Winsock Tracing

Applies To: Windows Server 2008 R2

Winsock does not log events unless Event Tracing for Windows (ETW) is enabled for Microsoft-Windows-Winsock-AFD, which is disabled by default. After ETW is enabled, an event is logged whenever a Winsock-based application uses one of the core Winsock operations, such as creating a socket.

To verify that tracing for Winsock is enabled:

1. To start tracing, at the command prompt, type logman start winsocktrace -p Microsoft-Windows-Winsock-AFD –o winsocktrace.etl –ets.
2. To stop tracing, type logman stop winsocktrace -ets.
3. To view the report in XML format, type tracerpt winsocktrace.etl -y -o winsocktracelog.xml -of xml.

Note:   Alternatively, tracing can be enabled or disabled by using Event Viewer.

Events

Event ID	Source	Message
1	Microsoft-Windows-Winsock-WS2HELP	Socket creation: %1 %2 %3 %4 %5
2	Microsoft-Windows-Winsock-WS2HELP	Socket bind: %1 %2 %3 %4 %5
3	Microsoft-Windows-Winsock-WS2HELP	Socket bind: %1 %2 %3 %4 %5
4	Microsoft-Windows-Winsock-WS2HELP	Socket connect: %1 %2 %3 %4
5	Microsoft-Windows-Winsock-WS2HELP	Socket connect: %1 %2 %3 %4
6	Microsoft-Windows-Winsock-WS2HELP	Connect completed: %1 %2 %3
7	Microsoft-Windows-Winsock-WS2HELP	AFD initiated abort: %1 %2 %3
8	Microsoft-Windows-Winsock-WS2HELP	Transport initiated abort: %1 %2 %3
9	Microsoft-Windows-Winsock-WS2HELP	Failed send request: %1 %2 %3
10	Microsoft-Windows-Winsock-WS2HELP	Failed WSASendMsg request: %1 %2 %3
11	Microsoft-Windows-Winsock-WS2HELP	Failed recv request: %1 %2 %3
12	Microsoft-Windows-Winsock-WS2HELP	Failed recvfrom request: %1 %2 %3
13	Microsoft-Windows-Winsock-WS2HELP	Socket close: %1 %2 %3
14	Microsoft-Windows-Winsock-WS2HELP	Socket cleanup (all references removed): %1 %2 %3
15	Microsoft-Windows-Winsock-WS2HELP	Socket accept: %1 %2 %3 %4 %5
16	Microsoft-Windows-Winsock-WS2HELP	Socket accept: %1 %2 %3 %4 %5
17	Microsoft-Windows-Winsock-WS2HELP	Accept failed: %1 %2 %3
18	Microsoft-Windows-Winsock-WS2HELP	Send posted: %1 %2 %3 %4 %5 %6
19	Microsoft-Windows-Winsock-WS2HELP	Receive posted: %1 %2 %3 %4 %5 %6
20	Microsoft-Windows-Winsock-WS2HELP	RecvFrom posted: %1 %2 %3 %4 %5 %6
21	Microsoft-Windows-Winsock-WS2HELP	SendTo posted: %1 %2 %3 %4 %5 %6 %7 %8
22	Microsoft-Windows-Winsock-WS2HELP	SendTo posted: %1 %2 %3 %4 %5 %6 %7 %8
23	Microsoft-Windows-Winsock-WS2HELP	Recv completed: %1 %2 %3 %4
24	Microsoft-Windows-Winsock-WS2HELP	Send completed: %1 %2 %3 %4
25	Microsoft-Windows-Winsock-WS2HELP	SendMsg completed: %1 %2 %3 %4
26	Microsoft-Windows-Winsock-WS2HELP	RecvFrom completed: %1 %2 %3 %4 %5 %6 %7
27	Microsoft-Windows-Winsock-WS2HELP	RecvFrom completed: %1 %2 %3 %4 %5 %6 %7
28	Microsoft-Windows-Winsock-WS2HELP	SendTo completed: %1 %2 %3 %4
29	Microsoft-Windows-Winsock-WS2HELP	Socket option set: %1 %2 %3 %4
30	Microsoft-Windows-Winsock-WS2HELP	Select/Poll posted: %1 %2 %3
31	Microsoft-Windows-Winsock-WS2HELP	Select/Poll completed: %1 %2 %3
32	Microsoft-Windows-Winsock-WS2HELP	WSAEventSelect: %1 %2 %3
33	Microsoft-Windows-Winsock-WS2HELP	Datagram dropped: %1 %2 %3 %4 %5 %6
34	Microsoft-Windows-Winsock-WS2HELP	Datagram dropped: %1 %2 %3 %4 %5 %6
35	Microsoft-Windows-Winsock-WS2HELP	Connection indicated: %1 %2 %3 %4
36	Microsoft-Windows-Winsock-WS2HELP	Connection indicated: %1 %2 %3 %4
37	Microsoft-Windows-Winsock-WS2HELP	Data indicated from transport: %1 %2 %3
38	Microsoft-Windows-Winsock-WS2HELP	Data indicated from transport: %1 %2 %3 %4 %5
39	Microsoft-Windows-Winsock-WS2HELP	Data indicated from transport: %1 %2 %3 %4 %5
40	Microsoft-Windows-Winsock-WS2HELP	Failed bind: %1 %2 %3

Related Management Information

Winsock2

Networking