Message Analyzer FAQ and Known Issues

This document captures FAQ and known issues with Microsoft Message Analyzer. Please browse this list if you're having an issue before reporting a problem to our team. Microsoft Message analyzer Frequently Asked Questions and Known Issues Table of Content Capturing    2 Network connections are reset When Message Analyzer is installed    2 Why can’t I view web traffic anymore? Why is IE now not working the same?    2 Can't start capturing or no data being received    2 It seems like some of the messages are missing when I capture    2 I receive the error “Failed to start one or more trace session(s) due to the following error(s) “    2 Live consumer xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx fails to start.     2 Unable to start filter info provider service.”    2 PowerShell capture trace is not saved to PS execute path if you are using relative path    3 Simultaneous captures involving the same provider may give unpredictable results    3 The Web Proxy live trace scenario causes issues with Internet Explorer and Windows Store applications    3 Information Disclosure on WebProxy Trace Scenario for multi user scenario    4 Hyper-V traffic between virtual machines is not captured in Windows Server 2008 R2    4 Remote Capture    4 Supported Remote Capture Scenarios    4 Failed to create a remote trace session after providing wrong credentials    5 ETW keywords ignored When doing remote capture    5 Failed to create a remote trace session or to configure NDIS provider when entering an invalid or not reachable hostname for Link layer remote capture.    5 Windows 8.1 and Windows Server 2012 R2 specific issues    5 Can’t    5 capture on NDISCAP after Message Analyzer installation    5 Capture on Local Link Layer fails    5 UI    5 Can't see columns for USB (or other) Events    5 Charts    6 Assets in Appdata/Roaming are not updated after uninstall/reinstall    6 Performance    6 Size of Traces that can be loaded/Number of Messages that can be captured    6 Errors on 32-bit machine    7 filtering    7 IPv4 and IPv6Adress filters do not work on Wifi    7 FAST Filters on WFP    7 Sequence Expressions    7 What are the sequence expressions limitations?    7 Opening Traces    10 MA is unable to decode ETL file    10 Slow performance loading Cluster log with text log adapter    10 Clicking multiple files from Windows Explorer doesn’t do anything    10 Capturing Network connections are reset When Message Analyzer is installed Message Analyzer installs PEFNDIS driver in Windows 8/Windows Server 2012 and below systems. When we add our driver on the system during the installation, the network stack may reset. This might cause a temporary loss network access which can interfere with programs that rely on a network connection.  This problem is mitigated on Windows 8 and Windows 2012 and above. Why can’t I view web traffic anymore? Why is IE now not working the same? Message Analyzer uses Fiddler to create a man-in-the-middle proxy to capture unencrypted web traffic. When the Message Analyzer closes unexpectedly, Message Analyzer tries to recover the original proxy settings; however, there are times when this may not occur. To fix this issue, try restarting and then stopping a Web Proxy capture OR resetting your proxy settings in the LAN settings section of the Connections Tab in Internet Options within Internet Explorer. Can't start capturing or no data being received There is a limit to the number of capture sessions which can run concurrently. If the Message Analyzer isn't properly closed, these can accumulate and prevent new ones from running. To close these extra sessions: 1. Open the Computer Management utility by right-clicking Computer in the Start Menu and selecting Manage.