Skip to content

Commit 1613d79

Browse files
Malcolm-StewartMalcolm-Stewart
committed
Updated SQLTrace
-added more tracing -removed classes and replaced with alternate code -added a FlushExistingTraces to the beginning of the start trace -renamed the NETSH and LOGMAN trace names to have SQLTrace as the prefix
1 parent ffc6713 commit 1613d79

File tree

1 file changed

+124
-62
lines changed

1 file changed

+124
-62
lines changed

‎SQLTrace/SQLTrace.ps1‎

Lines changed: 124 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ param
5151
)
5252

5353

54-
#=======================================Globals =====================================
54+
#======================================= Globals =====================================
5555

5656
# [console]::TreatControlCAsInput = $false # may change this later
5757
[string]$global:CurrentFolder = Get-Location
@@ -60,7 +60,9 @@ param
6060
[string]$global:LogFolderEnvName = "SQLTraceLogFolder"
6161

6262
$global:INISettings = $null # set in ReadINIFile
63-
$global:RunningSettings = $null
63+
64+
65+
#======================================= Code =====================================
6466

6567
Function Main
6668
{
@@ -89,7 +91,7 @@ LogRaw "
8991
/_______ /\_____\ \_/|_______ \|____| |__| (____ / \___ >\___ >
9092
\/ \__> \/ \/ \/ \/
9193
92-
SQLTrace.ps1 version 1.0.0.0066
94+
SQLTrace.ps1 version 1.0.0083.0
9395
by the Microsoft SQL Server Networking Team
9496
"
9597

@@ -143,7 +145,27 @@ Usage:
143145

144146
Function ReadINIFile
145147
{
146-
$global:INISettings = New-Object IniValueClass
148+
#$global:INISettings = New-Object IniValueClass
149+
150+
$global:INISettings = @{ # a "splat" aka Dictionary
151+
BidTrace = "No" # No | Yes
152+
BidWow = "No" # No | Yes | Both
153+
BidProviderList = ""
154+
155+
NetTrace = "No"
156+
Netsh = "No"
157+
Netmon = "No"
158+
Wireshark = "No"
159+
Pktmon = "No"
160+
161+
AuthTrace = "No"
162+
SSL = "No"
163+
Kerberos = "No"
164+
LSA = "No"
165+
Credssp = "No"
166+
EventViewer = "No"
167+
}
168+
147169
$fileName = $INIFile
148170

149171
$fileData = get-content $fileName
@@ -254,31 +276,31 @@ Function GetLogFolderName
254276

255277
# ================================= Class Definitions ===========================
256278

257-
class INIValueClass # contains all the INI file settings in one place
258-
{
259-
[string] $BidTrace = "No" # No | Yes
260-
[string] $BidWow = "No" # No | Yes | Both
261-
[string] $BidProviderList = ""
262-
263-
[string] $NetTrace = "No"
264-
[string] $Netsh = "No"
265-
[string] $Netmon = "No"
266-
[string] $Wireshark = "No"
267-
[string] $Pktmon = "No"
268-
269-
[string] $AuthTrace = "No"
270-
[string] $SSL = "No"
271-
[string] $Kerberos = "No"
272-
[string] $LSA = "No"
273-
[string] $Credssp = "No"
274-
[string] $EventViewer = "No"
275-
}
276-
277-
class RunningSettings
278-
{
279-
[System.Diagnostics.Process] $WiresharkProcess = $null
280-
[System.Diagnostics.Process] $NetmonProcess = $null
281-
}
279+
#class INIValueClass # contains all the INI file settings in one place - requires PowerShell 5
280+
#{
281+
# [string] $BidTrace = "No" # No | Yes
282+
# [string] $BidWow = "No" # No | Yes | Both
283+
# [string] $BidProviderList = ""
284+
#
285+
# [string] $NetTrace = "No"
286+
# [string] $Netsh = "No"
287+
# [string] $Netmon = "No"
288+
# [string] $Wireshark = "No"
289+
# [string] $Pktmon = "No"
290+
#
291+
# [string] $AuthTrace = "No"
292+
# [string] $SSL = "No"
293+
# [string] $Kerberos = "No"
294+
# [string] $LSA = "No"
295+
# [string] $Credssp = "No"
296+
# [string] $EventViewer = "No"
297+
#}
298+
#
299+
#class RunningSettings
300+
#{
301+
# [System.Diagnostics.Process] $WiresharkProcess = $null
302+
# [System.Diagnostics.Process] $NetmonProcess = $null
303+
#}
282304

283305
# ======================================= Setup Traces =========================================
284306

@@ -361,8 +383,8 @@ Function StartTraces
361383
LogInfo "Progress Log name: $($global:LogProgressFileName)"
362384

363385
# $PSDefaultParameterValues['*:Encoding'] = 'Ascii'
364-
$global:RunningSettings = New-Object RunningSettings
365386

387+
FlushExistingTraces
366388
FlushCaches
367389

368390
tasklist > "$($global:LogFolderName)\TasklistAtStart.txt"
@@ -374,6 +396,37 @@ Function StartTraces
374396
LogInfo "Traces have started..."
375397
}
376398

399+
Function FlushExistingTraces
400+
{
401+
# flush everything regardless of settings - may interfere with custom tracing
402+
403+
LogInfo "Stopping previously running traces ..."
404+
405+
logman stop SQLTraceBID -ets 2>&1 | Out-Null
406+
407+
logman stop SQLTraceNDIS -ets 2>&1 | Out-Null
408+
netsh trace stop 2>&1 | Out-Null
409+
nslookup "stopsqltrace.microsoft.com" 2>&1 | Out-Null # Why the 2>&1 pipe? Do we still need that?
410+
Stop-Process -Name "dumpcap" -Force 2>&1 | Out-Null
411+
412+
logman stop "SQLTraceKerberos" -ets 2>&1 | Out-Null
413+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA\Kerberos\Parameters /v LogLevel /f 2>&1 | Out-Null
414+
logman stop "SQLTraceNtlm_CredSSP" -ets 2>&1 | Out-Null
415+
logman stop "SQLTraceSSL" -ets 2>&1 | Out-Null
416+
417+
nltest /dbflag:0x0 2>&1 | Out-Null
418+
419+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v SPMInfoLevel /f 2>&1 | Out-Null
420+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v LogToFile /f 2>&1 | Out-Null
421+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v NegEventMask /f 2>&1 | Out-Null
422+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA\NegoExtender\Parameters /v InfoLevel /f 2>&1 | Out-Null
423+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA\Pku2u\Parameters /v InfoLevel /f 2>&1 | Out-Null
424+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v LspDbgInfoLevel /f 2>&1 | Out-Null
425+
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v LspDbgTraceOptions /f 2>&1 | Out-Null
426+
427+
logman stop "SQLTraceLSA" -ets 2>&1 | Out-Null
428+
}
429+
377430
Function FlushCaches
378431
{
379432
LogInfo (IPCONFIG /flushdns)
@@ -466,10 +519,9 @@ Function StartBIDTraces
466519
$guid | Out-File -FilePath "$($global:LogFolderName)\BIDTraces\ctrl.guid" -Append -Encoding Ascii
467520
}
468521

469-
logman start msbidtraces -pf "$($global:LogFolderName)\BIDTraces\ctrl.guid" -o "$($global:LogFolderName)\BIDTraces\bidtrace%d.etl" -bs 1024 -nb 1024 1024 -mode NewFile -max 200 -ets
470-
522+
$result = logman start SQLTraceBID -pf "$($global:LogFolderName)\BIDTraces\ctrl.guid" -o "$($global:LogFolderName)\BIDTraces\bidtrace%d.etl" -bs 1024 -nb 1024 1024 -mode NewFile -max 200 -ets
523+
LogInfo "LOGMAN: $result"
471524
}
472-
473525
}
474526

475527
Function StartWireshark
@@ -482,9 +534,8 @@ Function StartWireshark
482534
For($cDevices=0;$cDevices -lt $DeviceList.Count;$cDevices++) { $ArgumentList = $ArgumentList + " -i " + ($cDevices+1) }
483535
##Prepare command arguments
484536
$ArgumentList = $ArgumentList + " -w $($global:LogFolderName)\NetworkTraces\nettrace.pcap -b filesize:200000 -b files:10"
485-
$WiresharkProcess = Start-Process $WiresharkCmd -PassThru -NoNewWindow -ArgumentList $ArgumentList
486-
LogInfo "Wireshark is running with PID: " + $global:RunningSettings.WiresharkProcess.ID
487-
537+
[System.Diagnostics.Process] $WiresharkProcess = Start-Process $WiresharkCmd -PassThru -NoNewWindow -ArgumentList $ArgumentList
538+
LogInfo "Wireshark is running with PID: " + $WiresharkProcess.ID
488539
}
489540

490541

@@ -495,15 +546,14 @@ Function StartNetworkMonitor
495546
$NMCap = Get-ItemPropertyValue -Path 'HKLM:\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Netmon3\' -Name InstallDir
496547

497548
$NMCap = '"' + $NMCap + "nmcap.exe" + '" '
498-
$ArgumentList = "/network * /capture /file $($global:LogFolderName)\NetworkTraces\nettrace.chn:200M /StopWhen /Frame dns.qrecord.questionname.Contains('stopmstrace')"
549+
$ArgumentList = "/network * /capture /file $($global:LogFolderName)\NetworkTraces\nettrace.chn:200M /StopWhen /Frame dns.qrecord.questionname.Contains('stopsqltrace')"
499550

500551
#Start the capture
501-
$global:RunningSettings.NetmonProcess = Start-Process $NMCap -PassThru -NoNewWindow -ArgumentList $ArgumentList
502-
LogInfo "Network Monitor is running with PID: " + $global:RunningSettings.NetmonProcess.ID
552+
[System.Diagnostics.Process] $NetmonProcess = Start-Process $NMCap -PassThru -NoNewWindow -ArgumentList $ArgumentList
553+
LogInfo "Network Monitor is running with PID: " + $NetmonProcess.ID
503554
LogWarning "Killing this process will corrupt the most recent capture file."
504555
LogWarning "Run SQLTrace.ps1 with the -stop option to terminate safely."
505556
LogRaw ""
506-
507557
}
508558
Function StartNetworkTraces
509559
{
@@ -523,8 +573,10 @@ Function StartNetworkTraces
523573
# $commandLine = "netsh trace start capture=yes overwrite=yes tracefile=$($global:LogFolderName)\NetworkTraces\" + $env:computername +".etl filemode=circular maxSize=200MB"
524574
# Invoke-Expression $commandLine
525575

526-
netsh trace start capture=yes maxsize=1 TRACEFILE="$($global:LogFolderName)\NetworkTraces\deleteme.etl"
527-
logman start msndiscap -p Microsoft-Windows-NDIS-PacketCapture -mode newfile -max 200 -o "$($global:LogFolderName)\NetworkTraces\nettrace%d.etl" -ets
576+
$result = netsh trace start capture=yes maxsize=1 TRACEFILE="$($global:LogFolderName)\NetworkTraces\deleteme.etl"
577+
LogInfo "NETSH: $result"
578+
$result = logman start SQLTraceNDIS -p Microsoft-Windows-NDIS-PacketCapture -mode newfile -max 200 -o "$($global:LogFolderName)\NetworkTraces\nettrace%d.etl" -ets
579+
LogInfo "LOGMAN: $result"
528580
}
529581
if($global:INISettings.NETMON -eq "Yes")
530582
{
@@ -565,15 +617,17 @@ Function StartAuthenticationTraces
565617
# Kerberos Logging to SYSTEM event log in case this is a client
566618
reg add HKLM\SYSTEM\CurrentControlSet\Control\LSA\Kerberos\Parameters /v LogLevel /t REG_DWORD /d 1 /f
567619

568-
logman start "Kerberos" -o "$($global:LogFolderName)\Auth\Kerberos.etl" -ets
620+
$result = logman start "SQLTraceKerberos" -o "$($global:LogFolderName)\Auth\Kerberos.etl" -ets
621+
LogInfo "Kerberos: $result"
569622

570623
ForEach($KerberosProvider in $KerberosProviders)
571624
{
572625
# Update Logman Kerberos
573626
$KerberosParams = $KerberosProvider.Split('!')
574627
$KerberosSingleTraceGUID = $KerberosParams[0]
575628
$KerberosSingleTraceFlags = $KerberosParams[1]
576-
logman update trace "Kerberos" -p `"$KerberosSingleTraceGUID`" $KerberosSingleTraceFlags 0xff -ets | Out-Null
629+
$result = logman update trace "SQLTraceKerberos" -p `"$KerberosSingleTraceGUID`" $KerberosSingleTraceFlags 0xff -ets
630+
LogInfo "Kerberos: $result"
577631
}
578632
}
579633

@@ -590,7 +644,8 @@ Function StartAuthenticationTraces
590644
'{DAA6CAF5-6678-43f8-A6FE-B40EE096E06E}!0xffffffffffffffff'
591645
)
592646

593-
logman create trace "Ntlm_CredSSP" -o "$($global:LogFolderName)\Auth\Ntlm_CredSSP.etl" -ets
647+
$result = logman create trace "SQLTraceNtlm_CredSSP" -o "$($global:LogFolderName)\Auth\Ntlm_CredSSP.etl" -ets
648+
LogInfo "NTLM_CredSSP: $result"
594649

595650
ForEach($Ntlm_CredSSPProvider in $Ntlm_CredSSPProviders)
596651
{
@@ -599,7 +654,8 @@ Function StartAuthenticationTraces
599654
$Ntlm_CredSSPSingleTraceGUID = $Ntlm_CredSSPParams[0]
600655
$Ntlm_CredSSPSingleTraceFlags = $Ntlm_CredSSPParams[1]
601656

602-
logman update trace "Ntlm_CredSSP" -p `"$Ntlm_CredSSPSingleTraceGUID`" $Ntlm_CredSSPSingleTraceFlags 0xff -ets | Out-Null
657+
$result = logman update trace "SQLTraceNtlm_CredSSP" -p `"$Ntlm_CredSSPSingleTraceGUID`" $Ntlm_CredSSPSingleTraceFlags 0xff -ets
658+
LogInfo "NTLM_CredSSP: $result"
603659
}
604660
}
605661

@@ -613,7 +669,8 @@ Function StartAuthenticationTraces
613669
)
614670

615671
# Start Logman SSL
616-
logman start "SSL" -o "$($global:LogFolderName)\Auth\SSL.etl" -ets
672+
$result = logman start "SQLTraceSSL" -o "$($global:LogFolderName)\Auth\SSL.etl" -ets
673+
LogInfo "SSL: $result"
617674

618675
ForEach($SSLProvider in $SSLProviders)
619676
{
@@ -622,7 +679,8 @@ Function StartAuthenticationTraces
622679
$SSLSingleTraceGUID = $SSLParams[0]
623680
$SSLSingleTraceFlags = $SSLParams[1]
624681

625-
logman update trace "SSL" -p `"$SSLSingleTraceGUID`" $SSLSingleTraceFlags 0xff -ets | Out-Null
682+
$result = logman update trace "SQLTraceSSL" -p `"$SSLSingleTraceGUID`" $SSLSingleTraceFlags 0xff -ets
683+
LogInfo "SSL: $result"
626684
}
627685
}
628686

@@ -632,7 +690,8 @@ Function StartAuthenticationTraces
632690
LogInfo "Starting LSA Traces..."
633691

634692
# **Netlogon logging**
635-
nltest /dbflag:0x2EFFFFFF 2>&1 | Out-Null
693+
$result = nltest /dbflag:0x2EFFFFFF 2>&1
694+
LogInfo "NLTEST: $result"
636695

637696
# **LSA**
638697
$LSAProviders = @(
@@ -669,8 +728,9 @@ Function StartAuthenticationTraces
669728

670729

671730
# Start Logman LSA
672-
$LSASingleTraceName = "LSA"
673-
logman create trace $LSASingleTraceName -o "$($global:LogFolderName)\Auth\LSA.etl" -ets
731+
$LSASingleTraceName = "SQLTraceLSA"
732+
$result = logman create trace $LSASingleTraceName -o "$($global:LogFolderName)\Auth\LSA.etl" -ets
733+
LogInfo "LSA: $result"
674734

675735
ForEach($LSAProvider in $LSAProviders)
676736
{
@@ -680,7 +740,8 @@ Function StartAuthenticationTraces
680740
$LSASingleTraceGUID = $LSAParams[0]
681741
$LSASingleTraceFlags = $LSAParams[1]
682742

683-
logman update trace $LSASingleTraceName -p `"$LSASingleTraceGUID`" $LSASingleTraceFlags 0xff -ets | Out-Null
743+
$result = logman update trace $LSASingleTraceName -p `"$LSASingleTraceGUID`" $LSASingleTraceFlags 0xff -ets
744+
LogInfo "LSA: $result"
684745
}
685746
}
686747

@@ -689,8 +750,10 @@ Function StartAuthenticationTraces
689750

690751
LogInfo "Enabling/Collecting Event Viewer Logs..."
691752
# Enable Eventvwr logging
692-
wevtutil.exe set-log "Microsoft-Windows-CAPI2/Operational" /ms:102400000 2>&1
693-
wevtutil.exe set-log "Microsoft-Windows-Kerberos/Operational" /enabled:true /rt:false /q:true 2>&1
753+
$result = wevtutil.exe set-log "Microsoft-Windows-CAPI2/Operational" /ms:102400000 2>&1
754+
LogInfo "CAPI2 events: $result"
755+
$result = wevtutil.exe set-log "Microsoft-Windows-Kerberos/Operational" /enabled:true /rt:false /q:true 2>&1
756+
LogInfo "Kerberos events: $result"
694757
}
695758
}
696759
}
@@ -700,7 +763,6 @@ Function StartAuthenticationTraces
700763
Function StopTraces
701764
{
702765
LogInfo "Stopping Traces ..."
703-
$global:RunningSettings = New-Object RunningSettings
704766
netstat -abon > "$($global:LogFolderName)\NetStatAtEnd.txt"
705767
tasklist > "$($global:LogFolderName)\TasklistAtEnd.txt"
706768
StopBIDTraces
@@ -719,7 +781,7 @@ Function StopBIDTraces
719781
{
720782
LogInfo "Stopping BID Traces ..."
721783
# Do not clear the registry keys in case we run a second trace; use the -cleanup switch explicitly
722-
logman stop msbidtraces -ets
784+
logman stop SQLTraceBID -ets
723785
}
724786
}
725787

@@ -735,7 +797,7 @@ Function StopNetworkTraces
735797
{
736798
LogInfo "Stopping NETSH..."
737799
# netsh trace stop
738-
logman stop msndiscap -ets
800+
logman stop SQLTraceNDIS -ets
739801
netsh trace stop
740802
del "$($global:LogFolderName)\NetworkTraces\deleteme.etl"
741803
Rename-Item "$($global:LogFolderName)\NetworkTraces\deleteme.cab" "network_settings.cab"
@@ -744,7 +806,7 @@ Function StopNetworkTraces
744806
{
745807
$NetmonPID = Get-Process -Name "nmcap"
746808
LogInfo "Stopping Network Monitor with PID: " + $NetmonPID.ID
747-
nslookup "stopmstrace.microsoft.com" 2>&1 | Out-Null # Why the 2>&1 pipe? Do we still need that?
809+
nslookup "stopsqltrace.microsoft.com" 2>&1 | Out-Null # Why the 2>&1 pipe? Do we still need that?
748810
}
749811
if($global:INISettings.WIRESHARK -eq "Yes")
750812
{
@@ -764,18 +826,18 @@ Function StopAuthenticationTraces
764826
if($global:INISettings.Kerberos -eq "Yes")
765827
{
766828
LogInfo "Stopping Kerberos ETL Traces..."
767-
logman stop "Kerberos" -ets
829+
logman stop "SQLTraceKerberos" -ets
768830
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA\Kerberos\Parameters /v LogLevel /f 2>&1
769831
}
770832
if($global:INISettings.Credssp -eq "Yes")
771833
{
772834
LogInfo "Stopping CredSSP/NTLM Traces..."
773-
logman stop "Ntlm_CredSSP" -ets
835+
logman stop "SQLTraceNtlm_CredSSP" -ets
774836
}
775837
if($global:INISettings.SSL -eq "Yes")
776838
{
777839
LogInfo "Stopping SSL Traces..."
778-
logman stop "SSL" -ets
840+
logman stop "SQLTraceSSL" -ets
779841
}
780842
if($global:INISettings.LSA -eq "Yes")
781843
{
@@ -798,7 +860,7 @@ Function StopAuthenticationTraces
798860
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v LspDbgInfoLevel /f 2>&1 | Out-Null
799861
reg delete HKLM\SYSTEM\CurrentControlSet\Control\LSA /v LspDbgTraceOptions /f 2>&1 | Out-Null
800862

801-
logman stop "LSA" -ets
863+
logman stop "SQLTraceLSA" -ets
802864

803865
Copy-Item -Path "$($env:windir)\debug\Netlogon.*" -Destination "$($global:LogFolderName)\Auth" -Force 2>&1
804866

0 commit comments

Comments
 (0)