LDAP client tracing...
ADinsight from the sysinternals toolset is a great tool , but I seem to have problems with it at times. Specifically on Server 2008 & Vista (maybe due to the way it hooks wldap32.dll)
On Vista OS and beyond, there is built in client ldap tracing which can give you similar results ( with a wee bitmore effort )
In order to start the trace you use tracelog.exe ( may be able to use logman.exe as well but I have not tried it )
First , create a new key under HKLM\System\CurrentControlSet\Services\ldap\tracing\
The key name should be the name of the .exe you want to trace , mmc.exe for example.
C:\tools>Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f ldap.etl -flag x1FFFDFF3
Logger Started...
Enabling trace to logger 23
Operation Status: 0L The operation completed successfully.
Logger Name: ldap
Logger Id: 0x17
Logger Thread Id: 00000EDC
Guid: 4a9f73a0-649c-11dd-84e5-0003ff1ee008
Buffer Size: 16 Kb
Maximum Buffers: 25
Minimum Buffers: 3
Number of Buffers: 3
Free Buffers: 2
Buffers Written: 1
Events Lost: 0
Log Buffers Lost: 0
Real Time Buffers Lost: 0
AgeLimit: 0
Real Time Consumers: 0
ClockType: PerfCounter
Log Mode: Sequential
Maximum File Size: not set
Buffer Flush Timer: not set
Log Filename: C:\tools\ldap.etl
After your repro or whatnot, when you want to stop the trace use the following command:
C:\tools>tracelog -stop ldap
Operation Status: 0L The operation completed successfully.
Logger Name: ldap
Logger Id: 0x17
Logger Thread Id: 00000EDC
Guid: 4a9f73a0-649c-11dd-84e5-0003ff1ee008
Buffer Size: 16 Kb
Maximum Buffers: 25
Minimum Buffers: 3
Number of Buffers: 4
Free Buffers: 4
Buffers Written: 1
Events Lost: 0
Log Buffers Lost: 0
Real Time Buffers Lost: 0
AgeLimit: 0
Real Time Consumers: 0
ClockType: PerfCounter
Log Mode: Sequential
Maximum File Size: not set
Buffer Flush Timer: not set
Log Filename: C:\tools\ldap.etl
In order to format the trace to a readable format use tracerpt.exe
C:\tools>tracerpt.exe ldap.etl -o ldap2.csv -of CSV
Input
----------------
File(s):
ldap.etl
100.00%
Output
----------------
DumpFile: ldap2.csv
The command completed successfully.
Now, open the CSV in excel . There is a whole gob of information, but I have found that if I filter the Event ID column I can easily get what I want from it.
Below I filter on ID = 20
Have fun with it... works nicely in a pinch when you don't have any other tools at your disposal except for the built in ones. Also works nice for the detailed returns and code flow, as well as how much time it took to perform.
spat
Comments
Anonymous
August 12, 2008
Hmmm... looks like a job for Powershell :)Anonymous
August 12, 2008
LOL - you and your powershell. OK I'll admit - it is pure laziness on my part for not learning PS yet... convince me to repriortize it. spatAnonymous
August 13, 2008
Challenge taken :) stay tuned!Anonymous
August 13, 2008
So.. here is a question. I can't seem to get the GUID to work for me (even in cmd.exe)Anonymous
August 13, 2008
The comment has been removedAnonymous
August 13, 2008
The comment has been removedAnonymous
August 14, 2008
My blog post response http://bsonposh.com/archives/347Anonymous
August 20, 2008
The comment has been removedAnonymous
August 25, 2008
There has been some form of tracing for DS since Win2k.. but it's not the friendliest of data. I'll look into either a better collection of data in 2k8 or simply post a follow up of the Win2k+ tracing available.. spatAnonymous
September 23, 2008
In answer to Joe's question, you can use the Windows Server 2008 Reliability and Performance Monitor to trace AD activity. I've covered this here: http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/49/Default.aspx Along with the htm and xml output files that are created you also have etl trace files. If you dump these to CSV using tracerpt as Spat shows above, you can see the LDAP activity.Anonymous
February 02, 2009
Could you blog on how Microsoft ADAM supports referential integrity? https://www.opends.org/wiki/page/MaintainingReferentialIntegrityAnonymous
August 07, 2009
The comment has been removedAnonymous
August 10, 2009
get the newer version of tracelog - see the previous comment from Bshell