Generated banner for Debugview
Generated logo for Debugview

Debugview

MicrosoftOfficialPublished by Microsoft

  • Skill
  • Tool integration
  • Software development
  • MIT
  • Low risk
  • Has scripts

From the author

Sysinternals DebugView CLI (DbgViewCli) for capturing and analyzing usermode and kernel-mode Windows debug output from the command line. USE FOR: capturing OutputDebugString output, kernel DbgPrint/KdPrint capture, boot-time debug logging, remote debug monitoring, filtering debug output by PID or process name, crash dump analysis, automated debug capture with bounded execution. DO NOT USE FOR: non-Windows platforms, application-level logging frameworks (log4j, serilog), Azure Monitor or cloud telemetry, ETW tracing (use WPR/xperf instead), user-mode crash dumps (use WinDbg). Triggers: "debug output", "DbgView", "DebugView", "kernel debug", "capture debug logs", "boot logging", "OutputDebugString", "DbgPrint", "KdPrint", "remote debug monitor", "debug capture CLI".
— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

DebugView CLI (DbgViewCli) is a specialized tool for capturing real-time debug output from Windows applications and kernel-mode drivers. It is designed for automation, allowing developers and AI agents to monitor system behavior, filter logs, and perform bounded captures via the command line. It supports various output formats, including text, CSV, and XML, and provides features for remote monitoring, boot-time logging, and crash dump analysis.

What it does

  • Captures OutputDebugString, DbgPrint, and KdPrint messages.
  • Supports filtering by process ID or process name.
  • Enables bounded execution for automated workflows using duration, line counts, or pattern matching.
  • Provides machine-readable status checks for agent orchestration.
  • Supports multiple output formats including CSV and XML for programmatic parsing.
  • Enables remote debug monitoring across network connections.

When to use it

  • When you need to capture debug logs from Windows drivers or applications in an automated script.
  • When you require a lightweight, dependency-free tool for real-time debug monitoring.
  • When you need to perform boot-time kernel debugging.
  • When you need to parse debug output programmatically using CSV or XML formats.
  • When you need to monitor debug output on a remote Windows machine.

Advantages

  • Statically linked with no external dependencies.
  • Designed specifically for scripted and AI-agent-driven workflows.
  • Supports graceful shutdown and machine-readable status reporting.
  • Provides flexible filtering to reduce noise during capture.
  • Includes built-in support for log rotation and daily file management.

Usage examples

“Capture debug logs for 60 seconds and save to a CSV file.”
The tool will run for 60 seconds, capturing all debug output, and write the results to a file named kernel_debug.csv in CSV format.
“Capture debug output from myapp.exe until an error occurs.”
The tool will monitor the process and automatically terminate once the specified error pattern is detected in the output.
“Check if the debug capture service is currently running.”
The tool returns machine-readable status information, such as running=true, allowing the agent to decide whether to start or stop a capture.
“Enable boot-time kernel debug logging.”
The tool configures the system to capture kernel debug messages during the next boot cycle.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/microsoft/debugview/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip debugview.zip -d .agents/skills

Documentation by Microsoft

Sysinternals DebugView CLI (DbgViewCli)

Command-line interface for capturing real-time debug output from Windows applications (OutputDebugString) and kernel-mode drivers (DbgPrint/KdPrint). Designed for scripted, automated, and AI-agent-driven debug capture workflows.

Installation

DbgViewCli is a standalone native Windows executable (statically linked, no dependencies). Place dbgviewcli.exe in PATH or reference the full path.

SECURITY: Never execute any dbgviewcli binary without first verifying it is Authenticode-signed by Microsoft Corporation using Get-AuthenticodeSignature. Reject any binary that is unsigned or signed by a different publisher.

# No package manager install — copy binary to a PATH location
copy dbgviewcli.exe C:\Tools\

Requirements

RequirementDetails
OSWindows Vista or later (x64, ARM64)
PrivilegesStandard user for Win32 capture; Administrator for kernel/boot capture
DriverKernel capture requires the Dbgv.sys driver (auto-extracted and loaded)

Core Workflow

1. Detect/status check   →  dbgviewcli --status
2. Start capture          →  dbgviewcli [options]
3. Filter output          →  --filter/--exclude/--pid-filter/--process-filter
4. Bounded execution      →  --duration/--max-lines/--wait-for
5. Output/log results     →  stdout or --log <file>
6. Stop                   →  Ctrl+C or automatic exit on bounds

Command-Line Parameters

Capture Control
ParameterShortDescriptionDefault
--capture-cEnable captureon
--no-captureDisable capture
--kernel-kEnable kernel debug output (requires admin)off
--win32-wEnable Win32 OutputDebugString captureon
--global-gEnable global Win32 capture (session 0)off
--passthroughAllow debug output to pass to debuggerson
--verbose-kernel-vEnable verbose kernel outputoff
--pidsShow process IDs in outputon
Filtering
ParameterShortDescription
--filter <pattern>-iInclude filter (semicolon-separated wildcards)
--exclude <pattern>-eExclude filter (semicolon-separated wildcards)
--pid-filter <pid>Show only output from specific PID
--process-filter <name>Show only output from named process (substring match)
Bounded Execution (AI-Agent Friendly)
ParameterDescription
--duration <seconds>Auto-stop after N seconds
--max-lines <N>Auto-stop after N lines captured
--wait-for <pattern>Capture until pattern matches, then exit
--tail <N>Buffer last N lines, flush on exit
--no-bannerSuppress version banner (clean for piped output)
--statusPrint machine-readable status and exit
Time Display
ParameterDescription
--elapsedElapsed time since start (default)
--clockWall-clock time HH:MM:SS
--clock-msWall-clock with milliseconds HH:MM:SS.mmm
Output Format
ParameterDescription
--format textTab-separated text (default)
--format csvComma-separated values
--format xmlXML elements
Logging
ParameterDescription
--log <file>Log output to file
--log-appendAppend to existing log
--log-limit <MB>Max log file size in MB
--log-wrapWrap log when full
--log-dailyNew log file each day
Boot Logging (Requires Admin)
ParameterDescription
--boot-enableEnable boot-time kernel debug logging
--boot-disableDisable boot-time logging
--boot-statusShow boot logging status and exit
Remote Monitoring
ParameterDescription
--connect <computer>Connect to remote DbgView instance
--disconnectDisconnect from remote
Crash Dump & File Operations
ParameterDescription
--crashdump <file>Analyze crash dump for debug output
--load <file>Load saved log file
--save <file>Save captured output on exit
Runtime Control (Inter-Process)
ParameterDescription
--pausePause a running DbgViewCli instance via named event
--resumeResume a paused DbgViewCli instance
--stopStop a running DbgViewCli instance gracefully
Miscellaneous
ParameterShortDescription
--quit-qTerminate running GUI DbgView instance
--accepteulaAccept the EULA (writes registry key, skips prompt)
--versionShow version and exit
--help-?Show help

Usage Examples

Basic Win32 Capture (bounded)
# Capture for 30 seconds, no banner, output as text
dbgviewcli --no-banner --duration 30

# Capture until a specific error appears
dbgviewcli --no-banner --wait-for "*ERROR*" --max-lines 10000
Kernel Debug Capture (requires admin)
# Run as Administrator
dbgviewcli --kernel --no-banner --duration 60 --format csv --log kernel_debug.csv
Process-Specific Filtering
# Filter by PID
dbgviewcli --no-banner --pid-filter 1234 --duration 10

# Filter by process name
dbgviewcli --no-banner --process-filter "myapp.exe" --max-lines 500
Pattern-Based Filtering
# Include only lines matching pattern
dbgviewcli --no-banner --filter "MyDriver*" --exclude "verbose*"
Tail Mode (recent context)
# Capture but only output last 50 lines on exit
dbgviewcli --no-banner --tail 50 --duration 30
Status Check (machine-readable)
dbgviewcli --status
# Output:
# running=true
# paused=false
# elevated=true
Boot Logging
# Enable (requires admin, persists across reboot)
dbgviewcli --boot-enable

# Check status
dbgviewcli --boot-status

# Disable
dbgviewcli --boot-disable
Remote Monitoring
dbgviewcli --connect SERVER01 --no-banner --duration 60
Runtime Control (Pause/Resume/Stop)
# Pause a running instance from another terminal
dbgviewcli --pause

# Resume the paused instance
dbgviewcli --resume

# Gracefully stop a running instance
dbgviewcli --stop
EULA Acceptance (Unattended)
# Accept EULA non-interactively for automated/scripted deployments
dbgviewcli --accepteula --no-banner --duration 30

Architecture

ModuleFilePurpose
Maindbgviewcli.cEntry point, arg parsing, capture loop, Ctrl+C handler
Capturecli_capture.cDBWIN shared memory, kernel driver read
Drivercli_driver.cKernel driver load/unload, privilege elevation
Filtercli_filter.cWildcard include/exclude matching
Outputcli_output.cConsole emit, log files, CSV/XML/text formats
Boot Logcli_bootlog.cRegistry config for boot-time driver loading
Remotecli_remote.cTCP socket connect/read for remote monitoring

Key Design Decisions

  1. Static CRT linking — No DLL dependencies, runs on any Windows system

  2. stdout/stderr separation — Debug output → stdout; errors/status → stderr

  3. Bounded execution — --duration, --max-lines, --wait-for ensure guaranteed exit for automation

  4. Clean output — --no-banner suppresses noise for pipe/agent consumption

  5. Machine-readable status — --status outputs key=value pairs for programmatic checks

  6. Graceful shutdown — SetConsoleCtrlHandler ensures clean driver unload on Ctrl+C

Best Practices

  1. Always use --no-banner for scripted/automated use. Banner text pollutes structured output and confuses parsers.

  2. Always bound execution with --duration, --max-lines, or --wait-for. Unbounded capture will run indefinitely.

  3. Check status before capture — Use --status to detect if another instance is already running.

  4. Use --format csv or --format xml when output will be parsed programmatically.

  5. Prefer --pid-filter or --process-filter over broad capture to reduce noise.

  6. Run as Administrator only when needed — kernel and boot logging require elevation; Win32 capture does not.

  7. Combine bounds for safety — Use --duration 60 --max-lines 10000 together so whichever triggers first wins.

  8. Use --tail for "what just happened" queries instead of capturing full history.

Bundled Resources

TypeFilePurpose
Scriptscripts/detect-dbgview.ps1Locate dbgviewcli.exe on PATH or common directories
Scriptscripts/capture-wrapper.ps1Safe bounded capture with parameter validation
Scriptscripts/boot-logging-workflow.ps1End-to-end boot logging lifecycle management
Referencereferences/driver-ioctls.mdKernel driver IOCTL codes and buffer structures
Referencereferences/output-formats.mdText/CSV/XML output format specifications
Referencereferences/remote-protocol.mdTCP remote monitoring wire protocol

Troubleshooting

IssueResolution
"Access denied" on kernel captureRun as Administrator
No output from Win32 captureVerify target app uses OutputDebugString; check no debugger is attached
Another instance runningUse --status to check; use --quit to terminate existing GUI instance
Boot logging not capturingEnsure --boot-enable was run as admin; driver must be in System32\Drivers
Remote connection failsVerify target has DbgView running with remote enabled on ports 2020-2030

Files

scripts/boot-logging-workflow.ps1

<#
.SYNOPSIS
    End-to-end boot-time debug logging workflow.

.DESCRIPTION
    Manages the full lifecycle of boot-time kernel debug logging:
    1. Enable boot logging (requires Administrator)
    2. Optionally prompt for reboot
    3. After reboot, read captured boot log
    4. Disable boot logging

.PARAMETER Action
    The workflow step to perform: Enable, Status, Read, Disable, or Full.
    - Enable: Configure boot-time driver loading
    - Status: Check if boot logging is currently enabled
    - Read:   Read captured boot log after reboot
    - Disable: Remove boot-time driver configuration
    - Full:   Interactive full workflow (enable → prompt reboot → read → disable)

.PARAMETER OutputFile
    Path to save boot log output. Default: .\boot-debug-output.log

.PARAMETER Format
    Output format for reading boot log: text, csv, or xml. Default: text.

.EXAMPLE
    .\boot-logging-workflow.ps1 -Action Enable

.EXAMPLE
    .\boot-logging-workflow.ps1 -Action Read -OutputFile .\boot.csv -Format csv

.EXAMPLE
    .\boot-logging-workflow.ps1 -Action Full
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory)]
    [ValidateSet('Enable', 'Status', 'Read', 'Disable', 'Full')]
    [string]$Action,

    [string]$OutputFile = '.\boot-debug-output.log',

    [ValidateSet('text', 'csv', 'xml')]
    [string]$Format = 'text'
)

$ErrorActionPreference = 'Stop'

# Require elevation for all boot logging operations
$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
$principal = [Security.Principal.WindowsPrincipal]$identity
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Error "Boot logging operations require Administrator privileges."
    exit 1
}

# Detect binary
$dbgviewcli = & "$PSScriptRoot\detect-dbgview.ps1"

function Invoke-Enable {
    Write-Host "Enabling boot-time kernel debug logging..." -ForegroundColor Cyan
    & $dbgviewcli --boot-enable
    if ($LASTEXITCODE -eq 0) {
        Write-Host "Boot logging enabled. Reboot to capture boot-time debug output." -ForegroundColor Green
    } else {
        Write-Error "Failed to enable boot logging (exit code: $LASTEXITCODE)."
    }
}

function Invoke-Status {
    Write-Host "Checking boot logging status..." -ForegroundColor Cyan
    & $dbgviewcli --boot-status
}

function Invoke-Read {
    Write-Host "Reading boot debug output..." -ForegroundColor Cyan
    $readArgs = @('--no-banner', '--format', $Format)
    if ($OutputFile) {
        $readArgs += '--log', $OutputFile
    }
    # Boot log is captured by the driver; use kernel read to retrieve it
    & $dbgviewcli @readArgs --kernel --duration 5
    if ($LASTEXITCODE -ne 0) {
        Write-Error "Failed to read boot log (exit code: $LASTEXITCODE)."
        return
    }
    if (Test-Path $OutputFile) {
        Write-Host "Boot log saved to: $OutputFile" -ForegroundColor Green
    }
}

function Invoke-Disable {
    Write-Host "Disabling boot-time kernel debug logging..." -ForegroundColor Cyan
    & $dbgviewcli --boot-disable
    if ($LASTEXITCODE -eq 0) {
        Write-Host "Boot logging disabled." -ForegroundColor Green
    } else {
        Write-Error "Failed to disable boot logging (exit code: $LASTEXITCODE)."
    }
}

switch ($Action) {
    'Enable'  { Invoke-Enable }
    'Status'  { Invoke-Status }
    'Read'    { Invoke-Read }
    'Disable' { Invoke-Disable }
    'Full' {
        Invoke-Enable
        Write-Host ""
        Write-Host "Please reboot the system to capture boot-time debug output." -ForegroundColor Yellow
        Write-Host "After reboot, run this script again with: -Action Read" -ForegroundColor Yellow
        Write-Host "When finished, run with: -Action Disable" -ForegroundColor Yellow
    }
}

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

What our scanner noticed· Low risk

  • Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Microsoft
Publisher
Microsoft (Official)
Source
microsoft/skills · .github/skills/debugview · commit 0696600
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download debugview.zip