Tracing is a detailed logging of the actions taken by Microsoft Forefront Protection 2010 for SharePoint (FPSP). Enabled by default, tracing helps support engineers diagnose and troubleshoot problems. Although you can control tracing by using the Tracelog.exe tool, some of the most common tracing settings can be configured directly by using the Forefront Management Shell to enter Windows PowerShell commands.
Monitoring without the aid of customer support
Tracing is for advanced troubleshooting scenarios. You should only use tracing under the direction of customer support. In order to investigate errors or to monitor your system on your own, it is recommended that you use the Windows Event Viewer.
To access the Windows Event Viewer-
Click Start, point to All Programs, point to Control Panel, point to Administrative Tools, and then click Event Viewer.
The tools needed for tracing are tracelog.exe and tracefmt.exe. These are part of the Windows Driver Kit, and you can download them from Microsoft's WDK and Developer Tools site.
Configuring tracing
You can configure the following trace settings by using the Windows PowerShell Set-FsspTracing cmdlet:
- The level of tracing, in order to indicate
how much detail is included in the trace
- The tracing flags, in order to indicate the
functions being traced
- The maximum size of the trace log
- The frequency with which buffered tracing
events are flushed (written) to the trace log
This is the syntax of the Set-FsspTracing cmdlet:
Set-FsspTracing
[-Level
level ] [-Flags
flags
] [-MaxLogSize
MaxLogSize ]
[FlushFrequency
frequency ]
The following sections describe the parameters.
Configuring tracing levels
In order to indicate how much detail to include in the trace, use the Program log detail level option. For more information about the Program log detail level option, see Configuring the program log detail level.
Configuring tracing flags
To indicate what functions are being traced, use the -Flags parameter of Set-FsspTracing. This permits a finer level of control. You may specify multiple flags as a comma-separated array. The following table describes the available flags:
Flag | Enabled by default | Function |
---|---|---|
Default |
- |
Restores all default values |
All |
- |
Enables all tracing flags |
EngineAdapters |
Yes |
Scan-engine interface adapters |
EngineUpdates |
Yes |
Traces engine updating pipeline |
FileNavigators |
Yes |
File parsers |
Generic |
Yes |
Output with no flag specified |
HResult |
Yes |
Return codes from function calls |
ScanJobs |
Yes |
Scanning processes |
ThreatScanning |
Yes |
Coordinates engines when data is being scanned and cleaned |
Common |
No |
Core product functionality |
Configuration |
No |
Configuration changes |
IPC |
No |
Inter-process communication between workload hook and scanning processes |
Stack |
No |
Program stack call |
Statistics |
No |
Performance counter-related functionality |
-
Click Start, point to All Programs, point to Microsoft Forefront Server Protection, and then click Forefront Management Shell.
-
At the Windows PowerShell command prompt, enter the following:
Copy Code Set-FsspTracing -flag flags
This example sets the Stack flag:
Set-FsspTracing -flag
Stack
This example sets the engine adapters, threat scanning, and generic flags:
Set-FsspTracing -flag
EngineAdapters,ThreatScanning,Generic
Configuring maximum tracing log size
In order to indicate the maximum size of the trace log, use the -MaxLogSize parameter of Set-FsspTracing.
The maximum trace log size is specified in megabytes (MB). The minimum size is 16 MB, and the maximum size is 1024 MB (1 gigabyte), which is the default value. The maximum trace log size value includes the combined value of the program log (ProgramLog.etl) plus any archived program logs (located in the ProgramLogArchive directory). The maximum size for any single program log is 512 MB, or half the configured total.
To configure the maximum trace log size-
Click Start, point to All Programs, point to Microsoft Forefront Server Protection, and then click Forefront Management Shell.
-
At the Windows PowerShell command prompt, enter the following command:
Copy Code Set-FsspTracing -MaxLogSize MaxLogSize
This example sets a trace log size limit of 768 MB for all program logs:
Set-FsspTracing -MaxLogSize
768
In this example, the maximum file size for any single program log is 384 MB.
After changing the maximum tracing log size setting, restart the tracing session in order for the change to take effect.
To restart the tracing session-
At the Windows PowerShell command prompt, stop the tracing session by entering the following command:
Copy Code Logman stop FssTracingSession –ets
-
Stop the Forefront Server Protection Controller service by entering the following command:
Copy Code Net stop FSCController
-
Start the Forefront Server Protection Controller service (which automatically starts the tracing session) by entering the following command:
Copy Code Net start FSCController
Configuring the flush frequency
To indicate the frequency (in seconds) of writing (flushing) buffered tracing events to the trace log, use the -FlushFrequency parameter of Set-FsspTracing. The buffer is always flushed when filled or when the trace is ended, regardless of the value of flush frequency.
The frequency can be any positive integer. The default of 0 means that buffers are flushed as soon as they become full.
To configure the flush frequency-
Click Start, point to All Programs, point to Microsoft Forefront Server Protection, and then click Forefront Management Shell.
-
At the PowerShell command prompt, enter the following:
Copy Code Set-FsspTracing -FlushFrequency frequency
This example sets a flush frequency of 10 seconds:
Set-FsspTracing
-FlushFrequency 10