convert input= Tracefilename.etl [[output=]FileName] [[dump=]{csv|xml|evtx|txt|no}] [[report=]{yes|no}] [[overwrite=]{yes|no}] [[tmfpath=]PathAndFileName]

input

Required. Specifies the input ETL trace file.

output

Optional. Specifies the name of the converted file. If unspecified, the output file name defaults to the input name.

dump

Optional. Specifies the file format of the converted trace file: .CSV .XML .EVTX .TXT No. If unspecified, the converted file output defaults to .txt.

Report

Optional. Specifies whether to generate an HTML report. If unspecified, the parameter defaults to “no.”

overwrite

Optional. Specifies whether this instance of the trace conversion command overwrites files that were rendered from previous trace conversions. If unspecified, the parameter defaults to “no.”

tmfpath

Optional. Specifies the path (folder location) of the tmf files that are used for decoding WPP traces.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

• convert input=ExampleTestTrace.etl output=TestTrace dump=XML report=yes
  
  

correlate input= tracefilename.etl output=newtracefilename.etl [[filter=]Activity_ID] [[overwrite=]{yes|no}] [[retaincorrelationevents=]{yes|no}] [[retainpii=]{yes|no}] [[retainglobalevents=]{yes|no}]

input

Required. Specifies the input trace file name.

output

Required. Specifies the file name of the output file.

filter

Optional. Specifies that trace output is rendered only for events that are related to the specific Activity GUID. If unspecified, the default entry for filter is null; the filter parameter is ignored.

overwrite

Optional. Overwrites existing files. If unspecified, the default entry for overwrite is no.

retaincorrelationevents

Optional. Retains correlation events. If unspecified, the default entry for retaincorrevents is no.

retainpii

Optional. Specifies that events containing personally identifiable information (pii) are kept. If unspecified, the default entry for retainpii is yes.

retainglobalevents

Optional. Specifies that global events are kept. If unspecified, the default entry for retainglobalevents is yes.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

Filter activity ID is a GUID expressed in the form {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}.

Personally identifiable information includes packet capture events.

• correlate input=exampleTraceFileName.etl output=NewTraceFileName.etl overwrite=yes retaincorrelationevents=no retainpii=yes retainglobalevents=yes
  
  

Diagnose scenario= ScenarioName namedAttribute=attributeValue [[saveSessionTrace=]{yes|no}] [[report=]yes|no] [[capture=]yes|no]

scenario

Required. Specifies the name of the scenario.

namedAttribute

Required. Specifies the attribute value.

Tip
namedAttributes change depending on the scenario, and can be discovered by running the Netsh Trace show scenario command.

saveSessionTrace

Optional. If parameter saveSessionTrace is unspecified and parameter report is set to yes, then the default entry for saveSessionTrace is yes. If parameter saveSessionTrace is unspecified and parameter report is set to no or is unspecified, then the default entry for saveSessionTrace is no.

report

Optional. If unspecified, the default entry for report is no.

capture

Optional. If unspecified, the default entry for capture is no.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

Diagnose command behavior for parameters capture and report:

The following table summarizes the results that are rendered by the use of the various combinations of the capture and report parameters:

1. If parameters capture and report are not specified the diagnostic results will display, but neither the ETL nor CAB files are saved.
   
   
2. If parameter capture=yes and parameter report=no the diagnostic results will display, and only ETL file is saved. The ETL file is saved with both traces and packets.
   
   
3. If parameter capture=yes and parameter report=yes, then the diagnostic results will display, and both the ETL and CAB files are saved. The ETL file is saved with both traces and packets.
   
   
4. If parameter capture=no and parameter report=yes, then the diagnostic results will display, and both ETL and CAB files are saved. Only events are saved in the ETL file; no packets are saved.
   
   
5. If parameter capture=no and parameter report=no, the diagnostic results will display, ETL file is saved with trace events only. The CAB file is not saved.
   
   

Tip
In all cases, if the ETL file is saved and capture=yes, ETL file will contain both packet captures and trace events

• Diagnose scenario=internetclient namedAttribute=http://www.Microsoft.com saveSessionTrace=yes report=no
  
  

show CaptureFilterHelp

There are no parameters associated with this command

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

• show CaptureFilterHelp
  
  

show globalKeywordsAndLevels

There are no parameters associated with this command.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

Following is an example of the global levels and keywords that are displayed by running the command show globalKeywordsAndLevels.

Copy Code

netsh trace>show globalkeywordsandlevels Levels (value) - 5 element(s) ------------------------------------------------------------------- win:Critical (1) win:Error (2) win:Warning (3) win:Informational (4) win:Verbose (5) Keywords (mask) - 15 element(s) ------------------------------------------------------------------- ut:SendPath (0x100000000) ut:ReceivePath (0x200000000) ut:L3ConnectPath (0x400000000) ut:L2ConnectPath (0x800000000) ut:ClosePath (0x1000000000) ut:Authentication (0x2000000000) ut:Configuration (0x4000000000) ut:Global (0x8000000000) ut:Dropped (0x10000000000) ut:PiiPresent (0x20000000000) ut:Packet (0x40000000000) ut:Address (0x80000000000) ut:StdTemplateHint (0x100000000000) ut:StateTransition (0x200000000000) ut:Diagnostic (0x400000000000) netsh trace>

You can specify the global levels and keywords in the start command as shown in the following example of the start command: start InternetClient provider=Microsoft-Windows-TCPIP level=5 keywords=ut:ReceivePath,ut:SendPath. This is explained in greater detail in the section: Example Netsh trace filter parameters and usage

• show globalKeywordsAndLevels
  
  

show helperclass name= helperClassName

name

Required. Specifies the name of the helperclass for which to display information.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

Helper class names are case sensitive. For example, you cannot substitute wininethelperclass, if WinInetHelperClass is the correct, case-sensitive name.

• Show helperclass name=WinInetHelperClass
  
  

show interfaces

There are no parameters associated with this command.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

• show interfaces
  
  

show provider name= providerIdOrName

name

Required. Specifies the provider name or provider identification (Id) GUID.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

This displays the keywords and levels that the specified provider supports, which can be used when starting a tracing session.

• show provider name=Microsoft-Windows-TCPIP
  
  
• show provider name=B92CF7FD-DC10-4C6B-A72D-1613BF25E597
  
  

show providers

There are no parameters associated with this command.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

• Show providers
  
  

show scenario name= scenarioName

name

Required. Specifies the name of the scenario for which to display information.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

This command displays information about a scenario, including:

• Attributes that might be required by the diagnose command.
  
  
• The list of providers that would be enabled for the specified scenario.
  
  
• The default keywords and levels that would be applied for the specified scenario.
  
  

• show scenario name=DirectAccess
  
  

show scenarios

There are no parameters associated with this command.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

• show scenarios
  
  

show status

There are no parameters associated with this command.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

• show status
  
  

start [[scenario=]Scenario1,Scenario2] [[globalKeywords=]keywords] [[globalLevel=]level] [[capture=]{yes|no}] [[report=]{yes|no}] [[persistent=]{yes|no}] [[traceFile=]Path\Filename] [[maxSize=]MaxFileSizeInMB] [[fileMode=]{single|circular|append}] [[overwrite=]{yes|no}] [[correlation=]{yes|no|disabled}] [[provider=]ProviderIdOrName] [[keywords=]KeywordMaskOrSet] [[level=]level] [[provider=]Provider2IdOrName] [[keywords=]Keyword2MaskOrSet] [[level=]level2]

scenario

Optional. Specifies the scenarios that are applied to the trace session.

globalKeywords

Optional. Specifies the global keywords that are applied to the trace session.

globalLevel

Optional. Species at what level the traces should be collected across all the providers. For example, the command netsh trace start scenario=internetclient globallevel=win:error will capture only error events; the command netsh trace show globalkeywordsandlevel displays list of options.

capture

Optional. Specifies whether packet capture is enabled in addition to trace events. If unspecified, the default entry for capture is no.

report

Optional. Specifies whether a complementing report will be generated in addition to the trace file report. If unspecified, the default entry for report is no.

persistent

Optional. Specifies whether the tracing session resumes upon restarting the computer, and continues to function until the “Netsh trace stop” command is issued. If unspecified, the default entry for persistent is no.

traceFile

Optional. Specifies the location to save the output file. If unspecified, the output file is saved using the default path and filename: “traceFile=%LOCALAPPDATA%\Temp\NetTraces\NetTrace.etl”

maxSize

Optional. Specifies the maximum size in MB for saved trace files. MB 0=no maximum. If the maxSize parameter is unspecified, the default value of 250 MB is used.

fileMode

Optional. Specifies which file mode is applied when tracing output is generated: single|circular|append. If unspecified, the default entry “fileMode=circular” is used.

overwrite

Optional. Specifies whether an existing trace output file – in either the specified or default location - will be overwritten. If parameter traceFile is not specified, then the default location and filename is applied, and any pre-existing version of the trace file is automatically overwritten. See parameter traceFile for default path and filename details.

correlation

Optional. Specifies whether related events will be correlated and grouped together. If unspecified, the default entry “correlation=yes” is applied.

provider

Optional. Specifies additional providers to enable for tracing.

keywords

Optional. Specifies the keywords to enable for the corresponding provider.

level

Optional. Specifies the level to enable for the corresponding provider.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

Capture filters are only supported when capture is explicitly enabled with capture=yes. You can use the show CaptureFilterHelp command to display the list of supported capture filters and their usage.

Follow is a list and brief explanation of the ETW levels that you can specify by using the level parameter.

1. Critical. Captures only critical events.
   
   
2. Errors. Captures only critical events and error events.
   
   
3. Warnings. Captures only critical events, error events, and warning events.
   
   
4. Informational. Captures only critical events, error events, warning events, and informational events.
   
   
5. Verbose Captures all events.
   
   

You can view a complete list of keywords for a specific provider by typing show provider, followed by the provider name. For example, you can type show provider Microsoft-Windows-TCPIP to display information about the Microsoft-Windows-TCPIP provider, including the list of supported keywords.

• start scenario=InternetClient capture=yes
  
  
  • Starts tracing for the InternetClient scenario and dependent providers with packet capture enabled.
    
    
  • Tracing will stop when the "Netsh trace stop" command is issued or when the system reboots.
    
    
  • Default location and name will be used for the output file. If an old file exists, it will be overwritten.
    
    
• start provider=Microsoft-windows-wlan-autoconfig keywords=state,ut:authentication
  
  
  • Starts tracing for the Microsoft-windows-wlan-autoconfig provider.
    
    
  • Tracing will stop when the "Netsh trace stop" command is issued or when the system reboots.
    
    
  • Default location and name will be used for the output file.
    
    
  • If an old file exists, it will be overwritten.
    
    
  • Trace will only log events with the keywords 'state' or 'ut:authentication.'
    
    
  You can use the Netsh trace show provider command to display the supported keywords and levels.
  
  

The Netsh trace context also supports packet filtering capability that is similar to Network Monitor. You can turn on packet capturing by specifying capture=yes in the Netsh trace start command. You can use packet filtering to capture specific packets in a trace file. For example, you can type start capture=yes ipv4.address=x.x.x.x, (where x.x.x.x is the IP address), to only capture only those packets containing ipv4 traffic using that specific source or destination address.

To obtain additional information about how to use packet filtering, you can type show capturefilterHelp.

stop

There are no parameters associated with this command.

This Netsh command is new in Windows Server 2008 R2 and cannot be run on computers running Windows Server 2008.

• stop