Microsoft Message Analyzer Operating Guide
 |
Important Microsoft Message Analyzer (MMA) is being retired and its download packages removed from microsoft.com sites on November 25 2019. There is currently no Microsoft replacement for Microsoft Message Analyzer in development at this time. If you already have Microsoft Message Analyzer installed, you may continue to use it, along with the OPN parsers you have already downloaded. Parsing ETW traces will also continue to work as before. After November 25 2019 when MMA is launched, it will attempt to connect to the back-end Feed service to check News and Assets updates and an error message will appear. To dismiss this errror message, see Dismiss Error Message. Introduction Microsoft Message Analyzer is a tool for capturing, displaying, and analyzing protocol messaging traffic, events, and other system or application messages in network troubleshooting and other diagnostic scenarios. Message Analyzer also enables you to load, aggregate, and analyze data from log and saved trace files. It is the successor to Microsoft Network Monitor 3.4 and is a key component in the Protocol Engineering Framework (PEF) that was created by Microsoft to improve protocol design, development, implementation testing and verification, documentation, and support. With Message Analyzer, you can choose to capture local and remote traffic live or load archived message collections from multiple data sources simultaneously. Message Analyzer enables you to display trace, log, and other message data in numerous data viewer formats, including a default tree-grid view, interactive Tool Windows, and other selectable graphical view Layouts that employ grids, bar element, timeline, and other visualizer components that provide high-level data summaries and other prominent statistics. You also have the option to configure your own custom Layouts for the Chart viewer. In addition, Message Analyzer now provides a Profiles feature, which creates interactive and integrated analysis environments that automatically display preset viewer and Layout configurations when data from specific input file types is loaded. Quick Links New Features and Updates — find out what's new in the latest release of Microsoft Message Analyzer. Message Analyzer User Roles — determine your User Role and navigate to topics that help you get started with Message Analyzer in your role. Message Analyzer Tutorial — take a detailed tour of Message Analyzer to learn about its capabilities, functions, and features. Quick Session Startup — start a new Message Analyzer local trace session with a single click. Procedures: Quick Start — see Message Analyzer in action right now by running several simple procedures. Important for Network Monitor Users — review information about the differences between Network Monitor and Message Analyzer. Feedback — provide feedback on any topic in this Operating Guide. Other Links Installing and Upgrading Message Analyzer — get a free download and install or upgrade Message Analyzer on your system. Starting Message Analyzer for the First Time — learn about how to run Message Analyzer as an Administrator, security contexts and restrictions, and syncing Message Analyzer assets for automatic updates. Training Videos — view several supplemental training videos to help you get started with Microsoft Message Analyzer. Participating in the Message Analyzer Community — review options for participating in various Message Analyzer community venues. Download PDF — download a PDF copy of this Operating Guide. |
Information Roadmap
The topics outlined in this section provide a map into the documentation contained in the Message Analyzer Operating Guide. Use this map to quickly navigate to the topics that show you how to get started with Message Analyzer, how to use its basic and more advanced features, and to understand the underlying frameworks on which it is built. At a high level, the map breaks out into the three content spaces that are specified in the following table, within which you will find quick links that point to topics of interest in these spaces:
| Content Space | Description | Navigation |
|---|---|---|
| Usage tasks | Review features and functions that you can use to perform various Message Analyzer operations. | Message Analyzer Usage Tasks |
| Usage procedures | Run procedures to see Message Analyzer in action and quickly familiarize yourself with its capabilities. | Message Analyzer Usage Procedures |
| Technology concepts | Review conceptual information to understand Message Analyzer features and the underlying technologies upon which they are built. | Message Analyzer Technology Concepts |
Message Analyzer Usage Tasks
In this Operating Guide, Message Analyzer guidance is presented in the form of usage tasks. Each task provides some conceptual background with respect to the functions and features you will be working with, discusses how to use the associated UI features, and also includes example procedures to help you walk through various Message Analyzer usage contexts. To proceed directly to the usage tasks presented in this Operating Guide, click a task link below such as Capturing Message Data:
| Getting Started with Message Analyzer See the following topics to learn how to get started with Message Analyzer: - New Features and Updates — read about the new and updated features in the latest release of Message Analyzer. - Installing and Upgrading Message Analyzer — learn about Message Analyzer installation requirements, options, and other information, which includes upgrades from earlier Message Analyzer release versions, preserving user-created assets from prior installations, window docking layout changes, security contexts, and auto-syncing Message Analyzer assets for updates. - Message Analyzer User Roles — determine your User Role based on how you intend to use Message Analyzer and navigate to topics that help you get started. - Message Analyzer Feature Summary — review the main features of Message Analyzer and use the topic links to access more detailed feature descriptions. - Quick Session Startup — learn about various methods you can use to very quickly start a new Message Analyzer session with a minimum of clicks. - Technology Tutorials — read a tutorial on Message Analyzer functions before you dive into the usage tasks and procedures. Optionally, review the Protocol Engineering Framework (PEF) architecture and Event Tracing for Windows (ETW) framework tutorials to understand the technologies upon which Message Analyzer is built. - Message Analyzer Startup Options — review the methods you can use to start Message Analyzer, which includes the arguments and command switches that are available to launch Message Analyzer from the command line. - Setting Message Analyzer Global Options — set global options such as default values and settings that can affect Message Analyzer performance, display configurations, feature activations, and Profile activations. - Procedures: Quick Start — run several simple procedures to quickly see Message Analyzer in action. |
Capturing Message Data Review the following topics to learn how to configure, start, and edit a Message Analyzer session, or configure a session scenario that targets multiple data sources, including local and multiple concurrent remote sessions. Discover how to start a session with a single click, how to use predefined Trace Scenario configurations and other message providers, how to create and save custom Live Trace Session configurations to run on-demand, how to use decryption, and how to enhance capture configurations with filtering, ETW system providers, and promiscuous mode: - Starting a Message Analyzer Session — familiarize yourself with the types of sessions you can configure and start with Message Analyzer; also review common steps that you can use to create a basic session. - Targeting Live Data as an Input Source — learn about the many different message providers that Message Analyzer uses as a source for live input data. Also learn about built-in Trace Scenarios, quickly starting a Trace Scenario, using system ETW providers, optimizing capture configurations, and session configuration workflow. - Configuring a Live Trace Session — select and configure predefined Trace Scenarios, set predefined Parsing Levels, configure Fast Filters and Session Filters, configure system ETW providers, use advanced session configuration, select data viewers, and more. - Built-In Trace Scenarios — review the functions and usage configurations of the built-in Message Analyzer Trace Scenarios in the Network, Device, System, and File Sharing categories. - Decrypting TLS and SSL Encrypted Data — specify a server certificate and password to enable decryption and analysis of TLS/SSL encrypted traffic, which includes TCP, HTTP, and Remote Desktop Protocol (RDP) messages. - Selecting Data to Capture — learn how to configure a Live Trace Session to capture specifically targeted data by applying a Session Filter and/or a Parsing Level. - Configuring a Remote Capture — learn how to capture traffic concurrently on multiple remote hosts, which includes traffic on virtual machines that are serviced by a Hyper-V-Switch, along with advanced packet filtering and other special filters. - Promiscuous Mode — learn how to capture data in P-Mode, if supported by your network adapter. - Creating and Managing Custom Trace Scenarios — design a custom capture configuration template, save it as a Trace Scenario, and run it on demand. - Editing Existing Sessions — learn how to reconfigure an existing session and apply the changes to existing data. - Configuring Session Scenarios with Selected Data Sources — discover how to make use of the flexible session framework with multiple data sources capability that enables you to create Data Retrieval Sessions with multiple data loading configurations or Live Trace Sessions with multiple capture configurations for local and remote tracing. |
| Retrieving Message Data Review the following topics to learn how to load input data from saved files, filter input data, and present it in a chosen viewer when loading messages through a Message Analyzer Data Retrieval Session: - Browse-Select-View Model — learn about the Message Analyzer BSV infrastructure that enables you to browse for multiple data sources, filter or select specific data from those sources, and present results in a viewer of choice for data manipulation and analysis. - Targeting Saved Data as an Input Source — browse for and load saved data from numerous log and trace file types into Message Analyzer, for example, *.matp, *.cap, *.evtx, .etl, *.log, *.csv, *.oms, *ps1, *.dmp, and *.saz files. - Configuring a Data Retrieval Session — learn how to configure a Data Retrieval Session and make use of such features as session Filtering, Truncated Parsing, Parsing Levels, Decryption, Text log parsing, and more. - Selecting Data to Retrieve — learn how to use a Session Filter, a Time Filter, and/or a Parsing Level to select specific data in a trace that you want to load into Message Analyzer. - Acquiring Data From Other Input Sources — learn about other unique input data sources that Message Analyzer supports, such as Azure, Event Log, and SQL data; along with Operations Management Suite (OMS) log data and WPP-generated events. Also see Working With Special Input Requirements to learn about text log support. - Selecting a Data Retrieval Session Viewer — learn how to specify a data viewer that displays message data that you load from one or more data sources in a Data Retrieval Session. - Loading WPP-Generated Events — learn how to enable parsing of Windows software trace preprocessor (WPP)-generated events in Message Analyzer. |
Viewing Message Data Review the following topics to learn about the different data viewers that Message Analyzer provides, along with the capabilities that enable you to manipulate data views: - Data Viewer Concepts — review background concepts about the Message Analyzer data viewing infrastructure to learn the basics on how data viewers work and interact. - Data Viewers — learn about the data viewers that are available for data analysis, including the Analysis Grid Viewer, Grouping Viewer, Pattern Match Viewer, Gantt Viewer, and others, along with their associated data manipulation components. Also discover how to use Chart Viewer Layouts to display top-level protocol summary information and computed statistical values in graphic data visualizers for targeted analysis. - Session Data Viewer Options — find out how to open various data viewers from multiple locations. - Common Data Viewer Features — learn about Message Analyzer data manipulation tools that are common to the Analysis Grid and other viewers, such as view Filters, Time Filters, Viewpoints, Operations, Aliases, Unions, Time Shifts, and the Flat Message List feature that simulates the Network Monitor view. - Tool Windows — understand how to use message-specific and session-specific Tool Windows that provide additional message details or configuration capabilities in Message Analyzer, for example, the Diagnostics, Details, Message Stack, Decryption, Selection, Bookmarks, and other Tool Windows. - Working with Message Analyzer Window Layouts — learn how to create a customized working environment by selecting viewer and Tool Window preset configurations. Also learn how to use the redocking feature for data viewers and Tool Windows. - Working With Message Analyzer Profiles — learn how to display a focused analysis environment by selecting a built-in or custom-designed data viewer and Layout preset configuration that automatically displays whenever you are loading data from a specific type of input file with which a Profile is associated. |
| Filtering Message Data View the following topics to learn about selecting data in a Data Retrieval Session, applying filters to a Live Trace Session to isolate specific data, applying filters to trace results for analysis, using Color Rules to create conditional alerts or flags in a set of trace results, and understanding the Filtering Language: - Filtering Loaded Input Data — apply a Session Filter to isolate specific data from a specified input file/s configuration. - Filtering Captured Input Data — apply a Fast Filter, Keyword filter, WFP Layer Set filter, Advanced Settings filters, or an HTTP filter at the driver level to a Live Trace Session, or apply a predefined or custom Filter Expression as a Session Filter in the New Session dialog when configuring a Live Trace Session. - Filtering Live Trace Session Results — select a filter expression from the common Library of predefined filters and apply it as a view Filter to the results of a Live Trace Session. - Writing Filter Expressions — understand the Filtering Language so you can create your own filter expressions. |
Saving Message Data Review the following topics to learn how to save session data, which includes selecting messages to save, specifying the save file format, and using session naming conventions. - Saving Session Data — read a quick overview of how to save your message data from a Data Retrieval Session or a Live Trace Session. - Selecting Messages to Save — review the options that are available for saving message data. - Naming Saved Files — review some naming strategies and other considerations for saving message data. Automating Tracing Functions with PowerShell Get a quick overview of the Message Analyzer functions that are enabled for the PowerShell scripting environment, as described in the following topics: - Using PowerShell Cmdlets — read a synopsis of action, trigger, and other cmdlets that are available to automate various Message Analyzer functions and operations. - Examining a PowerShell Script Example — review an example PowerShell script that configures a message provider, adds a Trace Filter, and sets various triggers for starting, filtering, stopping, and saving a trace session. - Accessing PowerShell Cmdlets and Help — find out how to get PowerShell v3, access and update cmdlet help, and view the cmdlet help for Message Analyzer. |
| Managing Message Analyzer Assets Review the following topics to learn about the Message Analyzer Sharing Infrastructure, user Libraries, automatic asset updates, downloading asset collections, and creating user feeds for sharing assets with others: - Sharing Infrastructure — learn about the Message Analyzer Sharing Infrastructure; the user Library item collections that enable you to manipulate how data is captured, viewed, and analyzed; and how to manage these user Libraries. - Managing Asset Collection Downloads and Updates — find out how to download user Library item collections and how to utilize the auto-sync feature to automatically receive user Library updates that are pushed out by a Microsoft web service. - Managing Microsoft OPN Parser Packages — learn how to auto-sync updates to OPN Parser packages and download them from the Microsoft web service. - Creating Custom User Feeds — create your own user feeds to which others may subscribe, for mutually sharing Message Analyzer assets with other team members, for example, Filters, Trace Scenarios, Profiles, viewer Layouts, and so on. - Sharing Asset Collections on a User File Share — learn how to share user Library item collections directly with other users by exporting/importing collections or items to/from a file share. |
Extending Message Analyzer Data Viewing Capabilities Review the following topics to discover how to create custom Layouts for the Chart viewer that you can design to your own specifications with the use of various graphic visualizer components and data formulas. Enables you to extend Message Analyzer data viewing capabilities. Also learn how you can edit and customize any built-in Layout for the Chart viewer: - Configuring Chart Viewer Layouts — learn how to use the Message Analyzer Chart viewer Layout configuration features to create a new Layout of your own design that is customized to your analysis environment. - Using the Edit Chart Layout Dialog — learn how to use the controls and features of the Edit Chart Layout dialog to specify a visualizer component, data field values, and data formulas. - Configuration Walkthrough of a Built-In Chart Viewer Layout — perform a walkthrough of the built-in TCP/UDP Conversations by Message Count Layout for the Chart viewer to familiarize yourself with the configuration features that you can use to create a functioning Layout of your own, based on a built-in and functioning Layout. Includes specifying graphic visualizer components and creating data formulas that perform various operations on message field values. |
Message Analyzer Usage Procedures
If you want to proceed directly to usage procedures that demonstrate Message Analyzer features in the context of the usage tasks contained in this Operating Guide, click a link below:
Procedures: Quick Start — display saved data with the Open feature; start a Live Trace Session; display data quickly from your favorite Trace Scenarios by using the Favorite Scenarios feature on the Message Analyzer File menu or Start Page; load saved data through a Data Retrieval Session; and deploy various viewers, which includes Layouts for the Chart viewer, to display your data.
Procedures: Using the Network Tracing Features — run a Local Network Interfaces trace that isolates data to a particular network adapter and IPv4 address; perform a Loopback and Unencrypted IPSEC trace with a high-performance, driver-level Fast Filter that is set to capture HTTP traffic from TCP port 80; run a Pre-Encryption for HTTPS trace with driver-level Hostname and Port filters to isolate client and server HTTP message exchanges; capture traffic with a Remote Network Interfaces trace on a virtual machine (VM) that is serviced by a Hyper-V-Switch on a remote Windows 8.1, Windows 10, or Windows Server 2012 R2 host; and design a custom Trace Scenario and run it on demand.
Procedures: Using the Data Retrieval Features — browse for data and create a message collection to load into Message Analyzer; apply a Session Filter to loaded input data to isolate specific messages that you want to work with; display saved trace data in different viewers; use the Recent Files feature to display saved trace data to resume previous work; load data from multiple sources and save it as a single message collection; and apply a Time Filter to data being loaded into Message Analyzer.
Procedures: Using the Data Viewing Features — learn how to apply gradient-style Color Rules or a built-in view Layout; execute Group commands to group data and streamline message analysis; use the graphic visualizer components of the Protocol Dashboard to analyze top-level summary data such as top bandwidth consumption and message activity within a specified time window; analyze data with the interactive features of the Protocol Dashboard and Analysis Grid viewers; apply Quick Filters and Viewpoints; configure friendly Aliases for field values; create Unions of two or more message fields; and drive the display of various message details through Analysis Grid viewer and Tool Window interactions.
Procedures: Using the Data Filtering Features — create and apply filters to the data loading process, live captures, and trace results data to address and solve commonly encountered, real-world issues; create Color Rules to serve as an alert when certain message types, states, or values are present in a displayed message set, for example, TCP diagnostic information and SMB error status.
Procedures: Using the Asset Management Features — perform procedures that demonstrate how to manage user Library items and share them with others, or download and update Library item collections from the default Message Analyzer subscriber feed.
Configuration Walkthrough of a Built-In Chart Viewer Layout — perform a walkthrough of the built-in TCP/UDP Conversations by Message Count view Layout for Charts to familiarize yourself with the configuration features that you can use to create a functioning Layout of your own.
Message Analyzer Technology Concepts
If you want to expand your knowledge of the technologies upon which Message Analyzer is built, click the links below:
Technology Tutorials — get an overview of Message Analyzer functions and technology concepts, and learn about the PEF architecture and ETW framework components that support them: