Windowsserverdocs: Specifying log formats other than binary is not allowed

[paulomorgado]

If -f value of csv, tsv or sql is specified, the result is: The parameter is incorrect.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: ccf27e81-28f7-52ee-faa6-e604f679d5f3
• Version Independent ID: 583aae78-893b-5e4b-d511-4ea30f1a501c
• Content: logman create trace
• Content Source: WindowsServerDocs/administration/windows-commands/logman-create-trace.md
• Product: windows-server
• Technology: manage-windows-commands
• GitHub Login: @coreyp-at-msft
• Microsoft Alias: coreyp

[illfated]

Which OS version are you using where you have found this to be the case?
Could you post a sample command which does not work for you?

Logman help (text output) on Windows Server 2016 OS build 14393:

• https://gist.github.com/illfated/2d2df7efccd6b054ef85b3100d67a19d#file-logman-txt

[paulomorgado]

Windows 10.0.19018.1

logman create trace (not just logman) help text:

PS C:\temp> logman create trace -?

Microsoft ® Logman.exe (10.0.19018.1)

Usage:
  C:\WINDOWS\system32\logman.exe create trace <[-n] <name>> [options]

Verbs:
  create                        Create a new data collector.

Adverbs:
  trace                         Create a trace data collector.

Options (trace):
  -f <bin|bincirc|csv|tsv|sql>  Specifies the log format for the data collector. For SQL database format, you must use the -o option in the command line with the DNS!log option. The defaults is binary.
  -mode <trace_mode>            Event Trace Session logger mode. For more information visit - https://go.microsoft.com/fwlink/?LinkID=136464
  -ct <perf|system|cycle>       Specifies the clock resolution to use when logging the time stamp for each event. You can use query performance counter, system time, or CPU cycle.
  -ln <logger_name>             Logger name for Event Trace Sessions.
  -ft <[[hh:]mm:]ss>            Event Trace Session flush timer.
  -[-]p <provider [flags [level]]> A single Event Trace provider to enable. The terms 'Flags' and 'Keywords' are synonymous in this context.
  -pf <filename>                File listing multiple Event Trace providers to enable.
  -[-]rt                        Run the Event Trace Session in real-time mode.
  -[-]ul                        Run the Event Trace Session in user mode.
  -bs <value>                   Event Trace Session buffer size in kb.
  -nb <min max>                 Number of Event Trace Session buffers.

Options:
  -?                            Displays context sensitive help.
  -s <computer>                 Perform the command on specified remote system.
  -config <filename>            Settings file containing command options.
  [-n] <name>                   Name of the target object.
  -[-]u <user [password]>       User to Run As. Entering a * for the password produces a prompt for the password. The password is not displayed when you type it at the password prompt.
  -m <[start] [stop]>           Change to manual start or stop instead of a scheduled begin or end time.
  -rf <[[hh:]mm:]ss>            Run the data collector for the specified period of time.
  -b <yyyy-MM-dd HH:mm:ss>      Begin the data collector at specified time.
  -e <yyyy-MM-dd HH:mm:ss>      End the data collector at specified time.
  -o <path|dsn!log>             Path of the output log file or the DSN and log set name in a SQL database. The default path is '%systemdrive%\PerfLogs\Admin'.
  -[-]r                         Repeat the data collector daily at the specified begin and end times.
  -[-]a                         Append to an existing log file.
  -[-]ow                        Overwrite an existing log file.
  -[-]v <nnnnnn|mmddhhmm>       Attach file versioning information to the end of the log name.
  -[-]rc <task>                 Run the command specified each time the log is closed.
  -[-]max <value>               Maximum log file size in MB or number of records for SQL logs.
  -[-]cnf <[[hh:]mm:]ss>        Create a new file when the specified time has elapsed or when the max size is exceeded.
  -y                            Answer yes to all questions without prompting.
  -ets                          Send commands to Event Trace Sessions directly without saving or scheduling.

Note:
  Where [-] is listed, an extra - negates the option.
  For example --u turns off the -u option.

More Information:
  Microsoft TechNet - https://go.microsoft.com/fwlink/?LinkID=136332

Examples:
  logman create trace trace_log -nb 16 256 -bs 64 -o c:\logfile

Please try every value for the -f option.

[illfated]

Oh. You are using the Windows insider preview build.
It is very likely that your build does not do the same things as a supported Windows Server build.

---

edit: I will do my best to set aside enough time to make a test on a supported build, though (I am not using a preview build myself).

[paulomorgado]

Yes, I'm using an insiders' build.

Just try this out:

logman create trace ETW_TSV -f tsv -o C:\PerfLogs\Admin\ETW_TSW

It either creates the data collection or gives you an error.

This one will succeed:

logman create trace ETW_BIN-f bin -o C:\PerfLogs\Admin\ETW_BIN

Just out of curiosity, have you ever been able to create a tsv trace data collector? Either using logman or perfmon?

[illfated]

Sorry to disappoint you, but this kind of work has never been on my schedules, as I have mostly only worked as either a computer support agent, IT co-worker or repair technician.

My day today has also been too busy to even get time to test the Logman command on my employer's Windows Server 2016 production server. There is simply too much going on at the moment, with new people being added to the workforce at my office.

I would also like to point out that this repository is limited to reporting errors and inaccuracies in the documentation when using directly supported versions of the server OS. Depending on testing results (when I finally find time to do so), your private scenario will still not be relevant to the documentation page you arrived from (https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman-create-trace), unless any of us, or anyone else, are able to prove that a non-preview version of the OS software does not behave like the documentation says it should.

I will make an effort to test the command on my local production server, although I can't be sure exactly how soon my work load will be low enough to perform the test.

[JasonGerend]

I just tested this on Windows 10, version 1903, and all of the log formats worked except .csv, tsv, and sql, as stated in the original post.

Here's the syntax I tested:
logman create trace trace_test -nb 16 256 -bs 64 -o c:\logfile2 -f bin

Thanks for alerting us to this and I'll see if I can find someone to investigate further!

Jason Gerend - Technical Writer, Windows Server

[illfated]

Thank you for following up on this issue, Jason! Much obliged. 👍

[JasonGerend]

No problem! I found the team that owns Logman, and they've opened a bug and will investigate to see what's going on. Thanks again for letting us know about this issue!

Jason

[illfated]

@JasonGerend : Has there been any development in this case yet, outside of this ticket, so we can make any practical moves toward closing this ticket?