Tracking "Windows Search" Queries

Question

I can enable logging for Windows Search through the registry (see below), but this only captures queries sent through the default user-interface for Windows Search. I want to capture queries used by Outlook 2003, Outlook 2007, OneNote 2007 or any other application that accesses the SystemIndex.

HKEY_CURRENT_USER\Software\Microsoft\Windows Desktop Search\DS\WriteLog[DWORD]0|1

What I want to do is analyze these queries in order get a better understanding on how to build queries for my personal search utility (WinForms/WPF/ADO.NET/OleDb) that I use to search my code library (physical file system).

How would I track any and all queries performed on the SystemIndex of Windows Search?

Answer 1

If you really want to capture all accesses to the SystemIndex, that would be quite the tall order, as there are multiple ways it can be accessed:

• Using SQL and AQS Approaches to Query the Index
• Querying the Index with ISearchQueryHelper
• Querying the Index with the search-ms Protocol
• Querying the Index with Windows Search SQL Syntax
• Using Advanced Query Syntax Programmatically

If we ignore that for a bit and focus on your other goal:

What I want to do is analyze these queries in order get a better understanding on how to build queries for my personal search utility

Then I would look into the ISearchQueryHelper Interface.

ISearchQueryHelper Interface

Provides methods for building a query from user input, converting a query to Windows Search SQL, and obtaining a connection string to initialize a connection to the Window Search index.

One method of that interface is GenerateSQLFromUserQuery, which may help you out.

GenerateSQLFromUserQuery

Generates a Structured Query Language (SQL) query based on a client-supplied query string expressed in either Advanced Query Syntax (AQS) or Natural Query Syntax (NQS).

Answer 2

The system index is implemented as an OLE DB source. You can find out the data source from the connection string provided by ISearchQueryHelper::get_ConnectionString. I've been looking for a way to monitor an OLE DB source, but turned up nothing so far.

The OLE DB boils down to the Extensible Storage Engine (ESE) file named Windows.edb that exists, by default, in the \All Users\Application Data\Microsoft\Search\Data\Applications\Windows\ profile folder.

All ESE files are managed by ESENT.DLL. It may be possible to hook this DLL and trace queries. Hooking and logging is possible with programs such as with StraceNT, and xptruss

After a couple of hours searching, there doesn't appear to be any simpler way to get a log of all Windows Search queries. Since learning the query syntax is your goal, it may be simpler to look elsewhere for learning aids, such as using the default Windows Search UI and using the query log that you know about already. It may also be helpful to experiement with converting ADS and NDS queries to SQL using the ISearchQueryHelper interface.