Microsoft Message Analyzer Operating Guide
Updated: September 14, 2016
Message Analyzer enables you to display trace, log, and other message data in numerous data viewer formats, including a default tree-grid view, interactive Tool Windows, and other selectable graphical view Layouts that employ grids, bar element, timeline, and other visualizer components that provide high-level data summaries and other prominent statistics. You also have the option to configure your own custom Layouts for the Chart viewer. In addition, Message Analyzer now provides a Profiles feature, which creates interactive and integrated analysis environments that automatically display preset viewer and Layout configurations when data from specific input file types is loaded.
The topics outlined in this section provide a map into the documentation contained in the Message Analyzer Operating Guide. Use this map to quickly navigate to the topics that show you how to get started with Message Analyzer, how to use its basic and more advanced features, and to understand the underlying frameworks on which it is built. At a high level, the map breaks out into the three content spaces that are specified in the following table, within which you will find quick links that point to topics of interest in these spaces:
Review features and functions that you can use to perform various Message Analyzer operations.
Run procedures to see Message Analyzer in action and quickly familiarize yourself with its capabilities.
Review conceptual information to understand Message Analyzer features and the underlying technologies upon which they are built.
In this Operating Guide, Message Analyzer guidance is presented in the form of usage tasks. Each task provides some conceptual background with respect to the functions and features you will be working with, discusses how to use the associated UI features, and also includes example procedures to help you walk through various Message Analyzer usage contexts. To proceed directly to the usage tasks presented in this Operating Guide, click a task link below such as Capturing Message Data:
See the following topics to learn how to get started with Message Analyzer:
Review the following topics to learn how to configure, start, and edit a Message Analyzer session, or configure a session scenario that targets multiple data sources, including local and multiple concurrent remote sessions. Discover how to start a session with a single click, how to use predefined Trace Scenario configurations and other message providers, how to create and save custom Live Trace Session configurations to run on-demand, how to use decryption, and how to enhance capture configurations with filtering, ETW system providers, and promiscuous mode:
Review the following topics to learn how to load input data from saved files, filter input data, and present it in a chosen viewer when loading messages through a Message Analyzer Data Retrieval Session:
Review the following topics to learn about the different data viewers that Message Analyzer provides, along with the capabilities that enable you to manipulate data views:
View the following topics to learn about selecting data in a Data Retrieval Session, applying filters to a Live Trace Session to isolate specific data, applying filters to trace results for analysis, using Color Rules to create conditional alerts or flags in a set of trace results, and understanding the Filtering Language:
Review the following topics to learn how to save session data, which includes selecting messages to save, specifying the save file format, and using session naming conventions.
Get a quick overview of the Message Analyzer functions that are enabled for the PowerShell scripting environment, as described in the following topics:
Review the following topics to learn about the Message Analyzer Sharing Infrastructure, user Libraries, automatic asset updates, downloading asset collections, and creating user feeds for sharing assets with others:
Review the following topics to discover how to create custom Layouts for the Chart viewer that you can design to your own specifications with the use of various graphic visualizer components and data formulas. Enables you to extend Message Analyzer data viewing capabilities. Also learn how you can edit and customize any built-in Layout for the Chart viewer:
If you want to proceed directly to usage procedures that demonstrate Message Analyzer features in the context of the usage tasks contained in this Operating Guide, click a link below:
Procedures: Quick Start — display saved data with the Open feature; start a Live Trace Session; display data quickly from your favorite Trace Scenarios by using the Favorite Scenarios feature on the Message Analyzer File menu or Start Page; load saved data through a Data Retrieval Session; and deploy various viewers, which includes Layouts for the Chart viewer, to display your data.
Procedures: Using the Network Tracing Features — run a Local Network Interfaces trace that isolates data to a particular network adapter and IPv4 address; perform a Loopback and Unencrypted IPSEC trace with a high-performance, driver-level Fast Filter that is set to capture HTTP traffic from TCP port 80; run a Pre-Encryption for HTTPS trace with driver-level Hostname and Port filters to isolate client and server HTTP message exchanges; capture traffic with a Remote Network Interfaces trace on a virtual machine (VM) that is serviced by a Hyper-V-Switch on a remote Windows 8.1, Windows 10, or Windows Server 2012 R2 host; and design a custom Trace Scenario and run it on demand.
Procedures: Using the Data Retrieval Features — browse for data and create a message collection to load into Message Analyzer; apply a Session Filter to loaded input data to isolate specific messages that you want to work with; display saved trace data in different viewers; use the Recent Files feature to display saved trace data to resume previous work; load data from multiple sources and save it as a single message collection; and apply a Time Filter to data being loaded into Message Analyzer.
Procedures: Using the Data Viewing Features — learn how to apply gradient-style Color Rules or a built-in view Layout; execute Group commands to group data and streamline message analysis; use the graphic visualizer components of the Protocol Dashboard to analyze top-level summary data such as top bandwidth consumption and message activity within a specified time window; analyze data with the interactive features of the Protocol Dashboard and Analysis Grid viewers; apply Quick Filters and Viewpoints; configure friendly Aliases for field values; create Unions of two or more message fields; and drive the display of various message details through Analysis Grid viewer and Tool Window interactions.
Procedures: Using the Data Filtering Features — create and apply filters to the data loading process, live captures, and trace results data to address and solve commonly encountered, real-world issues; create Color Rules to serve as an alert when certain message types, states, or values are present in a displayed message set, for example, TCP diagnostic information and SMB error status.
Procedures: Using the Asset Management Features — perform procedures that demonstrate how to manage user Library items and share them with others, or download and update Library item collections from the default Message Analyzer subscriber feed.
Configuration Walkthrough of a Built-In Chart Viewer Layout — perform a walkthrough of the built-in TCP/UDP Conversations by Message Count view Layout for Charts to familiarize yourself with the configuration features that you can use to create a functioning Layout of your own.
If you want to expand your knowledge of the technologies upon which Message Analyzer is built, click the links below:
Technology Tutorials — get an overview of Message Analyzer functions and technology concepts, and learn about the PEF architecture and ETW framework components that support them: