We are excited to announce the official release of Message Analyzer to the Microsoft Download Center. Sci-Fi movie references aside, this really is a new beginning for troubleshooting and analysis. Message Analyzer brings a set of new ideas, new techniques, and new paradigms in order to make analysis of protocols, log files, and system events a cohesive activity which allows correlation across all those types of traces.
New Ways to Capture
As I detailed in the Network Capture is Dead blog, we have updated the way we capture messages. By leveraging ETW and providing inspection points to capture at the Firewall and HTTP Proxy layers, you can capture loopback and encrypted traffic that was not possible in the past. Message Analyzer also enables you to capture messages from multiple places in the system at the same time, collect them in one trace file and package up all the information so that it can be analyzed elsewhere.
New Ways to Analyze
There are also new ways to analyze and organize the trace data. Automatic diagnosis and coalescing of fragments and messages provide a concise and succinct view allowing you to focus on the problems and not the noise. New visualizations let you see a problem at a high level, and then dig in by viewing selected data in detail in the Analysis Grid. New tools like Sequence Matching, Viewpoints, and Grouping provide alternative ways to slice, dice and find the problems buried in heaps of noisy traces. Improved filtering syntax continues on where Network Monitor left and provides a richer way to specify fields and properties.
New Ways to Share
The world is full of many specialized areas each with their own silos of knowledge. Subject matter experts need a way to share this expertise so that everybody can benefit and learn from the masters. The sharing infrastructure is the starting place for this new innovation which will continue to evolve. Designed to allow users to manage and share various Message Analyzer assets like filters, views, trace scenarios and more, expert knowledge will become easier to discover and use.
The new name, Message Analyzer, reflects the broader initiative to analyze more than just network packet captures. Now your text files, event logs, and system event traces can be included altogether. When you analyze the merged traces the combined data helps provide an extra level of inspection and insight. And while this is the end of one chapter, it is only the start of a story that we will continue to share at a rapid pace. So please download Message Analyzer take it for a spin and if you have feedback of problems, please report them on our Microsoft Message Analyzer Forum.
To learn more about some of the concepts briefly described in this article, see the following topics in the Message Analyzer Operating Guide on TechNet:
- Release Features Summary — get a brief overview of Message Analyzer features.
- Technology Tutorials — review Message Analyzer technologies, the Protocol Engineering Framework (PEF) architecture, and the Event Tracing for Windows (ETW) Framework.
- Default Trace Scenarios — lists the predefined scenarios that you can use to capture live data.
- PEF-WFP Layer Set Filters — includes information on capturing loop back traffic.
- PEF-WebProxy Provider — includes information on capturing encrypted traffic.
- Analysis Grid — describes the default tree-grid-style viewer for analyzing message data and how to use its features.
- Sequence Match — discusses the use of sequence match viewer features, provides a walkthrough of the default sequence expressions, and describes how to create your own sequence matching patterns.
- Applying and Managing Viewpoints — includes how to apply predefined viewpoint filters that enable you to observe network traffic from the perspective of specific protocols.
- Using the Data Grouping Feature — describes how to use Analysis Grid features to bubble up and organize relevant data into a grouped display, similar to the conversation tree in Network Monitor.
- Writing Filter Expressions — describes how to use the filtering language to create your own filters.
- Managing Assets and Resources — includes information on how to obtain Message Analyzer assets, synchronize your installation to receive automatic asset updates, and share your assets with others.
- Importing Message Data — includes information about importing log files.