Partager via

LDAP client tracing...

  • Article

ADinsight from the sysinternals toolset is a great tool , but I seem to have problems with it at times. Specifically on Server 2008 & Vista (maybe due to the way it hooks wldap32.dll)

On Vista OS and beyond, there is built in client ldap tracing which can give you similar results ( with a wee bitmore effort )

In order to start the trace you use tracelog.exe ( may be able to use logman.exe as well but I have not tried it )

First , create a new key under HKLM\System\CurrentControlSet\Services\ldap\tracing\

 

The key name should be the name of the .exe you want to trace , mmc.exe for example.

C:\tools>Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f ldap.etl -flag x1FFFDFF3
 

Logger Started...

Enabling trace to logger 23

Operation Status: 0L The operation completed successfully.

 

Logger Name: ldap

Logger Id: 0x17

Logger Thread Id: 00000EDC

Guid: 4a9f73a0-649c-11dd-84e5-0003ff1ee008

Buffer Size: 16 Kb

Maximum Buffers: 25

Minimum Buffers: 3

Number of Buffers: 3

Free Buffers: 2

Buffers Written: 1

Events Lost: 0

Log Buffers Lost: 0

Real Time Buffers Lost: 0

AgeLimit: 0

Real Time Consumers: 0

ClockType: PerfCounter

Log Mode: Sequential

Maximum File Size: not set

Buffer Flush Timer: not set

Log Filename: C:\tools\ldap.etl

After your repro or whatnot, when you want to stop the trace use the following command:

C:\tools>tracelog -stop ldap

 

Operation Status: 0L The operation completed successfully.

Logger Name: ldap

Logger Id: 0x17

Logger Thread Id: 00000EDC

Guid: 4a9f73a0-649c-11dd-84e5-0003ff1ee008

Buffer Size: 16 Kb

Maximum Buffers: 25

Minimum Buffers: 3

Number of Buffers: 4

Free Buffers: 4

Buffers Written: 1

Events Lost: 0

Log Buffers Lost: 0

Real Time Buffers Lost: 0

AgeLimit: 0

Real Time Consumers: 0

ClockType: PerfCounter

Log Mode: Sequential

Maximum File Size: not set

Buffer Flush Timer: not set

Log Filename: C:\tools\ldap.etl

In order to format the trace to a readable format use tracerpt.exe

C:\tools>tracerpt.exe ldap.etl -o ldap2.csv -of CSV

 

Input

----------------

File(s):

     ldap.etl

100.00%

Output

----------------

DumpFile: ldap2.csv

The command completed successfully.

Now, open the CSV in excel . There is a whole gob of information, but I have found that if I filter the Event ID column I can easily get what I want from it.

Below I filter on ID = 20

 

image

 

 

Have fun with it... works nicely in a pinch when you don't have any other tools at your disposal except for the built in ones. Also works nice for the detailed returns and code flow, as well as how much time it took to perform.

 

spat

Comments

  • Anonymous
    August 12, 2008
    Hmmm... looks like a job for Powershell :)

  • Anonymous
    August 12, 2008
    LOL - you and your powershell.  OK I'll admit - it is pure laziness on my part for not learning PS yet...  convince me to repriortize it. spat

  • Anonymous
    August 13, 2008
    Challenge taken :) stay tuned!

  • Anonymous
    August 13, 2008
    So.. here is a question. I can't seem to get the GUID to work for me (even in cmd.exe)

  • Anonymous
    August 13, 2008
    The comment has been removed

  • Anonymous
    August 13, 2008
    The comment has been removed

  • Anonymous
    August 14, 2008
    My blog post response http://bsonposh.com/archives/347

  • Anonymous
    August 20, 2008
    The comment has been removed

  • Anonymous
    August 25, 2008
    There has been some form of tracing for DS since Win2k.. but it's not the friendliest of data. I'll look into either a better collection of data in 2k8 or simply post a follow up of the Win2k+ tracing available.. spat

  • Anonymous
    September 23, 2008
    In answer to Joe's question, you can use the Windows Server 2008 Reliability and Performance Monitor to trace AD activity.  I've covered this here: http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/49/Default.aspx Along with the htm and xml output files that are created you also have etl trace files.  If you dump these to CSV using tracerpt as Spat shows above, you can see the LDAP activity.

  • Anonymous
    February 02, 2009
    Could you blog on how Microsoft ADAM supports referential integrity? https://www.opends.org/wiki/page/MaintainingReferentialIntegrity

  • Anonymous
    August 07, 2009
    The comment has been removed

  • Anonymous
    August 10, 2009
    get the newer version of tracelog - see the previous comment from Bshell