Share via

Winsock Tracing

  • Article

Applies To: Windows Server 2008

Winsock does not log events unless Event Tracing for Windows (ETW) is enabled for Microsoft-Windows-Winsock-AFD, which is disabled by default. After ETW is enabled, an event is logged whenever a Winsock-based application uses one of the core Winsock operations, such as creating a socket.

To verify that tracing for Winsock is enabled:

  1. To start tracing, at the command prompt, type logman start winsocktrace -p Microsoft-Windows-Winsock-AFD –o winsocktrace.etl –ets.
  2. To stop tracing, type logman stop winsocktrace -ets.
  3. To view the report in XML format, type tracerpt winsocktrace.etl -y -o winsocktracelog.xml -of xml.

Note:   Alternatively, tracing can be enabled or disabled by using Event Viewer.

Events

Event ID Source Message

1

Microsoft-Windows-Winsock-WS2HELP

 Socket creation: %1 %2 %3 %4 %5

2

Microsoft-Windows-Winsock-WS2HELP

 Socket bind: %1 %2 %3 %4 %5

3

Microsoft-Windows-Winsock-WS2HELP

 Socket bind: %1 %2 %3 %4 %5

4

Microsoft-Windows-Winsock-WS2HELP

 Socket connect: %1 %2 %3 %4

5

Microsoft-Windows-Winsock-WS2HELP

 Socket connect: %1 %2 %3 %4

6

Microsoft-Windows-Winsock-WS2HELP

 Connect completed: %1 %2 %3

7

Microsoft-Windows-Winsock-WS2HELP

 AFD initiated abort: %1 %2 %3

8

Microsoft-Windows-Winsock-WS2HELP

 Transport initiated abort: %1 %2 %3

9

Microsoft-Windows-Winsock-WS2HELP

 Failed send request: %1 %2 %3

10

Microsoft-Windows-Winsock-WS2HELP

 Failed WSASendMsg request: %1 %2 %3

11

Microsoft-Windows-Winsock-WS2HELP

 Failed recv request: %1 %2 %3

12

Microsoft-Windows-Winsock-WS2HELP

 Failed recvfrom request: %1 %2 %3

13

Microsoft-Windows-Winsock-WS2HELP

 Socket close: %1 %2 %3

14

Microsoft-Windows-Winsock-WS2HELP

 Socket cleanup (all references removed): %1 %2 %3

15

Microsoft-Windows-Winsock-WS2HELP

 Socket accept: %1 %2 %3 %4 %5

16

Microsoft-Windows-Winsock-WS2HELP

 Socket accept: %1 %2 %3 %4 %5

17

Microsoft-Windows-Winsock-WS2HELP

 Accept failed: %1 %2 %3

18

Microsoft-Windows-Winsock-WS2HELP

 Send posted: %1 %2 %3 %4 %5 %6

19

Microsoft-Windows-Winsock-WS2HELP

 Receive posted: %1 %2 %3 %4 %5 %6

20

Microsoft-Windows-Winsock-WS2HELP

 RecvFrom posted: %1 %2 %3 %4 %5 %6

21

Microsoft-Windows-Winsock-WS2HELP

 SendTo posted: %1 %2 %3 %4 %5 %6 %7 %8

22

Microsoft-Windows-Winsock-WS2HELP

 SendTo posted: %1 %2 %3 %4 %5 %6 %7 %8

23

Microsoft-Windows-Winsock-WS2HELP

 Recv completed: %1 %2 %3 %4

24

Microsoft-Windows-Winsock-WS2HELP

 Send completed: %1 %2 %3 %4

25

Microsoft-Windows-Winsock-WS2HELP

 SendMsg completed: %1 %2 %3 %4

26

Microsoft-Windows-Winsock-WS2HELP

 RecvFrom completed: %1 %2 %3 %4 %5 %6 %7

27

Microsoft-Windows-Winsock-WS2HELP

 RecvFrom completed: %1 %2 %3 %4 %5 %6 %7

28

Microsoft-Windows-Winsock-WS2HELP

 SendTo completed: %1 %2 %3 %4

29

Microsoft-Windows-Winsock-WS2HELP

 Socket option set: %1 %2 %3 %4

30

Microsoft-Windows-Winsock-WS2HELP

 Select/Poll posted: %1 %2 %3

31

Microsoft-Windows-Winsock-WS2HELP

 Select/Poll completed: %1 %2 %3

32

Microsoft-Windows-Winsock-WS2HELP

 WSAEventSelect: %1 %2 %3

33

Microsoft-Windows-Winsock-WS2HELP

 Datagram dropped: %1 %2 %3 %4 %5 %6

34

Microsoft-Windows-Winsock-WS2HELP

 Datagram dropped: %1 %2 %3 %4 %5 %6

35

Microsoft-Windows-Winsock-WS2HELP

 Connection indicated: %1 %2 %3 %4

36

Microsoft-Windows-Winsock-WS2HELP

 Connection indicated: %1 %2 %3 %4

37

Microsoft-Windows-Winsock-WS2HELP

 Data indicated from transport: %1 %2 %3

38

Microsoft-Windows-Winsock-WS2HELP

 Data indicated from transport: %1 %2 %3 %4 %5

39

Microsoft-Windows-Winsock-WS2HELP

 Data indicated from transport: %1 %2 %3 %4 %5

40

Microsoft-Windows-Winsock-WS2HELP

 Failed bind: %1 %2 %3

Winsock2

Networking