This blog entry explains how to collect WinRM ETW and WPP traces:
WinRM ETW Traces:
You can use EventViewer to look at WinRM ETW events:
· They are under Application and Services Logs à Microsoft àWindowsàWindows Remote Management
Operational channel is enabled by default. Analytic needs to be enabled
Use the following to show and enable Analytic log:
· Menu à View àShow Analytic and Debug Logs
· Rightclick on Analytic log and Enable Log
Alternatively one can enable Analytic logs using:
· Wevtutil.exe sl Microsoft-Windows-Winrm/Analytic /e:true /q
Here’s a way to collect ETW log dump using logman.exe
· Start the provider: logman.exe start winrmtrace -p Microsoft-Windows-Winrm -o winrmtrace.etl -ets
· Run the repro.
· Stop the provider: logman.exe stop winrmtrace -ets
Here’s a way to convert the etl log to various formats
· XML: tracerpt.exe winrmtrace.etl -of XML -o winrmtrace.xml
· CSV: tracerpt.exe winrmtrace.etl -of CSV -o winrmtrace.csv
· TXT: netsh trace convert winrmtrace.etl dump=TXT
Note that these are just operational and analytic logs. If there is a low level design/implementation problem that couldn’t be figured out using these logs, WPP traces may be required. Following are steps on how to generate WinRM WPP traces.
WinRM WPP Traces:
Launch a PowerShell console with the elevated admin credentials and run the following commands:
· Import-Module psdiagnostics
· Enable-WSManTrace
· Now reproduce the problem by sending the subscription packets from the client. Continue with the next step after the problem stops.
· Disable-wsmantrace
· Send us the file %windir%\system32\wsmtraces.log