Spat's WebLog (Steve Patrick)

When things go wrong...

LDAP client tracing...

LDAP client tracing...

Rate This
  • Comments 13

ADinsight from the sysinternals toolset is a great tool , but I seem to have problems  with it at times. Specifically on Server 2008  & Vista (maybe due to the way it hooks wldap32.dll)

On Vista OS and beyond, there is built in client ldap tracing which can give you similar results  ( with a wee bitmore effort )

In order to start the trace you use tracelog.exe ( may be able to use logman.exe as well but I have not tried it )

First , create a new key under HKLM\System\CurrentControlSet\Services\ldap\tracing\

 

The key name should be the name of the .exe you want to trace ,  mmc.exe for example.

C:\tools>Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f  ldap.etl  -flag x1FFFDFF3

 

Logger Started...

Enabling trace to logger 23

Operation Status:       0L      The operation completed successfully.

 

Logger Name:            ldap

Logger Id:              0x17

Logger Thread Id:       00000EDC

Guid:                   4a9f73a0-649c-11dd-84e5-0003ff1ee008

Buffer Size:            16 Kb

Maximum Buffers:        25

Minimum Buffers:        3

Number of Buffers:      3

Free Buffers:           2

Buffers Written:        1

Events Lost:            0

Log Buffers Lost:       0

Real Time Buffers Lost: 0

AgeLimit:               0

Real Time Consumers:    0

ClockType:              PerfCounter

Log Mode:               Sequential

Maximum File Size:      not set

Buffer Flush Timer:     not set

Log Filename:           C:\tools\ldap.etl

 

After your repro or whatnot, when you want to stop the trace use the following command:

C:\tools>tracelog -stop ldap

 

Operation Status:       0L      The operation completed successfully.

Logger Name:            ldap

Logger Id:              0x17

Logger Thread Id:       00000EDC

Guid:                   4a9f73a0-649c-11dd-84e5-0003ff1ee008

Buffer Size:            16 Kb

Maximum Buffers:        25

Minimum Buffers:        3

Number of Buffers:      4

Free Buffers:           4

Buffers Written:        1

Events Lost:            0

Log Buffers Lost:       0

Real Time Buffers Lost: 0

AgeLimit:               0

Real Time Consumers:    0

ClockType:              PerfCounter

Log Mode:               Sequential

Maximum File Size:      not set

Buffer Flush Timer:     not set

Log Filename:           C:\tools\ldap.etl

In order to format the trace to a readable format use tracerpt.exe

C:\tools>tracerpt.exe ldap.etl -o ldap2.csv -of CSV

 

Input

----------------

File(s):

     ldap.etl

100.00%

Output

----------------

DumpFile:           ldap2.csv

The command completed successfully.

 

 

 

Now, open the CSV in excel . There is a whole gob of information, but I have found that if I filter the Event ID column I can easily get what I want from it.

Below I filter on ID = 20

 

image

 

 

Have fun with it... works nicely in a pinch when you don't have any other tools at your disposal except for the built in ones. Also works nice for the detailed returns and code flow, as well as how much time it took to perform.

 

spat

 

Leave a Comment
  • Please add 3 and 7 and type the answer here:
  • Post
  • Hmmm... looks like a job for Powershell :)

  • LOL - you and your powershell.  OK I'll admit - it is pure laziness on my part for not learning PS yet...  convince me to repriortize it.

    spat

  • Challenge taken :) stay tuned!

  • So.. here is a question. I can't seem to get the GUID to work for me (even in cmd.exe)

  • whoops.. sure the error message may be helpful

    C:\data\Tools>Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f  ldap.etl  -flag x1FFFDFF3

    Getting guids from C:\data\Tools\#099614a5-5dd7-4788-8bc9-e29f43db28fc

    Error: C:\data\Tools\#099614a5-5dd7-4788-8bc9-e29f43db28fc is invalid

  • nm... apparently my version from 1999 was old :) I am good now.

    btw... I should the Powershell script posted tomorrow. Its HOT IMO :)

  • My blog post response

    http://bsonposh.com/archives/347

  • Hey Steve, do you know if there is an equivilent tracing functionality to capture the server side part? That would be extremely useful, especially when you have the UNIX people coming for your head because "AD is Broken". ;)

  • There has been some form of tracing for DS since Win2k.. but it's not the friendliest of data. I'll look into either a better collection of data in 2k8 or simply post a follow up of the Win2k+ tracing available..

    spat

  • In answer to Joe's question, you can use the Windows Server 2008 Reliability and Performance Monitor to trace AD activity.  I've covered this here:

    http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/49/Default.aspx

    Along with the htm and xml output files that are created you also have etl trace files.  If you dump these to CSV using tracerpt as Spat shows above, you can see the LDAP activity.

  • Could you blog on how Microsoft ADAM supports referential integrity?

    https://www.opends.org/wiki/page/MaintainingReferentialIntegrity

  • Hello,

    When i execute the command Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f  ldap.etl  -flag x1FFFDFF3

    i have this result:

    Getting guids from C:\WINDOWS\system32\#099614a5-5dd7-4788-8bc9-e29f43db28fc

    Error: C:\WINDOWS\system32\#099614a5-5dd7-4788-8bc9-e29f43db28fc is invalid

    Any clue ?

    thx

  • get the newer version of tracelog - see the previous comment from Bshell

Page 1 of 1 (13 items)