WSL/diagnostics/collect-networking-logs.ps1
2024-05-16 13:19:48 -07:00

310 lines
9.3 KiB
PowerShell

#Requires -RunAsAdministrator
[CmdletBinding()]
Param (
[switch]$RestartWslReproMode = $false
)
function Collect-WindowsNetworkState {
param (
$ReproStep
)
# Collect host networking state relevant for WSL
# Using a try/catch for commands below, as some of them do not exist on all OS versions
try
{
Get-NetAdapter -includeHidden | select Name,ifIndex,NetLuid,InterfaceGuid,Status,MacAddress,MtuSize,InterfaceType,Hidden,HardwareInterface,ConnectorPresent,MediaType,PhysicalMediaType | Out-File -FilePath "$folder/Get-NetAdapter_$ReproStep.log" -Append
}
catch {}
try
{
& netsh nlm query all $folder/nlmquery_"$ReproStep".log
}
catch {}
try
{
Get-NetIPConfiguration -All -Detailed | Out-File -FilePath "$folder/Get-NetIPConfiguration_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetRoute | Out-File -FilePath "$folder/Get-NetRoute_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetFirewallHyperVVMCreator | Out-File -FilePath "$folder/Get-NetFirewallHyperVVMCreator_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetFirewallHyperVVMSetting -PolicyStore ActiveStore | Out-File -FilePath "$folder/Get-NetFirewallHyperVVMSetting_ActiveStore_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetFirewallHyperVProfile -PolicyStore ActiveStore | Out-File -FilePath "$folder/Get-NetFirewallHyperVProfile_ActiveStore_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetFirewallHyperVRule -PolicyStore ActiveStore | Out-File -FilePath "$folder/Get-NetFirewallHyperVRule_ActiveStore_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetFirewallRule -PolicyStore ActiveStore | Out-File -FilePath "$folder/Get-NetFirewallRule_ActiveStore_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetFirewallProfile -PolicyStore ActiveStore | Out-File -FilePath "$folder/Get-NetFirewallProfile_ActiveStore_$ReproStep.log" -Append
}
catch {}
try
{
Get-NetFirewallHyperVPort | Out-File -FilePath "$folder/Get-NetFirewallHyperVPort_$ReproStep.log" -Append
}
catch {}
try
{
& hnsdiag.exe list all 2>&1 > $folder/hnsdiag_list_all_"$ReproStep".log
}
catch {}
try
{
& hnsdiag.exe list endpoints -df 2>&1 > $folder/hnsdiag_list_endpoints_"$ReproStep".log
}
catch {}
try
{
foreach ($port in Get-NetFirewallHyperVPort)
{
& vfpctrl.exe /port $port.PortName /get-port-state 2>&1 > "$folder/vfp-port-$($port.PortName)-get-port-state_$ReproStep.log"
& vfpctrl.exe /port $port.PortName /list-rule 2>&1 > "$folder/vfp-port-$($port.PortName)-list-rule_$ReproStep.log"
}
}
catch {}
try
{
& vfpctrl.exe /list-vmswitch-port 2>&1 > $folder/vfpctrl_list_vmswitch_port_"$ReproStep".log
}
catch {}
try
{
Get-VMSwitch | select Name,Id,SwitchType | Out-File -FilePath "$folder/Get-VMSwitch_$ReproStep.log" -Append
}
catch {}
}
$folder = "WslNetworkingLogs-" + (Get-Date -Format "yyyy-MM-dd_HH-mm-ss")
mkdir -p $folder
$logProfile = "$folder/wsl_networking.wprp"
$networkingBashScript = "$folder/networking.sh"
# Copy/Download supporting files
if (Test-Path "$PSScriptRoot/wsl_networking.wprp")
{
Copy-Item "$PSScriptRoot/wsl_networking.wprp" $logProfile
}
else
{
Write-Host -ForegroundColor Yellow "wsl_networking.wprp not found in the current directory. Downloading it from GitHub."
Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/wsl_networking.wprp" -OutFile $logProfile
}
if (Test-Path "$PSScriptRoot/networking.sh")
{
Copy-Item "$PSScriptRoot/networking.sh" $networkingBashScript
}
else
{
Write-Host -ForegroundColor Yellow "networking.sh not found in the current directory. Downloading it from GitHub."
Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/networking.sh" -OutFile $networkingBashScript
}
# Retrieve WSL version and wslconfig file
get-appxpackage MicrosoftCorporationII.WindowsSubsystemforLinux > $folder/appxpackage.txt
$wslconfig = "$env:USERPROFILE/.wslconfig"
if (Test-Path $wslconfig)
{
Copy-Item $wslconfig $folder
}
# Collect Linux & Windows network state before the repro
& wsl.exe -u root -e $networkingBashScript 2>&1 > $folder/linux_network_configuration_before.log
Collect-WindowsNetworkState "before_repro"
if ($RestartWslReproMode)
{
# The WSL HNS network is created once per boot. Resetting it to collect network creation logs.
# Note: The below HNS command applies only to WSL in NAT mode
Get-HnsNetwork | Where-Object {$_.Name -eq 'WSL' -Or $_.Name -eq 'WSL (Hyper-V firewall)'} | Remove-HnsNetwork
# Stop WSL.
net.exe stop WslService
if(-not $?)
{
net.exe stop LxssManager
}
}
# Start logging.
$wprOutputLog = "$folder/wpr.txt"
wpr.exe -start $logProfile -filemode 2>&1 >> $wprOutputLog
if ($LastExitCode -Ne 0)
{
Write-Host -ForegroundColor Yellow "Log collection failed to start (exit code: $LastExitCode), trying to reset it."
wpr.exe -cancel 2>&1 >> $wprOutputLog
wpr.exe -start $logProfile -filemode 2>&1 >> $wprOutputLog
if ($LastExitCode -Ne 0)
{
Write-Host -ForegroundColor Red "Couldn't start log collection (exitCode: $LastExitCode)"
}
}
# Start packet capture using pktmon
pktmon start -c --flags 0x1A --file-name "$folder/pktmon.etl" | out-null
# Start WFP capture
netsh wfp capture start file="$folder/wfpdiag.cab"
# Start tcpdump. Using a try/catch as tcpdump might not be installed
$tcpdumpProcess = $null
try
{
$tcpdumpProcess = Start-Process wsl.exe -ArgumentList "-u root tcpdump -n -i any -e -vvv > $folder/tcpdump.log" -PassThru
}
catch {}
try
{
Write-Host -NoNewLine -ForegroundColor Green "Log collection is running. Please reproduce the problem and press any key to save the logs."
$KeysToIgnore =
16, # Shift (left or right)
17, # Ctrl (left or right)
18, # Alt (left or right)
20, # Caps lock
91, # Windows key (left)
92, # Windows key (right)
93, # Menu key
144, # Num lock
145, # Scroll lock
166, # Back
167, # Forward
168, # Refresh
169, # Stop
170, # Search
171, # Favorites
172, # Start/Home
173, # Mute
174, # Volume Down
175, # Volume Up
176, # Next Track
177, # Previous Track
178, # Stop Media
179, # Play
180, # Mail
181, # Select Media
182, # Application 1
183 # Application 2
$Key = $null
while (($Key -Eq $null -Or $Key.VirtualKeyCode -Eq $null -Or $KeysToIgnore -Contains $Key.VirtualKeyCode) -and ($null -eq $tcpdumpProcess -or $tcpdumpProcess.HasExited -eq $false))
{
if ([console]::KeyAvailable)
{
$Key = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown')
}
else
{
Start-Sleep -Seconds 1
}
}
Write-Host "`nSaving logs..."
}
finally
{
try
{
wsl.exe -u root killall tcpdump
if ($tcpdumpProcess -ne $null)
{
Wait-Process -InputObject $tcpdumpProcess -Timeout 10
}
}
catch {}
netsh wfp capture stop
pktmon stop | out-null
wpr.exe -stop $folder/logs.etl 2>&1 >> $wprOutputLog
}
# Collect Linux & Windows network state after the repro
& wsl.exe -u root -e $networkingBashScript 2>&1 > $folder/linux_network_configuration_after.log
Collect-WindowsNetworkState "after_repro"
try
{
# Collect HNS events from past 24 hours
$events = Get-WinEvent -ProviderName Microsoft-Windows-Host-Network-Service | Where-Object { $_.TimeCreated -ge ((Get-Date) - (New-TimeSpan -Day 1)) }
($events | ForEach-Object { '{0},{1},{2},{3}' -f $_.TimeCreated, $_.Id, $_.LevelDisplayName, $_.Message }) -join [environment]::NewLine | Out-File -FilePath "$folder/hns_events.log" -Append
}
catch {}
# Collect the old Tcpip6 registry values - as they can break WSL if DisabledComponents is set to 0xff
# see https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows
try
{
Get-Item HKLM:SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters | Out-File -FilePath "$folder/tcpip6_parameters.log" -Append
}
catch {}
# Collect the setup and NetSetup log files
$netSetupPath = "$env:WINDIR/logs/netsetup"
if (Test-Path $netSetupPath)
{
Copy-Item $netSetupPath/* $folder
}
$setupApiPath = "$env:WINDIR/inf/setupapi.dev.log"
if (Test-Path $setupApiPath)
{
Copy-Item $setupApiPath $folder
}
Remove-Item $logProfile
Remove-Item $networkingBashScript
$logArchive = "$(Resolve-Path $folder).zip"
Compress-Archive -Path $folder -DestinationPath $logArchive
Remove-Item $folder -Recurse
Write-Host -ForegroundColor Green "Logs saved in: $logArchive. Please attach that file to the GitHub issue."