Collecting ETW traces for FTP Sessions

Having problems with FTP Server not returning the expected return code? You have checked the detailed error message, nt event log and ftp log files, still can not get to the bottom of the problem?

Here are few simple steps you can follow to trace your ftp session and uncover the real cause. This feature is supported on Microsoft FTP Sever 7.0, which can be downloaded from http://www.microsoft.com/downloads/details.aspx?familyid=2ECCF14A-5C4F-4CFB-9153-CFE1204B346A&displaylang=en, and above.

1. Start FTP ETW Session using logman.exe

   Note: You need to be a system administrator on the FTP Server to be able to execute this command.

logman start "ftp" -p "IIS: Ftp Server" 255 5 –ets

2. Reproduce the error you are hitting

3. Stop FTP ETW Session using logman.exe

    Note: You need to be a system administrator on the FTP Server to be able to execute this command.

logman stop "ftp" –ets

4. Parse the etw log file using logparser.exe

    Note: LogParser can be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

<Path To LogParser>\logparser "select EventTypeName, UserData from ftp.etl" -e 20 -o:DATAGRID -rtp 20 -compactModeSep " | "

The final step will open the etw log in the following grid format

In the above case the error is (Event #18) 0x8007002 (Specified File Not Found).

-Suditi