Skip to content

Commit 6bf8b6d

Browse files
Malcolm-StewartMalcolm-Stewart
committed
Miscellaneous fixes
SQLTrace misc fixes SQL Network Analyzer misc fixes
1 parent bf0e322 commit 6bf8b6d

File tree

2 files changed

+98
-139
lines changed

2 files changed

+98
-139
lines changed

‎SQLTrace/SQLTrace.ps1‎

Lines changed: 94 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
#
1515
# .\SQLTrace.ps1 -Help
1616
# .\SQLTrace.ps1 -Setup [-INIFile SQLTrace.ini]
17-
# .\SQLTrace.ps1 -Start [-StopAfter 0] [-INIFile SQLTrace.ini]
17+
# .\SQLTrace.ps1 -Start [-INIFile SQLTrace.ini] [-LogFolder folderpath] [-StopAfter minutes]
1818
# .\SQLTrace.ps1 -Stop [-INIFile SQLTrace.ini]
1919
# .\SQLTrace.ps1 -Cleanup [-INIFile SQLTrace.ini]
2020
#
@@ -70,15 +70,14 @@ $PathsToClean = @{} # for DeleteOldFiles
7070

7171
Function Main
7272
{
73-
$OutputEncoding = [console]::OutputEncoding # Prevents mix of UNICODE and ANSI logs in SQLTrace.log
73+
$OutputEncoding = [console]::OutputEncoding # Prevents mix of UNICODE and ANSI logs in SQLTrace.log
7474
if (PreReqsOkay)
7575
{
7676
ReadINIFile
77-
DisplayINIValues # TODO hide
7877
RegisterEventLog
7978

80-
if ($Setup) { DisplayLicenseAndHeader; SetupTraces } # set BID Trace :Path registry if asked for in the INI file
81-
elseif ($Start) { SetLogFolderName; DisplayLicenseAndHeader; StartTraces } # set BID Trace registry if not already set, then pause and prompt to restart app
79+
if ($Setup) { DisplayLicenseAndHeader; DisplayINIValues; SetupTraces } # set BID Trace :Path registry if asked for in the INI file
80+
elseif ($Start) { SetLogFolderName; DisplayLicenseAndHeader; DisplayINIValues; StartTraces } # set BID Trace registry if not already set, then pause and prompt to restart app
8281
elseif ($Stop) { GetLogFolderName; StopTraces }
8382
elseif ($Cleanup) { CleanupTraces }
8483
else { DisplayLicenseAndHeader; DisplayHelpMessage }
@@ -96,7 +95,7 @@ LogRaw "
9695
/_______ /\_____\ \_/|_______ \|____| |__| (____ / \___ >\___ >
9796
\/ \__> \/ \/ \/ \/
9897
99-
SQLTrace.ps1 version 1.0.0200.0
98+
SQLTrace.ps1 version 1.0.0211.0
10099
by the Microsoft SQL Server Networking Team
101100
"
102101

@@ -211,7 +210,7 @@ Function ReadINIFile
211210
{
212211
"BIDTrace" { $global:INISettings.BIDTrace = $value }
213212
"BIDWow" { $global:INISettings.BIDWow = $value }
214-
"BIDProviderList" { $global:INISettings.BIDProviderList = $value ; while ( $global:INISettings.BIDProviderList.IndexOf(" ") -ge 0) { $global:INISettings.BIDProviderList = $global:INISettings.BIDProviderList.Replace(" ", " ") } } # remove extra spaces between provider names
213+
"BIDProviderList" { $global:INISettings.BIDProviderList = $value ; while ( $global:INISettings.BIDProviderList.IndexOf(" ") -gt 0) { $global:INISettings.BIDProviderList = $global:INISettings.BIDProviderList.Replace(" ", " ") } } # remove extra spaces between provider names
215214
"NETTrace" { $global:INISettings.NetTrace = $value }
216215
"NETSH" { $global:INISettings.NETSH = $value }
217216
"PSNETCAPTURE" { $global:INISettings.PSNETCAPTURE = $value }
@@ -240,35 +239,36 @@ Function ReadINIFile
240239

241240
Function DisplayINIValues
242241
{
243-
"Read the ini file: $INIFile"
244-
""
245-
"BIDTrace " + $global:INISettings.BIDTrace
246-
"BIDWow " + $global:INISettings.BIDWow
247-
"BIDProviderList " + $global:INISettings.BIDProviderList
248-
""
249-
"NETTrace " + $global:INISettings.NETTrace
250-
"NETSH " + $global:INISettings.NETSH
251-
"PSNETCAPTURE " + $global:INISettings.PSNETCAPTURE
252-
"NETMON " + $global:INISettings.NETMON
253-
"WireShark " + $global:INISettings.WireShark
254-
"PktMon " + $global:INISettings.PktMon
255-
"TruncatePackets " + $global:INISettings.TruncatePackets
256-
"TCPEvents " + $global:INISettings.TCPEvents
257-
"FilterString " + $global:INISettings.FilterString
258-
""
259-
"AuthTrace " + $global:INISettings.AuthTrace
260-
"SSL " + $global:INISettings.SSL
261-
"CredSSP_NTLM " + $global:INISettings.CredSSP
262-
"Kerberos " + $global:INISettings.Kerberos
263-
"LSA " + $global:INISettings.LSA
264-
""
265-
"FlushTickets " + $global:INISettings.FlushTickets
266-
"EventViewer " + $global:INISettings.EventViewer
267-
"SQLErrorLog " + $global:INISettings.SQLErrorLog
268-
"SQLXEventLog " + $global:INISettings.SQLXEventLog
269-
"DeleteOldFiles " + $global:INISettings.DeleteOldFiles
270-
"MinFiles " + $global:INISettings.MinFiles
271-
"MinMinutes " + $global:INISettings.MinMinutes
242+
LogInfo ""
243+
LogInfo "Read the ini file: $INIFile"
244+
LogInfo ""
245+
LogInfo "BIDTrace $($global:INISettings.BIDTrace)"
246+
LogInfo "BIDWow $($global:INISettings.BIDWow)"
247+
LogInfo "BIDProviderList $($global:INISettings.BIDProviderList)"
248+
LogInfo ""
249+
LogInfo "NETTrace $($global:INISettings.NETTrace)"
250+
LogInfo "NETSH $($global:INISettings.NETSH)"
251+
LogInfo "PSNETCAPTURE $($global:INISettings.PSNETCAPTURE)"
252+
LogInfo "NETMON $($global:INISettings.NETMON)"
253+
LogInfo "WireShark $($global:INISettings.WireShark)"
254+
LogInfo "PktMon $($global:INISettings.PktMon)"
255+
LogInfo "TruncatePackets $($global:INISettings.TruncatePackets)"
256+
LogInfo "TCPEvents $($global:INISettings.TCPEvents)"
257+
LogInfo "FilterString $($global:INISettings.FilterString)"
258+
LogInfo ""
259+
LogInfo "AuthTrace $($global:INISettings.AuthTrace)"
260+
LogInfo "SSL $($global:INISettings.SSL)"
261+
LogInfo "CredSSP_NTLM $($global:INISettings.CredSSP)"
262+
LogInfo "Kerberos $($global:INISettings.Kerberos)"
263+
LogInfo "LSA $($global:INISettings.LSA)"
264+
LogInfo ""
265+
LogInfo "FlushTickets $($global:INISettings.FlushTickets)"
266+
LogInfo "EventViewer $($global:INISettings.EventViewer)"
267+
LogInfo "SQLErrorLog $($global:INISettings.SQLErrorLog)"
268+
LogInfo "SQLXEventLog $($global:INISettings.SQLXEventLog)"
269+
LogInfo "DeleteOldFiles $($global:INISettings.DeleteOldFiles)"
270+
LogInfo "MinFiles $($global:INISettings.MinFiles)"
271+
LogInfo "MinMinutes $($global:INISettings.MinMinutes)"
272272
}
273273

274274
function RegisterEventLog
@@ -495,9 +495,6 @@ Function FlushCaches
495495
}
496496

497497
StopDeleteOldFiles
498-
499-
# StopCleanupETLTraceFiles -jobname "BIDTRACECLEANUP"
500-
# StopCleanupETLTraceFiles -jobname "NETWORKTRACECLEANUP"
501498
}
502499

503500
Function GETBIDTraceGuid($bidProvider)
@@ -585,7 +582,7 @@ Function StartBIDTraces
585582
$guid | Out-File -FilePath "$($global:LogFolderName)\BIDTraces\ctrl.guid" -Append -Encoding Ascii
586583
}
587584

588-
$result = logman start SQLTraceBID -pf "$($global:LogFolderName)\BIDTraces\ctrl.guid" -o "$($global:LogFolderName)\BIDTraces\bidtrace%d.etl" -bs 1024 -nb 1024 1024 -mode NewFile -max 200 -ets
585+
$result = logman start SQLTraceBID -pf "$($global:LogFolderName)\BIDTraces\ctrl.guid" -o "$($global:LogFolderName)\BIDTraces\bidtrace%d.etl" -bs 1024 -nb 1024 1024 -mode NewFile -max 300 -ets
589586
LogInfo "LOGMAN: $result"
590587

591588
# Values for DeleteOldFiles
@@ -606,9 +603,8 @@ Function StartWireshark
606603
$ArgumentList = ""
607604
For($cDevices=0;$cDevices -lt $DeviceList.Count;$cDevices++) { $ArgumentList = $ArgumentList + " -i " + ($cDevices+1) }
608605
##Prepare command arguments
609-
$ArgumentList = " $truncatePackets " + $ArgumentList + " -w `"$($global:LogFolderName)\NetworkTraces\nettrace.pcap`" -b filesize:200000 $($global:INISettings.FilterString)"
606+
$ArgumentList = " $truncatePackets " + $ArgumentList + " -w `"$($global:LogFolderName)\NetworkTraces\nettrace.pcap`" -b filesize:300000 $($global:INISettings.FilterString)"
610607
LogInfo "Dumpcap Args: $ArgumentList"
611-
# [System.Diagnostics.Process] $WiresharkProcess = Start-Process $WiresharkCmd -PassThru -NoNewWindow -ArgumentList $ArgumentList
612608
[System.Diagnostics.Process] $WiresharkProcess = Start-Process $WiresharkCmd -PassThru -NoNewWindow -RedirectStandardOutput "$($global:LogFolderName)\NetworkTraces\Console.txt" -ArgumentList $ArgumentList
613609
LogInfo "Wireshark is running with PID: " + $WiresharkProcess.ID
614610

@@ -628,7 +624,7 @@ Function StartNetworkMonitor
628624
$NMCap = Get-ItemPropertyValue -Path 'HKLM:\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Netmon3\' -Name InstallDir
629625

630626
$NMCap = '"' + $NMCap + "nmcap.exe" + '" '
631-
$ArgumentList = "/network * /capture $($global:INISettings.FilterString) /file `"$($global:LogFolderName)\NetworkTraces\nettrace.chn:200M`" /StopWhen /Frame dns.qrecord.questionname.Contains('stopsqltrace') $truncatePackets"
627+
$ArgumentList = "/network * /capture $($global:INISettings.FilterString) /file `"$($global:LogFolderName)\NetworkTraces\nettrace.chn:300M`" /StopWhen /Frame dns.qrecord.questionname.Contains('stopsqltrace') $truncatePackets"
632628
LogInfo "NMCAP Args: $ArgumentList"
633629

634630
#Start the capture
@@ -643,95 +639,6 @@ Function StartNetworkMonitor
643639
$PathsToClean.Add("NMCAP", $CleanupValues)
644640
}
645641

646-
647-
## Create generic version of Cleanup Traces for BIDS, Network etc.
648-
Function StartCleanupETLTraceFiles
649-
{
650-
param
651-
(
652-
[string] $jobname,
653-
[string] $folder,
654-
[int] $numofFilesToKeep,
655-
[int] $jobrunintervalMin
656-
)
657-
658-
$job=Register-ScheduledJob -Name $jobname -scriptblock {
659-
Param($jobname,
660-
[string] $folder,
661-
[int] $numofFilesToKeep,
662-
[int] $jobrunintervalMin)
663-
gci -Path $folder -Recurse | where {(-not $_.PsIsContainer) -and ($_.name -notmatch "deleteme.etl") -and ($_.name -match ".etl") } | sort CreationTime -desc | select -skip $numofFilesToKeep | Remove-Item -Force @args
664-
} -ArgumentList $jobname, $folder, $numofFilesToKeep, $jobrunintervalMin
665-
$job.Options.RunElevated=$True
666-
$cleanupJob=New-JobTrigger -Once -At (get-date).AddSeconds(2) -RepetitionInterval (New-TimeSpan -Minutes $jobrunintervalMin) -RepeatIndefinitely ## -RepetitionDuration (New-TimeSpan -Minutes 20)
667-
Add-JobTrigger -Trigger $cleanupjob -Name $jobname
668-
}
669-
670-
Function StartDeleteOldFiles
671-
{
672-
param ($FilesToDelete)
673-
674-
"DeleteOldFiles job starting ..."
675-
"Files being monitored:"
676-
foreach ($Name in $FilesToDelete.Keys)
677-
{
678-
$PathToClean = $FilesToDelete[$Name]
679-
$FileSpec = $PathToClean[0]
680-
$MinMinutes = $PathToClean[1]
681-
$MinFiles = $PathToClean[2]
682-
"$Name=$fileSpec, Min Minutes=$MinMinutes, Min Files=$MinFiles"
683-
}
684-
685-
$jobname = "DeleteOldFiles"
686-
687-
$job=Register-ScheduledJob -Name "DeleteOldFiles" -scriptblock {
688-
Param ( $FilesToDelete )
689-
foreach ($Name in $FilesToDelete.Keys)
690-
{
691-
$PathToClean = $FilesToDelete[$Name]
692-
$FileSpec = $PathToClean[0]
693-
$MinMinutes = $PathToClean[1] -as [int]
694-
$MinFiles = $PathToClean[2] -as [int]
695-
get-item $FileSpec | sort-object -property LastWriteTime -descending | select -skip $MinFiles | where-object {$_.LastWriteTime -lt ((get-date).AddMinutes($MinMinutes * -1))} | remove-item -force
696-
}
697-
} -ArgumentList $FilesToDelete
698-
$job.Options.RunElevated=$True
699-
$cleanupJob=New-JobTrigger -Once -At (get-date).AddSeconds(2) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepeatIndefinitely # runs once every 5 minutes
700-
Add-JobTrigger -Trigger $cleanupjob -Name $jobname
701-
}
702-
703-
704-
Function StopCleanupETLTraceFiles
705-
{
706-
param
707-
(
708-
$jobname
709-
)
710-
711-
try
712-
{
713-
Stop-Job $jobname -ErrorAction SilentlyContinue
714-
Remove-Job $jobname -Force -ErrorAction SilentlyContinue
715-
Remove-JobTrigger $jobname -ErrorAction SilentlyContinue
716-
UnRegister-ScheduledJob -Name $jobname -Force -ErrorAction SilentlyContinue
717-
}
718-
catch { "Error stopping the Cleanup Job $jobname." }
719-
}
720-
721-
Function StopDeleteOldFiles
722-
{
723-
$jobname = "DeleteOldFiles"
724-
try
725-
{
726-
Stop-Job $jobname -ErrorAction SilentlyContinue
727-
Remove-Job $jobname -Force -ErrorAction SilentlyContinue
728-
Remove-JobTrigger $jobname -ErrorAction SilentlyContinue
729-
UnRegister-ScheduledJob -Name $jobname -Force -ErrorAction SilentlyContinue
730-
}
731-
catch { "Error stopping the DeleteOldFiles job." }
732-
}
733-
734-
735642
Function StartNetworkTraces
736643
{
737644

@@ -1096,9 +1003,6 @@ Function StopBIDTraces
10961003
{
10971004
if($global:INISettings.BidTrace -eq "Yes")
10981005
{
1099-
## StopCleanupBIDTraces # Clintonw
1100-
#StopCleanupETLTraceFiles -jobname "BIDTRACECLEANUP"
1101-
11021006
LogInfo "Stopping BID Traces ..."
11031007
# Do not clear the registry keys in case we run a second trace; use the -cleanup switch explicitly
11041008
logman stop SQLTraceBID -ets
@@ -1223,6 +1127,11 @@ Function StopAuthenticationTraces
12231127
# Not controlled by the Auth Flag
12241128
if($global:INISettings.EventViewer -eq "Yes")
12251129
{
1130+
1131+
if((Test-Path "$($global:LogFolderName)\Auth" -PathType Container) -eq $false)
1132+
{
1133+
md "$($global:LogFolderName)\Auth" > $null
1134+
}
12261135

12271136
LogInfo "Disabling/Collecting Event Viewer Logs..."
12281137

@@ -1348,6 +1257,56 @@ Function ClearBIDRegistry
13481257
}
13491258
}
13501259

1260+
# ============================= Background Job DeleteOldFiles ===================
1261+
1262+
Function StartDeleteOldFiles
1263+
{
1264+
param ($FilesToDelete)
1265+
1266+
LogInfo "DeleteOldFiles job starting ..."
1267+
LogInfo "Files being monitored:"
1268+
foreach ($Name in $FilesToDelete.Keys)
1269+
{
1270+
$PathToClean = $FilesToDelete[$Name]
1271+
$FileSpec = $PathToClean[0]
1272+
$MinMinutes = $PathToClean[1]
1273+
$MinFiles = $PathToClean[2]
1274+
LogInfo "$Name=$fileSpec, Min Minutes=$MinMinutes, Min Files=$MinFiles"
1275+
}
1276+
1277+
$jobname = "DeleteOldFiles"
1278+
1279+
$job=Register-ScheduledJob -Name "DeleteOldFiles" -scriptblock {
1280+
Param ( $FilesToDelete )
1281+
foreach ($Name in $FilesToDelete.Keys)
1282+
{
1283+
$PathToClean = $FilesToDelete[$Name]
1284+
$FileSpec = $PathToClean[0]
1285+
$MinMinutes = $PathToClean[1] -as [int]
1286+
$MinFiles = $PathToClean[2] -as [int]
1287+
get-item $FileSpec | sort-object -property LastWriteTime -descending | select -skip $MinFiles | where-object {$_.LastWriteTime -lt ((get-date).AddMinutes($MinMinutes * -1))} | remove-item -force
1288+
}
1289+
} -ArgumentList $FilesToDelete
1290+
$job.Options.RunElevated=$True
1291+
$cleanupJob=New-JobTrigger -Once -At (get-date).AddSeconds(2) -RepetitionInterval (New-TimeSpan -Minutes 5) -RepeatIndefinitely # runs once every 5 minutes
1292+
Add-JobTrigger -Trigger $cleanupjob -Name $jobname
1293+
}
1294+
1295+
Function StopDeleteOldFiles
1296+
{
1297+
LogInfo "DeleteOldFiles job stopping ..."
1298+
$jobname = "DeleteOldFiles"
1299+
try
1300+
{
1301+
Stop-Job $jobname -ErrorAction SilentlyContinue
1302+
Remove-Job $jobname -Force -ErrorAction SilentlyContinue
1303+
Remove-JobTrigger $jobname -ErrorAction SilentlyContinue
1304+
UnRegister-ScheduledJob -Name $jobname -Force -ErrorAction SilentlyContinue
1305+
LogInfo "Stopped the DeleteOldFiles job."
1306+
}
1307+
catch { LogInfo "Error stopping the DeleteOldFiles job." }
1308+
}
1309+
13511310
# ======================================= Logging ===============================
13521311

13531312
Function LogMessage($Message, $LogLevel = "info")

‎SQL_Network_Analyzer/SQLNA/TDSParser.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ public static void ProcessTDS(NetworkTrace trace)
277277
{
278278
// do nothing - ignore the TDS header that's in the else clause
279279
}
280-
else // (firstByte != (int)TDSPacketType.APPDATA)
280+
else // (firstByte != a TLS packet type)
281281
{
282282
// get header values - except for Application Data, and TDS8 packet types
283283
status = fd.payload[1];
@@ -302,7 +302,7 @@ public static void ProcessTDS(NetworkTrace trace)
302302
case (byte)TDSPacketType.TDS8TLS:
303303
{
304304
TLS tls = TLS.Parse(fd.payload, 0);
305-
if (tls.handshake.hasClientHello)
305+
if (tls.handshake != null && tls.handshake.hasClientHello)
306306
{
307307
// generic ClientHello stats, even for HTTPs, etc.
308308
ushort sslLevel = tls.handshake.clientHello.sslLevel;
@@ -319,7 +319,7 @@ public static void ProcessTDS(NetworkTrace trace)
319319
if (fd.isFromClient) { tdsClientSource++; } else { tdsClientDest++; };
320320
}
321321
}
322-
else if (tls.handshake.hasServerHello)
322+
else if (tls.handshake != null && tls.handshake.hasServerHello)
323323
{
324324
// generic ServerHello stats, even for HTTPS, etc.
325325
ushort sslLevel = tls.handshake.serverHello.sslLevel;
@@ -344,7 +344,7 @@ public static void ProcessTDS(NetworkTrace trace)
344344
if (fd.isFromClient) { tdsServerSource++; } else { tdsServerDest++; };
345345
}
346346
}
347-
else if (tls.handshake.hasClientKeyExchange)
347+
else if (tls.handshake != null && tls.handshake.hasClientKeyExchange)
348348
{
349349
fd.frameType = FrameType.KeyExchange;
350350
if (c.hasTDS8)

0 commit comments

Comments
 (0)