Rudy Ooms posted: "This time a simple blog, about WPA, not to be mixed up with Wifi Protected Acces. I will be talking about the Windows Performance Analyzer (WPA) and how you could use it to get some insights into (as an example) Autopilot Self-Deploying mode.I will divide"
This time a simple blog, about WPA, not to be mixed up with Wifi Protected Acces. I will be talking about the Windows Performance Analyzer (WPA) and how you could use it to get some insights into (as an example) Autopilot Self-Deploying mode.
When you need to deep dive into a problem it could really help you when you understand the whole flow of it. I did the same with Autopilot and using WPA was part of it.
And this blog below was kinda the start of it all, so please make sure you also read this one!
So when you want to get some more information and logging, Event Tracing will come knocking on the door. When using event tracing for Windows (ETW) you are enabling kernel or application event logging. But logging it one, but we still need to make sure we can read it!
Luckily these specified events can be exported to a nice ETL (Event tracing Log) so you could make sure you have every in place to start some troubleshooting.
But before we can use the WPA tool, we need to have the ETL file… otherwise we have a nice tool without data. How are we going to facilitate this?
With the use of the Windows Performance Recorder (WPR) tool! This tool extends the Event tracing for Windows it talked about earlier. When we are using the WPR tool we can enable the recording of the events and export them to a nice ETL file
Like I showed in the first part, we need to make sure we enable logging on the client with the use of the WPR tool. So how are we going to do this?
I will show you how to do this when you want to troubleshoot the autopilot flow. So to do this, just open a nice new system cmd when you are almost ready to go to start provisioning the device (shift + f10)
Now we need to start the recording. So let's start recording… right?
Looking at the screenshot above, when we want to start recording we need to select the wprp file. The wprp file is a Windows performance recorder profile. In this XML profile, we can define what we want to record.
So first take a look at how we could build it.
Looking at the above picture we need to define some settings, like the logging mode, the DetailLevel (Verbose… because we want to see everything). But we also need to define the profile itself and in it, we need to define the EventProviders we want to use.
So let's check them out should we? Open PowerShell and fire up this command
But what should we configure when we want to record the autopilot flow? Where to find them? When I am looking at these event providers I am missing a lot …. And I mean a lot!
Because when troubleshooting Autopilot you need to enable some nice EventProviders like Microsoft.Windows.Shell.CloudExperienceHost.Common or Microsoft.Windows.Shell.CloudDomainJoin.Client to get some good logging. But again… they are missing in the list I got back with the use of PowerShell
So if we don't get them back with PowerShell I will give them to you!
Okay… so now we have the WPA tool installed, we know about the WPR tool, we know about the fact we need to define a wprp file to do so and which EventProviders we need. So take a look at the wprp file
I guess it's now time to start doing some logging. That's just plain easy, just use this command to start recording
wpr -start c:tempautopilot.wprp
If you are done and you received the nice green screen after the white glove, you can use this command to stop recording and export the output to a nice log file! Please don't forget this step, otherwise, you will miss the ETL file
Wpr -stop c:tempautopilot.etl
Now we have the so much needed ETL file, let's fire up WPA and open the ETL file, start with double-clicking on the "generic events" so you will end up with this screen
The most important ones to check out would be these 2
If you want to be sure you are not missing stuff, please click on this settings button first
And make sure you enable those 3 fields
Now expand some Provider Names and take a look at the task names inside of them
If you want to calculate the time when something happened you can check the exact start time of the log file by clicking on the system configuration button
Knowing how to troubleshoot a device could come in handy when you run into weird issues.. of course, you could also use it when you are just curious about how some stuff works! Now let's check it out for yourself!
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.