tools/metrics/histograms/histograms.xml

Index: tools/metrics/histograms/histograms.xml
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 6c89c0a9380ff3b2fc00705b4a0a6b48ca42e2df..577b1e9e5d14a3ff85e5bb4e1a2f9dc7cc856478 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -2998,6 +2998,156 @@ http://cs/file:chrome/histograms.xml - but prefer this file for new entries.
   </summary>
 </histogram>
 
+<histogram name="AuthPolicy.ErrorTypeOfAuthenticateUser"
+    enum="AuthPolicyErrorType">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Result from an attempt to authenticate a user to an Active Directory domain.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.ErrorTypeOfJoinADDomain" enum="AuthPolicyErrorType">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Result from an attempt to join a machine to an Active Directory domain.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.ErrorTypeOfRefreshDevicePolicy"
+    enum="AuthPolicyErrorType">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Result from an attempt to fetch device policy from an Active Directory
+    domain and store it on disk.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.ErrorTypeOfRefreshUserPolicy"
+    enum="AuthPolicyErrorType">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Result from an attempt to fetch user policy from an Active Directory domain
+    and store it on disk.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.NumGposToDownload">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Number of group policy objects attached to a specific user or machine on an
+    Active Directory domain. This value is recorded while user or device policy

[Mark P, 2017/03/01 20:02:02]

nit: while -> when

+    is fetched from an Active Directory server.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToAuthenticateUser" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to authenticate a user to an Active Directory domain.
+    The value is recorded no matter if the operation was successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToJoinADDomain" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to join a machine to an Active Directory domain. Domain
+    join is part of the Active Directory enrollment process. The value is
+    recorded no matter if the operation was successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRefreshDevicePolicy" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to fetch device policy from an Active Directory domain
+    and store it on disk. The value is recorded no matter if the operation was
+    successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRefreshUserPolicy" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to fetch user policy from an Active Directory domain
+    and store it on disk. The value is recorded no matter if the operation was
+    successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRunKinit" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to call 'kinit' (request Kerberos ticket-granting-
+    ticket). TGTs are requested regularly for accessing services on Active
+    Directory domains. The value is recorded no matter if the operation was
+    successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRunNetAdsInfo" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to call 'net ads info' (query Active Directory
+    information). The value is recorded no matter if the operation was
+    successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRunNetAdsJoin" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to call 'net ads join' (join machine to an Active
+    Directory domain). The value is recorded no matter if the operation was
+    successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRunNetAdsSearch" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to call 'net ads search' (query information about an
+    Active Directory account). The value is recorded no matter if the operation
+    was successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRunNetAdsWorkgroup" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to call 'net ads workgroup' (query Active Directory
+    workgroup). The value is recorded no matter if the operation was successful
+    or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TimeToRunSmbclient" units="ms">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Time in milliseconds to call 'smbclient' (download policy from an Active
+    Directory domain). The value is recorded no matter if the operation was
+    successful or not.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TriesOfKinit">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Number of times 'kinit' was tried until it succeeded or gave up because a
+    maximum number of tries was exceeded. 'kinit' is run for Active Directory
+    enrolled devices during user authentication and device policy fetch.
+  </summary>
+</histogram>
+
+<histogram name="AuthPolicy.TriesOfSmbClient">
+  <owner>ljusten@chromium.org</owner>
+  <summary>
+    Number of times 'smbclient' was tried until it succeeded or gave up because
+    a maximum number of tries was exceeded. 'smbclient' is run for Active

[Mark P, 2017/03/01 20:02:02]

Yeah, I don't like that either.
I'd suggest two histograms, something like AuthPolicy.SmbClient.Result, which is
a boolean histogram recording whether the final result is a success or failure,
and AuthPolicy.TriesOfSmbClient.Success, which is a histogram like this that
records the number of tries but only emits on success.

The total number of emits to the latter histogram should be the number of
successes in the former.

ditto for kinit tries histogram

[ljusten (tachyonic), 2017/03/02 09:22:42]

There's a complication that we only retry in case of certain errors, but not for
all. Thus, you could fail even after 1 try and just recording failures would not
show us how many attempts it took. We're primarily interested whether we're
retrying often enough, so I believe the number of failed tries is the best stat
to record.

[Mark P, 2017/03/02 23:40:23]

Your new solution seems reasonable to me.

Make sure your logging code has the new correct logic and new histogram name!

+    Directory enrolled devices during policy fetch.
+  </summary>
+</histogram>
+
 <histogram name="Autocheckout.Bubble" enum="AutocheckoutBubble">
   <obsolete>
     Deprecated as of 8/2013.
@@ -80267,6 +80417,35 @@ http://cs/file:chrome/histograms.xml - but prefer this file for new entries.
   <int value="2" label="Processing in WebRTC"/>
 </enum>
 
+<enum name="AuthPolicyErrorType" type="int">
+  <int value="0" label="Success"/>
+  <int value="1" label="Unspecified error"/>
+  <int value="2" label="Unspecified D-Bus error"/>
+  <int value="3" label="Badly formatted user principal name"/>
+  <int value="4" label="Auth failed because of bad user name"/>
+  <int value="5" label="Auth failed because of bad password"/>
+  <int value="6" label="Auth failed because of expired password"/>
+  <int value="7" label="Auth failed because of bad realm or network"/>
+  <int value="8" label="kinit exited with unspecified error"/>
+  <int value="9" label="net exited with unspecified error"/>
+  <int value="10" label="smdclient exited with unspecified error"/>
+  <int value="11" label="authpolicy_parser exited with unknown error"/>
+  <int value="12" label="Parsing GPOs failed"/>
+  <int value="13" label="GPO data is bad"/>
+  <int value="14" label="Some local IO operation failed"/>
+  <int value="15" label="Machine is not joined to AD domain yet"/>
+  <int value="16" label="User is not logged in yet"/>
+  <int value="17" label="Failed to send policy to Session Manager"/>
+  <int value="18"
+      label="User doesn't have the right to join machines to the domain"/>
+  <int value="19" label="General network problem"/>
+  <int value="20" label="Machine name contains restricted characters"/>
+  <int value="21" label="Machine name too long"/>
+  <int value="22" label="User joined maximum number of machines to the domain"/>
+  <int value="23"
+      label="kinit or smbclient failed to contact Key Distribution Center"/>
+</enum>
+
 <enum name="AutocheckoutBubble" type="int">
   <obsolete>
     Deprecated as of 8/2013.