.ETL File Format

Introduction

An ETL file is a trace recorded by Event Tracing for Windows (ETW), the tracing system built into Windows. Parts of Windows, drivers and applications act as providers that send events, and a trace session writes the events of the providers it has enabled to an .etl file.

ETL files are made for performance analysis with the Windows Performance Recorder, for diagnostics, and for network capture: netsh trace start capture=yes records the packets crossing the network adapters into an ETL file. Windows also keeps some of its own logs this way, such as the logs of Windows Update.

Structure

An ETL file is binary and is written as a series of fixed-size buffers, each filled with event records by the trace session and flushed to disk as it fills. Each event carries the provider that sent it, an event ID, a timestamp, the process and thread, and the event’s data. The data is not self-describing: to decode it, a reader needs the provider’s manifest or other metadata, which tools such as Windows Performance Analyzer look up on the machine or in symbol files. Microsoft does not publish a full description of the file layout.

Links