Skip to content
This repository has been archived by the owner on Aug 2, 2023. It is now read-only.

Feature: Collect logs for requests in Fiddler trace #9

Open
bongiovimatthew-microsoft opened this issue Feb 7, 2018 · 0 comments
Open

Comments

@bongiovimatthew-microsoft
Copy link
Contributor

Fiddler captures HTTP requests and saves a set of files that can be parsed. Details on Fiddler serialization

The EventLog script can do the following steps to get the logs associated with the requests in a Fiddler trace:

  1. Open "raw" folder in the Fiddler .saz file, find all <sessid#>_c.txt files
  2. Locate the client requests to ADFS (parse the requests for URLs containing "adfs/ls")
  3. Pull out the "client-request-id" query string parameter (might need to also look in _s.txt in the case where the server returns the ID, but the client never redirects with it)
  4. Send the correlation ID to Get-ADFSEvents to collect the events associated with the current request
  5. Repeat 1-4 for each independent correlation ID that gets discovered (as a Fiddler trace could contain multiple requests)

The current script should be altered to include a -FiddlerTrace parameter, which takes the filepath to the Fiddler trace.

An example execution would be:

Get-ADFSEvents -Logs Security, Admin, Debug -FiddlerTrace c:\fiddlerTrace.saz -Server *

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant