STRACE and HTTPRelay

Whilst watching a Lync training video the other day, the instructor was using a very nice tool from Microsoft called STRACE.  It provided the ability to log all the HTTP/HTTPS requests that a particular application would make whist it was running.

I have used this program along with HTTPReplay a few times since to troubleshoot EWS errors in the Lync client.

So though I would try and put together some notes on how to use it.

First the programs can be downloaded from:
STRACE:       http://www.microsoft.com/en-us/download/details.aspx?id=7643
HTTPReplay:  http://www.microsoft.com/en-us/download/details.aspx?id=3121


Once installed, the process is traceing/troubleshooting/logging is done in two (2) parts.

1. Launch the required program to trace (in this case the Lync client) using the strace DLL.
2. View the output of the STRACE using HTTPReplay

STRACE

From a command prompt change to the directory that the STRACE program was installed.

cd "c:\Program Files (x86)\STRACE"

Launch the required application with the following command

withdll /d:STRACE.DLL MYAPPLICATION.EXE

The actual command to launch with communicator will be something like

withdll /d:STRACE.DLL "c:\Program Files (x86)\Microsoft Lync\communicator.exe"

The STRACE program will continue to log details of HTTP and HTTPS requests until you exit the program that was launched. So exit Lync and the STRACE program will complete.

This will create a file on your desktop called:

STRACE_COMMUNICATOR_PID_<PID Value>_<DATE>_<GMT Time>.LOG

HTTPReplay
Copy this file to the install directory of the HTTPReplay program

c:\program files (x86)\httpreplay\

From a command prompt change to the HTTPRelay directory.

cd "c:\program files (x86)\httpreplay"

Launch the HTTPReplay application with the STRACE log file that was created earlier.

httpreplay.cmd STRACE_COMMUNICATOR_PID_<PID Value>_<DATE>_<GMT Time>.LOG

The will again be a file created on the desktop, this time a .html file called HTTPREPLAY.HTML.  This file will automatically open in your default web browser.

From the image above you can see the URL, and the HTML status code from the request.  In the example you can see that there are a few status codes with "500" as the value. A HTML status code of "500" is "Internal Server Error"

Clicking on the status code value will give more details of the actual error that was generated.

From the generated "500 - Internal Server Error" message we can see that the error occurred due to an account being locked out.

In this case once the account was "un-locked" in AD the users problem was resolved.

So to cover off the commands again, just because I'm lazy and don't want to have to copy and paste from a few spots in this post.

cd "c:\Program Files (x86)\STRACE"

withdll /d:STRACE.DLL "c:\Program Files (x86)\Microsoft Lync\communicator.exe"

copy the STRACE log file to "c:\program files (x86)\httpreplay\"

cd "c:\program files (x86)\httpreplay"

httpreplay.cmd STRACE_COMMUNICATOR_PID_<PID Value>_<DATE>_<GMT Time>.LOG