.ETL File Format – Event headers

Telling headers apart

Read the first four bytes of an event. The byte at offset 3 has its top bit set in every trace header; for the header types below its top two bits are set, so it is 0xC0. The byte at offset 2 is the header type. Events are aligned on 8-byte boundaries, so a reader rounds each event’s size up to a multiple of 8 to find the next one.

“32-bit” and “64-bit” describe the event data, not the header: a 32-bit provider on 64-bit Windows writes 32-bit data, with 4-byte pointers, and a reader must know which to decode it.

System header

SYSTEM_TRACE_HEADER, used by the kernel’s own events (processes, threads, disk, network, and so on). 0x20 bytes; the compact form stops after SystemTime, at 0x18.

The meanings of the many group and type values (the hook IDs) are only partly published; Microsoft’s Kernel Trace classes name some of them.

Performance header

PERFINFO_TRACE_HEADER, used for the kernel’s high-rate performance events such as context switches. The event data starts at 0x10.

Geoff Chappell’s notes give the structure’s size as 0x18 bytes in one place but put the data at 0x10; the offsets above follow the layout.

Classic header

EVENT_TRACE_HEADER, documented in the Windows SDK, used by classic (MOF) providers. 0x30 bytes.

Modern header

EVENT_HEADER, documented in the Windows SDK, used by manifest-based and TraceLogging providers since Windows Vista. 0x50 bytes.

Flags

Event descriptor

EVENT_DESCRIPTOR, 16 bytes, identifies the event within its provider’s manifest.

Microsoft does not publish how the extended data items that follow an EVENT_HEADER are stored in a buffer when flag 0x0001 is set. Airbus CERT’s etl-parser (etl/event.py) reads them as a run of items, each aligned to 8 bytes, until one has bit 0 of its third field clear:

The event’s own data follows the last item. This layout is etl-parser’s reading, not a published one.