Sysinternals DebugView CLI (DbgViewCli)
Command-line interface for capturing real-time debug output from Windows applications
(OutputDebugString) and kernel-mode drivers (DbgPrint/KdPrint). Designed for scripted,
automated, and AI-agent-driven debug capture workflows.
Installation
DbgViewCli is a standalone native Windows executable (statically linked, no dependencies).
Place dbgviewcli.exe in PATH or reference the full path.
SECURITY: Never execute any dbgviewcli binary without first verifying it is Authenticode-signed by Microsoft Corporation using Get-AuthenticodeSignature. Reject any binary that is unsigned or signed by a different publisher.
# No package manager install — copy binary to a PATH location
copy dbgviewcli.exe C:\Tools\
Requirements
| Requirement |
Details |
| OS |
Windows Vista or later (x64, ARM64) |
| Privileges |
Standard user for Win32 capture; Administrator for kernel/boot capture |
| Driver |
Kernel capture requires the Dbgv.sys driver (auto-extracted and loaded) |
Core Workflow
1. Detect/status check → dbgviewcli --status
2. Start capture → dbgviewcli [options]
3. Filter output → --filter/--exclude/--pid-filter/--process-filter
4. Bounded execution → --duration/--max-lines/--wait-for
5. Output/log results → stdout or --log <file>
6. Stop → Ctrl+C or automatic exit on bounds
Command-Line Parameters
Capture Control
| Parameter |
Short |
Description |
Default |
--capture |
-c |
Enable capture |
on |
--no-capture |
|
Disable capture |
|
--kernel |
-k |
Enable kernel debug output (requires admin) |
off |
--win32 |
-w |
Enable Win32 OutputDebugString capture |
on |
--global |
-g |
Enable global Win32 capture (session 0) |
off |
--passthrough |
|
Allow debug output to pass to debuggers |
on |
--verbose-kernel |
-v |
Enable verbose kernel output |
off |
--pids |
|
Show process IDs in output |
on |
Filtering
| Parameter |
Short |
Description |
--filter <pattern> |
-i |
Include filter (semicolon-separated wildcards) |
--exclude <pattern> |
-e |
Exclude filter (semicolon-separated wildcards) |
--pid-filter <pid> |
|
Show only output from specific PID |
--process-filter <name> |
|
Show only output from named process (substring match) |
Bounded Execution (AI-Agent Friendly)
| Parameter |
Description |
--duration <seconds> |
Auto-stop after N seconds |
--max-lines <N> |
Auto-stop after N lines captured |
--wait-for <pattern> |
Capture until pattern matches, then exit |
--tail <N> |
Buffer last N lines, flush on exit |
--no-banner |
Suppress version banner (clean for piped output) |
--status |
Print machine-readable status and exit |
Time Display
| Parameter |
Description |
--elapsed |
Elapsed time since start (default) |
--clock |
Wall-clock time HH:MM:SS |
--clock-ms |
Wall-clock with milliseconds HH:MM:SS.mmm |
Output Format
| Parameter |
Description |
--format text |
Tab-separated text (default) |
--format csv |
Comma-separated values |
--format xml |
XML elements |
Logging
| Parameter |
Description |
--log <file> |
Log output to file |
--log-append |
Append to existing log |
--log-limit <MB> |
Max log file size in MB |
--log-wrap |
Wrap log when full |
--log-daily |
New log file each day |
Boot Logging (Requires Admin)
| Parameter |
Description |
--boot-enable |
Enable boot-time kernel debug logging |
--boot-disable |
Disable boot-time logging |
--boot-status |
Show boot logging status and exit |
Remote Monitoring
| Parameter |
Description |
--connect <computer> |
Connect to remote DbgView instance |
--disconnect |
Disconnect from remote |
Crash Dump & File Operations
| Parameter |
Description |
--crashdump <file> |
Analyze crash dump for debug output |
--load <file> |
Load saved log file |
--save <file> |
Save captured output on exit |
Runtime Control (Inter-Process)
| Parameter |
Description |
--pause |
Pause a running DbgViewCli instance via named event |
--resume |
Resume a paused DbgViewCli instance |
--stop |
Stop a running DbgViewCli instance gracefully |
Miscellaneous
| Parameter |
Short |
Description |
--quit |
-q |
Terminate running GUI DbgView instance |
--accepteula |
|
Accept the EULA (writes registry key, skips prompt) |
--version |
|
Show version and exit |
--help |
-? |
Show help |
Usage Examples
Basic Win32 Capture (bounded)
# Capture for 30 seconds, no banner, output as text
dbgviewcli --no-banner --duration 30
# Capture until a specific error appears
dbgviewcli --no-banner --wait-for "*ERROR*" --max-lines 10000
Kernel Debug Capture (requires admin)
# Run as Administrator
dbgviewcli --kernel --no-banner --duration 60 --format csv --log kernel_debug.csv
Process-Specific Filtering
# Filter by PID
dbgviewcli --no-banner --pid-filter 1234 --duration 10
# Filter by process name
dbgviewcli --no-banner --process-filter "myapp.exe" --max-lines 500
Pattern-Based Filtering
# Include only lines matching pattern
dbgviewcli --no-banner --filter "MyDriver*" --exclude "verbose*"
Tail Mode (recent context)
# Capture but only output last 50 lines on exit
dbgviewcli --no-banner --tail 50 --duration 30
Status Check (machine-readable)
dbgviewcli --status
# Output:
# running=true
# paused=false
# elevated=true
Boot Logging
# Enable (requires admin, persists across reboot)
dbgviewcli --boot-enable
# Check status
dbgviewcli --boot-status
# Disable
dbgviewcli --boot-disable
Remote Monitoring
dbgviewcli --connect SERVER01 --no-banner --duration 60
Runtime Control (Pause/Resume/Stop)
# Pause a running instance from another terminal
dbgviewcli --pause
# Resume the paused instance
dbgviewcli --resume
# Gracefully stop a running instance
dbgviewcli --stop
EULA Acceptance (Unattended)
# Accept EULA non-interactively for automated/scripted deployments
dbgviewcli --accepteula --no-banner --duration 30
Architecture
| Module |
File |
Purpose |
| Main |
dbgviewcli.c |
Entry point, arg parsing, capture loop, Ctrl+C handler |
| Capture |
cli_capture.c |
DBWIN shared memory, kernel driver read |
| Driver |
cli_driver.c |
Kernel driver load/unload, privilege elevation |
| Filter |
cli_filter.c |
Wildcard include/exclude matching |
| Output |
cli_output.c |
Console emit, log files, CSV/XML/text formats |
| Boot Log |
cli_bootlog.c |
Registry config for boot-time driver loading |
| Remote |
cli_remote.c |
TCP socket connect/read for remote monitoring |
Key Design Decisions
- Static CRT linking — No DLL dependencies, runs on any Windows system
- stdout/stderr separation — Debug output → stdout; errors/status → stderr
- Bounded execution —
--duration, --max-lines, --wait-for ensure guaranteed exit for automation
- Clean output —
--no-banner suppresses noise for pipe/agent consumption
- Machine-readable status —
--status outputs key=value pairs for programmatic checks
- Graceful shutdown —
SetConsoleCtrlHandler ensures clean driver unload on Ctrl+C
Best Practices
- Always use
--no-banner for scripted/automated use. Banner text pollutes structured output and confuses parsers.
- Always bound execution with
--duration, --max-lines, or --wait-for. Unbounded capture will run indefinitely.
- Check status before capture — Use
--status to detect if another instance is already running.
- Use
--format csv or --format xml when output will be parsed programmatically.
- Prefer
--pid-filter or --process-filter over broad capture to reduce noise.
- Run as Administrator only when needed — kernel and boot logging require elevation; Win32 capture does not.
- Combine bounds for safety — Use
--duration 60 --max-lines 10000 together so whichever triggers first wins.
- Use
--tail for "what just happened" queries instead of capturing full history.
Bundled Resources
| Type |
File |
Purpose |
| Script |
scripts/detect-dbgview.ps1 |
Locate dbgviewcli.exe on PATH or common directories |
| Script |
scripts/capture-wrapper.ps1 |
Safe bounded capture with parameter validation |
| Script |
scripts/boot-logging-workflow.ps1 |
End-to-end boot logging lifecycle management |
| Reference |
references/driver-ioctls.md |
Kernel driver IOCTL codes and buffer structures |
| Reference |
references/output-formats.md |
Text/CSV/XML output format specifications |
| Reference |
references/remote-protocol.md |
TCP remote monitoring wire protocol |
Troubleshooting
| Issue |
Resolution |
| "Access denied" on kernel capture |
Run as Administrator |
| No output from Win32 capture |
Verify target app uses OutputDebugString; check no debugger is attached |
| Another instance running |
Use --status to check; use --quit to terminate existing GUI instance |
| Boot logging not capturing |
Ensure --boot-enable was run as admin; driver must be in System32\Drivers |
| Remote connection fails |
Verify target has DbgView running with remote enabled on ports 2020-2030 |
Source: microsoft/skills → .github/skills/debugview/SKILL.md
thedixitjain