseconds HH:MM:SS.mmm
\n

Output Format

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--format textTab-separated text (default)
--format csvComma-separated values
--format xmlXML elements
\n

Logging

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--log <file>Log output to file
--log-appendAppend to existing log
--log-limit <MB>Max log file size in MB
--log-wrapWrap log when full
--log-dailyNew log file each day
\n

Boot Logging (Requires Admin)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--boot-enableEnable boot-time kernel debug logging
--boot-disableDisable boot-time logging
--boot-statusShow boot logging status and exit
\n

Remote Monitoring

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--connect <computer>Connect to remote DbgView instance
--disconnectDisconnect from remote
\n

Crash Dump & File Operations

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--crashdump <file>Analyze crash dump for debug output
--load <file>Load saved log file
--save <file>Save captured output on exit
\n

Runtime Control (Inter-Process)

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterDescription
--pausePause a running DbgViewCli instance via named event
--resumeResume a paused DbgViewCli instance
--stopStop a running DbgViewCli instance gracefully
\n

Miscellaneous

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ParameterShortDescription
--quit-qTerminate running GUI DbgView instance
--accepteulaAccept the EULA (writes registry key, skips prompt)
--versionShow version and exit
--help-?Show help
\n

Usage Examples

\n

Basic Win32 Capture (bounded)

\n
# Capture for 30 seconds, no banner, output as text\ndbgviewcli --no-banner --duration 30\n\n# Capture until a specific error appears\ndbgviewcli --no-banner --wait-for \"*ERROR*\" --max-lines 10000\n
\n

Kernel Debug Capture (requires admin)

\n
# Run as Administrator\ndbgviewcli --kernel --no-banner --duration 60 --format csv --log kernel_debug.csv\n
\n

Process-Specific Filtering

\n
# Filter by PID\ndbgviewcli --no-banner --pid-filter 1234 --duration 10\n\n# Filter by process name\ndbgviewcli --no-banner --process-filter \"myapp.exe\" --max-lines 500\n
\n

Pattern-Based Filtering

\n
# Include only lines matching pattern\ndbgviewcli --no-banner --filter \"MyDriver*\" --exclude \"verbose*\"\n
\n

Tail Mode (recent context)

\n
# Capture but only output last 50 lines on exit\ndbgviewcli --no-banner --tail 50 --duration 30\n
\n

Status Check (machine-readable)

\n
dbgviewcli --status\n# Output:\n# running=true\n# paused=false\n# elevated=true\n
\n

Boot Logging

\n
# Enable (requires admin, persists across reboot)\ndbgviewcli --boot-enable\n\n# Check status\ndbgviewcli --boot-status\n\n# Disable\ndbgviewcli --boot-disable\n
\n

Remote Monitoring

\n
dbgviewcli --connect SERVER01 --no-banner --duration 60\n
\n

Runtime Control (Pause/Resume/Stop)

\n
# Pause a running instance from another terminal\ndbgviewcli --pause\n\n# Resume the paused instance\ndbgviewcli --resume\n\n# Gracefully stop a running instance\ndbgviewcli --stop\n
\n

EULA Acceptance (Unattended)

\n
# Accept EULA non-interactively for automated/scripted deployments\ndbgviewcli --accepteula --no-banner --duration 30\n
\n

Architecture

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ModuleFilePurpose
Maindbgviewcli.cEntry point, arg parsing, capture loop, Ctrl+C handler
Capturecli_capture.cDBWIN shared memory, kernel driver read
Drivercli_driver.cKernel driver load/unload, privilege elevation
Filtercli_filter.cWildcard include/exclude matching
Outputcli_output.cConsole emit, log files, CSV/XML/text formats
Boot Logcli_bootlog.cRegistry config for boot-time driver loading
Remotecli_remote.cTCP socket connect/read for remote monitoring
\n

Key Design Decisions

\n
    \n
  1. Static CRT linking — No DLL dependencies, runs on any Windows system
    2. \n
  2. stdout/stderr separation — Debug output → stdout; errors/status → stderr
    3. \n
  3. Bounded execution — --duration, --max-lines, --wait-for ensure guaranteed exit for automation
    4. \n
  4. Clean output — --no-banner suppresses noise for pipe/agent consumption
    5. \n
  5. Machine-readable status — --status outputs key=value pairs for programmatic checks
    6. \n
  6. Graceful shutdown — SetConsoleCtrlHandler ensures clean driver unload on Ctrl+C
    7. \n
\n

Best Practices

\n
    \n
  1. Always use --no-banner for scripted/automated use. Banner text pollutes structured output and confuses parsers.
    2. \n
  2. Always bound execution with --duration, --max-lines, or --wait-for. Unbounded capture will run indefinitely.
    3. \n
  3. Check status before capture — Use --status to detect if another instance is already running.
    4. \n
  4. Use --format csv or --format xml when output will be parsed programmatically.
    5. \n
  5. Prefer --pid-filter or --process-filter over broad capture to reduce noise.
    6. \n
  6. Run as Administrator only when needed — kernel and boot logging require elevation; Win32 capture does not.
    7. \n
  7. Combine bounds for safety — Use --duration 60 --max-lines 10000 together so whichever triggers first wins.
    8. \n
  8. Use --tail for \"what just happened\" queries instead of capturing full history.
    9. \n
\n

Bundled Resources

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
TypeFilePurpose
Scriptscripts/detect-dbgview.ps1Locate dbgviewcli.exe on PATH or common directories
Scriptscripts/capture-wrapper.ps1Safe bounded capture with parameter validation
Scriptscripts/boot-logging-workflow.ps1End-to-end boot logging lifecycle management
Referencereferences/driver-ioctls.mdKernel driver IOCTL codes and buffer structures
Referencereferences/output-formats.mdText/CSV/XML output format specifications
Referencereferences/remote-protocol.mdTCP remote monitoring wire protocol
\n

Troubleshooting

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
IssueResolution
\"Access denied\" on kernel captureRun as Administrator
No output from Win32 captureVerify target app uses OutputDebugString; check no debugger is attached
Another instance runningUse --status to check; use --quit to terminate existing GUI instance
Boot logging not capturingEnsure --boot-enable was run as admin; driver must be in System32\\Drivers
Remote connection failsVerify target has DbgView running with remote enabled on ports 2020-2030
\n","files":[{"path":"references/driver-ioctls.md","sizeBytes":5969,"isText":true},{"path":"references/output-formats.md","sizeBytes":4116,"isText":true},{"path":"references/remote-protocol.md","sizeBytes":5704,"isText":true},{"path":"scripts/boot-logging-workflow.ps1","sizeBytes":3737,"isText":false},{"path":"scripts/capture-wrapper.ps1","sizeBytes":2819,"isText":false},{"path":"scripts/detect-dbgview.ps1","sizeBytes":1561,"isText":false},{"path":"SKILL.md","sizeBytes":10691,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-08-12T21:52:56.474659Z","sha256":"DEC2709FE2203557B37837F6327D7CB88C703D5A59D8D3763C475C443529E085","sizeBytes":14354},"review":null,"source":{"repositoryUrl":"https://github.com/microsoft/skills","path":".github/skills/debugview","license":"MIT","commit":"23d0dac5f83f268166a17f0bc7dc6c73dc348a33","subtreeSha":"2E3E2A91819ECB66F265B26945081E9725380441B500BB6CA0277E6D5E98210E","lastSyncedAt":"2026-09-25T06:48:53.330584Z"},"reviewedAt":"2026-08-12T21:59:41.802364Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/microsoft/skills/tree/main/.github/skills/debugview"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install microsoft-skills@llmmart"},{"target":"git","command":"git clone https://github.com/microsoft/skills.git"}]}