NetTrace

1.2.2

NetTrace-Service.ps1

#Requires -Version 5.1
#Requires -RunAsAdministrator

<#
.SYNOPSIS
    NetTrace Windows Service Implementation
 
.DESCRIPTION
    This script implements a Windows Service that provides true persistence for NetTrace functionality.
    The service handles network trace file monitoring and rotation independently of user sessions,
    ensuring continuous operation even after user logouts and system reboots.
 
.PARAMETER ServiceMode
    Indicates the script is running as a Windows Service. When this parameter is present,
    the script runs in service mode with direct monitoring execution.
 
.PARAMETER ConfigFile
    Path to the configuration file containing service parameters. Used in service mode.
 
.NOTES
    File Name : NetTrace-Service.ps1
    Version : 1.2.2
    Author : Naveed Khan
    Company : Hogwarts
    Copyright : (c) 2025 Naveed Khan. All rights reserved.
    License : MIT License
    Prerequisite : Windows 10/11 with Administrator privileges
    Requires : PowerShell 5.1 or PowerShell 7+
 
.LINK
    https://github.com/khannaveed2020/NetTrace
#>

param(
    [Parameter(Mandatory=$false)]
    [switch]$ServiceMode,

    [Parameter(Mandatory=$false)]
    [string]$ConfigFile
)

# Service configuration
$ServiceName = "NetTraceService"

# Service state file paths
$ServiceStateDir = "$env:ProgramData\NetTrace"
$ServiceConfigFile = "$ServiceStateDir\service_config.json"
$ServiceStatusFile = "$ServiceStateDir\service_status.json"
$ServiceLogFile = "$ServiceStateDir\service.log"
$ServiceStopFlag = "$ServiceStateDir\service_stop.flag"

# Ensure service directory exists
if (!(Test-Path $ServiceStateDir)) {
    New-Item -Path $ServiceStateDir -ItemType Directory -Force | Out-Null
}

# Service logging function
function Write-ServiceLog {
    param(
        [string]$Message,
        [string]$Level = "INFO"
    )

    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry = "[$timestamp] [$Level] $Message"

    try {
        $logEntry | Out-File -FilePath $ServiceLogFile -Append -Encoding UTF8
    } catch {
        # Fallback to event log if file logging fails
        Write-EventLog -LogName Application -Source $ServiceName -EntryType Information -EventId 1001 -Message $Message -ErrorAction SilentlyContinue
    }
}

# Service configuration management
function Get-ServiceConfig {
    try {
        if (Test-Path $ServiceConfigFile) {
            $config = Get-Content $ServiceConfigFile -Raw | ConvertFrom-Json
            return $config
        }
    } catch {
        Write-ServiceLog "Failed to read service configuration: $($_.Exception.Message)" "ERROR"
    }
    return $null
}

function Set-ServiceConfig {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [string]$Path,
        [int]$MaxFiles,
        [int]$MaxSizeMB,
        [bool]$LogOutput = $false,
        [bool]$EnableLogging = $false
    )

    if ($PSCmdlet.ShouldProcess("NetTrace Service Configuration", "Save configuration")) {
        $config = @{
            Path = $Path
            MaxFiles = $MaxFiles
            MaxSizeMB = $MaxSizeMB
            LogOutput = $LogOutput
            EnableLogging = $EnableLogging
            StartTime = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
            ServiceVersion = "1.2.2"
        }

        try {
            $config | ConvertTo-Json -Depth 10 | Out-File -FilePath $ServiceConfigFile -Encoding UTF8
            Write-ServiceLog "Service configuration saved: Path=$Path, MaxFiles=$MaxFiles, MaxSizeMB=$MaxSizeMB"
            return $true
        } catch {
            Write-ServiceLog "Failed to save service configuration: $($_.Exception.Message)" "ERROR"
            return $false
        }
    }
    return $false
}

# Service status management
function Get-ServiceStatus {
    try {
        if (Test-Path $ServiceStatusFile) {
            $status = Get-Content $ServiceStatusFile -Raw | ConvertFrom-Json
            return $status
        }
    } catch {
        Write-ServiceLog "Failed to read service status: $($_.Exception.Message)" "ERROR"
    }

    return @{
        IsRunning = $false
        FilesCreated = 0
        FilesRolled = 0
        CurrentFile = ""
        LastUpdate = ""
        ErrorMessage = ""
    }
}

function Set-ServiceStatus {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [bool]$IsRunning,
        [int]$FilesCreated = 0,
        [int]$FilesRolled = 0,
        [string]$CurrentFile = "",
        [string]$ErrorMessage = ""
    )

    if ($PSCmdlet.ShouldProcess("NetTrace Service Status", "Update status")) {
        $status = @{
            IsRunning = $IsRunning
            FilesCreated = $FilesCreated
            FilesRolled = $FilesRolled
            CurrentFile = $CurrentFile
            LastUpdate = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
            ErrorMessage = $ErrorMessage
        }

        try {
            $status | ConvertTo-Json -Depth 10 | Out-File -FilePath $ServiceStatusFile -Encoding UTF8
        } catch {
            Write-ServiceLog "Failed to save service status: $($_.Exception.Message)" "ERROR"
        }
    }
}

# Direct service monitoring function (replaces job-based monitoring)
function Start-DirectServiceMonitoring {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [string]$TracePath,
        [int]$MaxFiles,
        [int]$MaxSizeMB,
        [bool]$LogOutput = $false,
        [bool]$EnableLogging = $false
    )

    if ($PSCmdlet.ShouldProcess("NetTrace Service", "Start direct monitoring")) {
        Write-ServiceLog "Starting direct service monitoring: Path=$TracePath, MaxFiles=$MaxFiles, MaxSizeMB=$MaxSizeMB"

    $fileNumber = 1
    $filesCreated = 0
    $filesRolled = 0
    $fileHistory = @()
    $computerName = $env:COMPUTERNAME
    $maxSizeBytes = $MaxSizeMB * 1MB

    # Create user log file if logging is enabled
    $userLogFile = $null
    if ($EnableLogging) {
        $userLogFile = Join-Path $TracePath "NetTrace_$(Get-Date -Format 'yyyy-MM-dd_HHmmss').log"
        "NetTrace persistent service started at $(Get-Date)" | Out-File -FilePath $userLogFile -Encoding UTF8
        "Command: NetTrace -Persistence true -File $MaxFiles -FileSize $MaxSizeMB -Path '$TracePath'" | Out-File -FilePath $userLogFile -Append -Encoding UTF8
        "=" * 60 | Out-File -FilePath $userLogFile -Append -Encoding UTF8
        "" | Out-File -FilePath $userLogFile -Append -Encoding UTF8
    }

    # Function to write to user log file if logging is enabled
    function Write-ToUserLog {
        param($Message, $LogFile)
        if ($LogFile) {
            try {
                $Message | Out-File -FilePath $LogFile -Append -Encoding UTF8
            } catch {
                Write-ServiceLog "Failed to write to user log file: $($_.Exception.Message)" "ERROR"
            }
        }
    }

    # Force stop any existing netsh trace to ensure clean start
    & netsh trace stop 2>&1 | Out-Null
    Start-Sleep -Seconds 2

    # Main monitoring loop - runs directly in service context
    while (-not (Test-Path $ServiceStopFlag)) {
        try {
            # Generate filename with computer name and timestamp
            $dateStamp = Get-Date -Format "dd-MM-yy"
            $timeStamp = Get-Date -Format "HHmmss"
            $traceFile = Join-Path $TracePath "$computerName`_$dateStamp-$timeStamp.etl"
            $fileName = [System.IO.Path]::GetFileName($traceFile)

            Write-ServiceLog "Creating File #$fileNumber : $fileName"
            Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - Creating File #$fileNumber : $fileName" -LogFile $userLogFile
            Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - True Windows Service persistence enabled - capture will survive user session termination" -LogFile $userLogFile

            # Start netsh trace with persistent mode
            $arguments = @("trace", "start", "capture=yes", "report=disabled", "overwrite=yes", "maxSize=$MaxSizeMB", "tracefile=`"$traceFile`"", "persistent=yes")

            $netshOutput = & netsh $arguments 2>&1
            $exitCode = $LASTEXITCODE

            # Log netsh output if requested
            if ($LogOutput) {
                $netshLogFile = Join-Path $TracePath "netsh_trace.log"
                "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - START TRACE (WINDOWS SERVICE):" | Out-File -FilePath $netshLogFile -Append -Encoding UTF8
                $netshOutput | Out-File -FilePath $netshLogFile -Append -Encoding UTF8
                "" | Out-File -FilePath $netshLogFile -Append -Encoding UTF8
            }

            Write-ServiceLog "Netsh trace started for: $fileName (Exit Code: $exitCode)"
            Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - Netsh trace started for: $fileName" -LogFile $userLogFile

            if ($exitCode -ne 0) {
                $errorMsg = "Failed to start trace. Exit code: $exitCode"
                Write-ServiceLog $errorMsg "ERROR"
                Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - ERROR: $errorMsg" -LogFile $userLogFile
                Set-ServiceStatus -IsRunning $false -FilesCreated $filesCreated -FilesRolled $filesRolled -ErrorMessage $errorMsg
                break
            }

            $filesCreated++

            # Add current file to history
            $fileHistory += @{
                Number = $fileNumber
                Path = $traceFile
                Name = $fileName
            }

            # Update service status
            Set-ServiceStatus -IsRunning $true -FilesCreated $filesCreated -FilesRolled $filesRolled -CurrentFile $fileName

            Write-ServiceLog "Monitoring file size (limit: $MaxSizeMB MB)..."
            Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - Monitoring file size (limit: $MaxSizeMB MB)..." -LogFile $userLogFile

            # Monitor file size until limit is reached
            $fileRotated = $false
            while (-not $fileRotated -and -not (Test-Path $ServiceStopFlag)) {
                Start-Sleep -Seconds 2

                if (Test-Path $traceFile) {
                    $fileSize = (Get-Item $traceFile).Length
                    $sizeMB = [math]::Round($fileSize/1MB, 2)

                    Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - File: $fileName - Size: $sizeMB MB / $MaxSizeMB MB" -LogFile $userLogFile

                    if ($fileSize -ge $maxSizeBytes) {
                        Write-ServiceLog "Size limit reached for $fileName. Rolling to new file..."
                        Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - Size limit reached! Rolling to new file..." -LogFile $userLogFile

                        # Stop current trace
                        $stopOutput = & netsh trace stop 2>&1
                        $stopExitCode = $LASTEXITCODE

                        # Log stop output if requested
                        if ($LogOutput) {
                            $netshLogFile = Join-Path $TracePath "netsh_trace.log"
                            "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - STOP TRACE (WINDOWS SERVICE):" | Out-File -FilePath $netshLogFile -Append -Encoding UTF8
                            $stopOutput | Out-File -FilePath $netshLogFile -Append -Encoding UTF8
                            "" | Out-File -FilePath $netshLogFile -Append -Encoding UTF8
                        }

                        Write-ServiceLog "Trace stopped for file: $fileName (Exit Code: $stopExitCode)"
                        Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - Trace stopped for file: $fileName" -LogFile $userLogFile

                        if ($stopExitCode -eq 0) {
                            $filesRolled++
                            $fileRotated = $true
                            $fileNumber++

                            # Circular file management
                            if ($fileHistory.Count -gt $MaxFiles) {
                                $oldestFile = $fileHistory[0]
                                if (Test-Path $oldestFile.Path) {
                                    Remove-Item $oldestFile.Path -Force -ErrorAction SilentlyContinue
                                    Write-ServiceLog "Removed oldest file: $($oldestFile.Name)"
                                    Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - Removed oldest file: $($oldestFile.Name)" -LogFile $userLogFile
                                }
                                $fileHistory = $fileHistory[1..($fileHistory.Count-1)]
                            }

                            # Update service status
                            Set-ServiceStatus -IsRunning $true -FilesCreated $filesCreated -FilesRolled $filesRolled -CurrentFile ""
                        } else {
                            $errorMsg = "Failed to stop trace. Exit code: $stopExitCode"
                            Write-ServiceLog $errorMsg "ERROR"
                            Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - ERROR: $errorMsg" -LogFile $userLogFile
                            Set-ServiceStatus -IsRunning $false -FilesCreated $filesCreated -FilesRolled $filesRolled -ErrorMessage $errorMsg
                            break
                        }
                    }
                } else {
                    $errorMsg = "Trace file not found: $traceFile"
                    Write-ServiceLog $errorMsg "ERROR"
                    Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - ERROR: $errorMsg" -LogFile $userLogFile
                    Set-ServiceStatus -IsRunning $false -FilesCreated $filesCreated -FilesRolled $filesRolled -ErrorMessage $errorMsg
                    break
                }
            }
        } catch {
            $errorMsg = "Service monitoring error: $($_.Exception.Message)"
            Write-ServiceLog $errorMsg "ERROR"
            Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - ERROR: $errorMsg" -LogFile $userLogFile
            Set-ServiceStatus -IsRunning $false -FilesCreated $filesCreated -FilesRolled $filesRolled -ErrorMessage $errorMsg
            break
        }
    }

    # Cleanup when service stops
    Write-ServiceLog "Service monitoring stopped. Cleaning up..."
    Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - Service monitoring stopped" -LogFile $userLogFile
    Write-ToUserLog -Message "$(Get-Date -Format 'HH:mm:ss') - SUMMARY: Files created: $filesCreated, Files rolled: $filesRolled" -LogFile $userLogFile
    Write-ToUserLog -Message ("=" * 60) -LogFile $userLogFile

    & netsh trace stop 2>&1 | Out-Null
    Set-ServiceStatus -IsRunning $false -FilesCreated $filesCreated -FilesRolled $filesRolled -CurrentFile ""

    # Remove stop flag
    if (Test-Path $ServiceStopFlag) {
        Remove-Item $ServiceStopFlag -Force -ErrorAction SilentlyContinue
    }
    }
}

# Service control functions (NEW: No longer uses jobs)
function Start-NetTraceService {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [string]$Path,
        [int]$MaxFiles,
        [int]$MaxSizeMB,
        [bool]$LogOutput = $false,
        [bool]$EnableLogging = $false
    )

    if ($PSCmdlet.ShouldProcess("NetTrace Service", "Start service")) {
        Write-ServiceLog "Service start requested: Path=$Path, MaxFiles=$MaxFiles, MaxSizeMB=$MaxSizeMB"

        # Check if service is already running
        $currentStatus = Get-ServiceStatus
        if ($currentStatus.IsRunning) {
            Write-ServiceLog "Service is already running" "WARNING"
            return $false
        }

        # Remove any existing stop flag
        if (Test-Path $ServiceStopFlag) {
            Remove-Item $ServiceStopFlag -Force -ErrorAction SilentlyContinue
        }

        # Save configuration for service to read
        if (-not (Set-ServiceConfig -Path $Path -MaxFiles $MaxFiles -MaxSizeMB $MaxSizeMB -LogOutput $LogOutput -EnableLogging $EnableLogging)) {
            Write-ServiceLog "Failed to save service configuration" "ERROR"
            return $false
        }

        Write-ServiceLog "Service configuration saved. Ready for Windows Service to start."
        return $true
    }
    return $false
}

function Stop-NetTraceService {
    [CmdletBinding(SupportsShouldProcess)]
    param()

    if ($PSCmdlet.ShouldProcess("NetTrace Service", "Stop service")) {
        Write-ServiceLog "Service stop requested"

        # Create stop flag to signal service to stop
        try {
            "stop" | Out-File -FilePath $ServiceStopFlag -Force
            Write-ServiceLog "Service stop flag created"
        } catch {
            Write-ServiceLog "Failed to create service stop flag: $($_.Exception.Message)" "ERROR"
        }

        # Stop any running netsh trace
        & netsh trace stop 2>&1 | Out-Null
        Write-ServiceLog "Netsh trace stopped"

        # Update status
        $currentStatus = Get-ServiceStatus
        Set-ServiceStatus -IsRunning $false -FilesCreated $currentStatus.FilesCreated -FilesRolled $currentStatus.FilesRolled

        Write-ServiceLog "Service stopped successfully"
        return $true
    }
    return $false
}

# Service mode execution
if ($ServiceMode) {
    Write-ServiceLog "Starting in Windows Service Mode"

    # Read configuration
    $config = Get-ServiceConfig
    if (-not $config) {
        Write-ServiceLog "No service configuration found" "ERROR"
        exit 1
    }

    Write-ServiceLog "Service configuration loaded: Path=$($config.Path), MaxFiles=$($config.MaxFiles), MaxSizeMB=$($config.MaxSizeMB)"

    # Start direct monitoring (no jobs)
    try {
        Start-DirectServiceMonitoring -TracePath $config.Path -MaxFiles $config.MaxFiles -MaxSizeMB $config.MaxSizeMB -LogOutput $config.LogOutput -EnableLogging $config.EnableLogging
    } catch {
        Write-ServiceLog "Service monitoring failed: $($_.Exception.Message)" "ERROR"
        exit 1
    }

    Write-ServiceLog "Service mode execution completed"
    exit 0
}

# Export functions for use by other scripts
Export-ModuleMember -Function Start-NetTraceService, Stop-NetTraceService, Get-ServiceStatus, Get-ServiceConfig, Write-ServiceLog

# If script is run directly without service mode, provide guidance
if ($MyInvocation.InvocationName -eq $MyInvocation.MyCommand.Name) {
    Write-Information "NetTrace Service Script v1.2.2" -InformationAction Continue
    Write-Information "This script now implements a true Windows Service using NSSM." -InformationAction Continue
    Write-Information "This script should be used through NetTrace-ServiceRunner.ps1 for proper service management." -InformationAction Continue
    Write-Information "Direct execution without -ServiceMode is not recommended." -InformationAction Continue
}