Objective
This article describes how to enable Winsock logging on a Windows device, and how to view and export the results when Automox Support requests them.
When these logs are useful
Winsock logging records socket and name resolution activity, so it is most useful for connectivity problems that come and go rather than fail outright. Support may request it when a device disconnects from the console intermittently and reconnects on its own, or when an agent recovers after a service restart and then drops again later.
A common finding in these logs is a device that intermittently fails to resolve the Automox endpoints it needs, such as api.automox.com and rtt.automox.com, and then recovers. That pattern is hard to demonstrate from the agent log alone, which is why the Winsock channel is worth enabling.
Collect the agent log alongside it. Support will normally want both, see Retrieving Automox Agent logs.
Enabling Winsock Logging
- Open Event Viewer
- Expand the Applications and Services Logs section, then expand Microsoft > Windows.
- Scroll to the bottom, expand Winsock Network Event, right-click Operational, then select Enable Log.
- With logging enabled, configure it. Open Properties, set the maximum log size to 6016 KB, roughly 6 MB, and set the behavior when the maximum is reached to Overwrite Events as needed.
This channel can be busy on an active device. A capped size with overwrite enabled keeps it from filling and stopping, so recent activity is always retained.
Viewing and Exporting Winsock Logs
- Refresh Event Viewer. Events should already be populating under the Operational channel.
- Leave logging enabled long enough to capture the problem. If the disconnects are intermittent, the log needs to cover a window in which one actually occurred, so note the time it happens.
- To export, right-click Operational and select Save All Events As...
- Name the file after the device hostname, then click Save. Attach it to your support ticket along with the approximate time of the disconnect.
Doing this from the command line
The steps above are per device and require someone at the console. wevtutil performs the same actions from an elevated command prompt, which also means it can be run through a Worklet when you need logging on a device you cannot sit at, or on several devices at once.
First confirm the exact channel name on the device, since it is more precise than the display name shown in Event Viewer:
wevtutil el | findstr /i winsock
Enable the channel and configure it, substituting the name returned above:
wevtutil sl "CHANNEL_NAME" /e:true /ms:6291456 /rt:false
Export the log, naming the file after the hostname:
wevtutil epl "CHANNEL_NAME" "C:\Temp\%COMPUTERNAME%-winsock.evtx"
If you run this in a Worklet, write the export somewhere you can collect it from, and have the Worklet report the file path in its output so the Activity Log records where it landed.
Turn logging back off when you are finished
This is a diagnostic channel and is disabled by default. Leaving it enabled indefinitely continues writing events for no benefit, so disable it once the logs are collected:
wevtutil sl "CHANNEL_NAME" /e:false
You can also right-click the Operational channel in Event Viewer and select Disable Log.