LDAP client tracing…


ADinsight from the sysinternals toolset is a great tool , but I seem to have problems  with it at times. Specifically on Server 2008  & Vista (maybe due to the way it hooks wldap32.dll)


On Vista OS and beyond, there is built in client ldap tracing which can give you similar results  ( with a wee bitmore effort )



In order to start the trace you use tracelog.exe ( may be able to use logman.exe as well but I have not tried it )


First , create a new key under HKLM\System\CurrentControlSet\Services\ldap\tracing\


 


The key name should be the name of the .exe you want to trace ,  mmc.exe for example.


C:\tools>Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f  ldap.etl  -flag x1FFFDFF3

 



Logger Started…


Enabling trace to logger 23


Operation Status:       0L      The operation completed successfully.

 


Logger Name:            ldap


Logger Id:              0x17


Logger Thread Id:       00000EDC


Guid:                   4a9f73a0-649c-11dd-84e5-0003ff1ee008


Buffer Size:            16 Kb


Maximum Buffers:        25


Minimum Buffers:        3


Number of Buffers:      3


Free Buffers:           2


Buffers Written:        1


Events Lost:            0


Log Buffers Lost:       0


Real Time Buffers Lost: 0


AgeLimit:               0


Real Time Consumers:    0


ClockType:              PerfCounter


Log Mode:               Sequential


Maximum File Size:      not set


Buffer Flush Timer:     not set


Log Filename:           C:\tools\ldap.etl



 


After your repro or whatnot, when you want to stop the trace use the following command:


C:\tools>tracelog -stop ldap

 



Operation Status:       0L      The operation completed successfully.


Logger Name:            ldap

Logger Id:              0x17


Logger Thread Id:       00000EDC


Guid:                   4a9f73a0-649c-11dd-84e5-0003ff1ee008

Buffer Size:            16 Kb


Maximum Buffers:        25


Minimum Buffers:        3


Number of Buffers:      4


Free Buffers:           4


Buffers Written:        1


Events Lost:            0


Log Buffers Lost:       0


Real Time Buffers Lost: 0


AgeLimit:               0


Real Time Consumers:    0


ClockType:              PerfCounter


Log Mode:               Sequential


Maximum File Size:      not set


Buffer Flush Timer:     not set


Log Filename:           C:\tools\ldap.etl



In order to format the trace to a readable format use tracerpt.exe


C:\tools>tracerpt.exe ldap.etl -o ldap2.csv -of CSV


 



Input


—————-


File(s):


     ldap.etl


100.00%


Output


—————-

DumpFile:           ldap2.csv


The command completed successfully.


 



 



 


Now, open the CSV in excel . There is a whole gob of information, but I have found that if I filter the Event ID column I can easily get what I want from it.


Below I filter on ID = 20


 



image



 


 


Have fun with it… works nicely in a pinch when you don’t have any other tools at your disposal except for the built in ones. Also works nice for the detailed returns and code flow, as well as how much time it took to perform.


 


spat


 

Comments (13)

  1. Brandon says:

    Hmmm… looks like a job for Powershell 🙂

  2. SpatDSG says:

    LOL – you and your powershell.  OK I’ll admit – it is pure laziness on my part for not learning PS yet…  convince me to repriortize it.

    spat

  3. Brandon says:

    Challenge taken 🙂 stay tuned!

  4. Brandon says:

    So.. here is a question. I can’t seem to get the GUID to work for me (even in cmd.exe)

  5. Brandon says:

    whoops.. sure the error message may be helpful

    C:dataTools>Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f  ldap.etl  -flag x1FFFDFF3

    Getting guids from C:dataTools#099614a5-5dd7-4788-8bc9-e29f43db28fc

    Error: C:dataTools#099614a5-5dd7-4788-8bc9-e29f43db28fc is invalid

  6. Brandon says:

    nm… apparently my version from 1999 was old 🙂 I am good now.

    btw… I should the Powershell script posted tomorrow. Its HOT IMO 🙂

  7. joe says:

    Hey Steve, do you know if there is an equivilent tracing functionality to capture the server side part? That would be extremely useful, especially when you have the UNIX people coming for your head because "AD is Broken". 😉

  8. SpatDSG says:

    There has been some form of tracing for DS since Win2k.. but it’s not the friendliest of data. I’ll look into either a better collection of data in 2k8 or simply post a follow up of the Win2k+ tracing available..

    spat

  9. Tony Murray says:

    In answer to Joe’s question, you can use the Windows Server 2008 Reliability and Performance Monitor to trace AD activity.  I’ve covered this here:

    http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/49/Default.aspx

    Along with the htm and xml output files that are created you also have etl trace files.  If you dump these to CSV using tracerpt as Spat shows above, you can see the LDAP activity.

  10. James says:

    Could you blog on how Microsoft ADAM supports referential integrity?

    https://www.opends.org/wiki/page/MaintainingReferentialIntegrity

  11. Yann says:

    Hello,

    When i execute the command Tracelog.exe -start ldap -guid #099614a5-5dd7-4788-8bc9-e29f43db28fc -f  ldap.etl  -flag x1FFFDFF3

    i have this result:

    Getting guids from C:WINDOWSsystem32#099614a5-5dd7-4788-8bc9-e29f43db28fc

    Error: C:WINDOWSsystem32#099614a5-5dd7-4788-8bc9-e29f43db28fc is invalid

    Any clue ?

    thx

  12. SpatDSG says:

    get the newer version of tracelog – see the previous comment from Bshell

Skip to main content