Export (0) Print
Expand All
10 out of 14 rated this helpful - Rate this topic

Microsoft Message Analyzer Operating Guide

 

Message Analyzer Icon

Introduction
Microsoft Message Analyzer is a new tool for capturing, displaying, and analyzing protocol messaging traffic and other system messages. Message Analyzer also enables you to import, aggregate, and analyze data from log and trace files. It is the successor to Microsoft Network Monitor 3.4 and a key component in the Protocol Engineering Framework (PEF) that was created by Microsoft for the improvement of protocol design, development, documentation, testing, and support. With Message Analyzer, you can choose to capture data live or load archived message collections from multiple data sources simultaneously.


Message Analyzer enables you to display trace, log, and other message data in numerous data viewer formats, including a default tree grid view, interactive tool windows, and other selectable graphical views that employ grids, charts, and timeline visualizer components that provide high-level data summaries and other statistics. Message Analyzer also enables you to configure your own custom data viewer charts. In addition to being an effective tool for troubleshooting network issues, Message Analyzer enables you to test and verify protocol implementations.


Release Features Summary — get a quick overview of Message Analyzer release features and navigate links to more information.


Information Roadmap

The topics outlined in this section provide a map into the documentation contained in the Message Analyzer Operating Guide. Use this map to quickly navigate to the topics that show you how to get started with Message Analyzer, how to use its basic and more advanced features, and to understand the underlying frameworks on which it is built. At a high level, the map breaks out into the three content spaces that are specified in the following table, within which you will find quick links that point to topics of interest in these spaces:

 

Content Space Description Quick Links

Usage tasks

Review features and functions that you can use to perform various Message Analyzer operations.

Message Analyzer Usage Tasks

Usage procedures

Run procedures to see Message Analyzer in action and quickly familiarize yourself with its capabilities.

Message Analyzer Usage Procedures

Technology concepts

Review conceptual information to understand Message Analyzer features and the underlying technologies upon which they are built.

Message Analyzer Technology Concepts


Message Analyzer Usage Tasks

In this Operating Guide, Message Analyzer guidance is presented in the form of usage tasks. Each task provides some conceptual background with respect to the functions and features you will be working with, discusses how to use the associated UI features, and also includes example procedures to help you walk through various Message Analyzer usage contexts. To proceed directly to the usage tasks presented in this Operating Guide, click a task link below such as Capturing Message Data:

 

Getting Started

See the following topics to learn how to get started with Message Analyzer:

  • Release Features Summary — review the main features of the Message Analyzer release and use the topic links to access more detailed feature descriptions

  • Quick Start Procedures — run several simple procedures to quickly see Message Analyzer in action.

  • Technology Overview — explore the main navigation features and high-level functions of the Message Analyzer user interface.

  • Technology Tutorials — read a brief tutorial on Message Analyzer functions before you dive into the usage tasks and procedures. Also, see the Protocol Engineering Framework (PEF) architecture and Event Tracing for Windows (ETW) framework tutorials to understand the technologies upon which Message Analyzer is built.

  • Startup Options — review the methods you can use to start Message Analyzer, which includes the arguments and command switches that are available to launch Message Analyzer from the command line.

Importing Message Data

View the following topics to learn about how to load input data from saved files, and how to filter input data and present it in a chosen viewer when importing messages through a Message Analyzer Browse Session:

  • Browse-Select-View Model — learn about the Message Analyzer BSV infrastructure that enables you to browse for multiple data sources, filter or select specific data from those sources, and present results in a viewer of choice for data manipulation and analysis.

  • Browsing Data Sources — browse for and load saved trace data and logs into Message Analyzer.

  • Selecting Data — use filtering and other mechanisms to select specific data that you want to load into Message Analyzer.

  • Choosing a Data Viewer — learn how to select a data viewer that displays message data that you load from one or more data sources in a Browse Session.

Viewing Message Data

Review the following topics to learn about the different data viewers that Message Analyzer provides, along with some of the capabilities that enable you to manipulate data views:

  • Data Viewers — read about saving Message Analyzer settings and how to use the Analysis Grid viewer and the data manipulation components that are unique to it, such as Color Rules, View Layouts, data Grouping, Find filters, and so on. Also discover how to use Chart viewers that provide top-level protocol summary information, and learn about the Sequence Matching viewer which detects message patterns in a trace.

  • Specifying Data Viewers — find out how to open various data viewers from multiple locations.

  • Common Data Viewer Features — learn about Message Analyzer data manipulation tools that are common to the Analysis Grid and other viewers, including View Filters, Viewpoints, Quick Filters, and Time Shifts.

  • Tool Windows — understand how to use message-specific and session-specific tool windows that provide additional message details or configuration capabilities in Message Analyzer. Also learn about message annotations (Comments and Bookmarks), Diagnostics, Message Stack, and other tool windows in this section.

Capturing Message Data

See the following topics to learn about default trace scenario configurations, message provider technologies, creating and configuring Trace Sessions, creating custom Trace Scenarios, and provider manifests:

  • Default Trace Scenarios — review the functions and usage configurations of the built-in Message Analyzer Trace Scenarios in the network, device, system, and file sharing categories.

  • PEF Providers — review conceptual background on the PEF providers that install with Message Analyzer, including information about Fast Filters and provider manifests.

  • Creating and Modifying Trace Sessions — select and configure predefined Trace Scenarios, configure Fast Filters and Trace Filters, configure system ETW providers, use advanced session configuration, select data viewers, and more.

  • Developing and Managing Trace Scenarios — design a custom capture configuration template, save it as a Trace Scenario, and run it on demand.

  • Obtaining Provider Manifests — understand provider manifests and how to generate them.

Filtering Message Data

View the following topics to learn about selecting data from an import, applying filters to a live trace to isolate specific data, applying filters to trace results for analysis, using color rules to create conditional alerts in trace results, and understanding the Filtering Language:

  • Filtering Imported Data — apply a Selection Filter to isolate specific data in an import configuration.

  • Filtering Live Trace Data — apply a Fast Filter, Keyword filter, WFP Layer Set filter, or HTTP filter at the driver level to a live trace, or apply a predefined or custom Filter Expression as a Trace Filter in a live Trace Session.

  • Filtering Trace Results — select a filter expression from a common Library of predefined filters and apply it as a View Filter to trace results.

  • Writing Filter Expressions — understand the Filtering Language so you can create your own filter expressions.

Saving Message Data

Review the following topics to learn how to save session data and other configuration files.

  • Saving Session Data — read a quick overview of how to save your message data from a Browse Session or Trace Session.

  • Selecting Messages to Save — review the options that are available for saving message data.

  • Naming Saved Files — review some naming strategies and other considerations for saving message data.

Managing Assets and Resources

Review the following topics to learn about the Message Analyzer Sharing Infrastructure, user Libraries, automatic updates, downloads, and additional features that enable you to customize and extend the viewing capabilities of Message Analyzer:

  • Sharing Infrastructure — learn about the Message Analyzer Sharing Infrastructure; the user Library item collections that enable you to manipulate how data is captured, viewed, and analyzed; and how to manage these user Libraries.

  • Managing Item Collection Downloads and Updates — find out how to download user Library item collections and how to utilize the auto-sync feature to automatically receive user Library updates that are pushed out by a Microsoft web service.

  • Managing Microsoft OPN Parser Packages — learn how to auto-sync updates to OPN Parser packages and download them from the Microsoft web service.

  • Creating Custom User Feeds — create your own user feeds to which others may subscribe, for mutually sharing Message Analyzer assets with other team members, for example, Filters, Trace Scenarios, Chart viewers, and so on.

  • Sharing Item Collections on a User File Share — learn how to share user Library item collections directly with other users by exporting/importing collections or items to/from a file share.

  • Configuring Chart Data Viewers — discover how to edit Chart data viewers, such as the Protocol Dashboard, or create new ones with the use of various graphic visualizer components and data formulas, to extend Message Analyzer data viewing capabilities.

Automating Tracing Functions

Get a quick overview of the Message Analyzer functions that are enabled for the PowerShell scripting environment, as described in the following:

  • PowerShell Cmdlets for Message Analyzer — read a synopsis for action, trigger, and other cmdlets that are available to automate various Message Analyzer functions.

  • PowerShell Script Example — review an example PowerShell script that configures a message provider, adds a Trace Filter, and sets various triggers for starting, filtering, stopping, and saving a trace session.

  • Access PowerShell Cmdlets and Help — find out how to get PowerShell v3, access and update cmdlet help, and view the cmdlet help for Message Analyzer.


Message Analyzer Usage Procedures

If you want to proceed directly to usage procedures that demonstrate Message Analyzer features in the context of the usage tasks contained in this Operating Guide, click a link below:

 

Quick Start Procedures — display saved data with the Quick Open feature; start a live trace, including using the Quick Trace feature on the Start Page; import saved data through a Browse Session; and deploy Chart viewers to display your data.

Using the BSV Features — browse for data and create a message collection to load into Message Analyzer; apply a Selection Filter to a data import to isolate specific data; display trace results in different data viewers; use the Recent Files feature to display trace data; import data from multiple sources and save it as a single message collection; and create and save a custom Trace Scenario.

Using the Data Viewing Features — learn how to apply gradient style Color Rules or a predefined View Layout; execute Group commands to group data and streamline message analysis; use the graphic visualizer components of the Protocol Dashboard to analyze top-level summary data such as top bandwidth consumption and message activity within a specified time window; analyze data with the interactive features of the Protocol Dashboard and Analysis Grid viewers; apply Quick Filters and Viewpoints; and drive the display of various message details through Analysis Grid viewer and tool window interactions.

Using the Network Tracing Features — run a Local Link Layer trace that isolates data to a particular network adapter and IPv4 address; perform a Firewall trace with a high-performance, driver-level Fast Filter that is set to capture HTTP traffic from TCP port 80; run a Web Proxy trace with driver-level hostname and port filters to isolate client and server HTTP message exchanges; capture traffic on a virtual machine (VM) that is serviced by a Hyper-V-Switch on a remote Windows 8.1 or Windows Server 2012 R2 host; and design a custom Trace Scenario and run it on demand.

Using the Filtering Features — create and apply filters to imported, live, and trace results data to address and solve commonly encountered, real-world issues; and create color rules to serve as an alert when certain message types, states, or values are present in a displayed message set, for example, TCP diagnostic information and SMB error status.

Using the Management and Configuration Features — perform procedures that demonstrate how to manage user Library items and share them with others, how to download and update Library item collections from the default Message Analyzer subscriber feed, and how to configure your own Chart data viewers.


Message Analyzer Technology Concepts

If you want to expand your knowledge of the technologies upon which Message Analyzer is built, click the link below:

 

Technology Tutorials — get an overview of Message Analyzer functions and technology concepts, and learn about the PEF architecture and ETW framework components that support them.


Message Analyzer Installation

If you have not already installed Microsoft Message Analyzer, go to the Microsoft Message Analyzer page on the Microsoft Download Center. The Microsoft Message Analyzer release is available for installation in 32-bit and 64-bit versions. Installation requirements are listed in the following table for convenience:

Message Analyzer Installation Requirements

Component Requirement

Supported Operating Systems

32-bit and 64-bit: Windows 7, Windows 8, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.

Redistributable Packages

Minimum —.NET Framework 4; Recommended —.NET Framework 4.5

Display Resolution

1024 x 768 or higher

Hard disk space

Installation — Minimum: 350MB

Capturing and loading traces — Recommended: 50GB

RAM

64-bit — Minimum: 2GB; Recommended: 8GB

32-bit — Minimum: 2GB; Recommended: 4GB

CPU

Minimum — 1.4 GHz, Recommended — 2 x 2.80 GHz (64-bit)


Important  If you intend to perform long captures or load large traces, it is recommended that you use a 64-bit computer.

Warning  If you are reinstalling Message Analyzer, see the Reinstalling Message Analyzer topic to learn how to avoid the loss of user data.

Advisory  If you are installing Message Analyzer on a Windows 7 computer, you might experience a reset of the TCP stack and a subsequent loss of TCP connections.

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.