Causal request traces are valuable to developers of large concurrent and distributed applications, yet difficult to obtain. Traces show how a request is processed, and can be analyzed by tools to detect performance or correctness errors and anomalous behavior. We present BorderPatrol, which obtains precise request traces through systems built from a litany of unmodified modules. Traced components include Apache, thttpd, PostgreSQL, TurboGears, BIND and notably Zeus, a closedsource event-driven web server. BorderPatrol obtains traces using active observation which carefully modifies the event stream observed by modules, simplifying precise observation. Protocol processors leverage knowledge about standard protocols, avoiding application-specific instrumentation. BorderPatrol obtains precise traces for black-box systems that cannot be traced by any other technique. We confirm the accuracy of BorderPatrol’s traces by comparing to manual instrumentation, and compare the developer e...