How to Read an ETL File

Microsoft Windows records application and system-level warnings, errors or other events to a binary file called the event trace log, or ETL, which can then be used to troubleshoot potential problems. Special viewers are required to parse the contents of an ETL file into useful information. Luckily, Microsoft Windows has two built-in programs that can do this. These programs are Tracerpt and the Event Viewer.

Event trace logs are stored under the "Panther" folder of the Windows directory on the computer's hard drive ("C:\Windows\Panther"). Other logs may be found in "C:\Windows\Logs."

Tracerpt is a command-line tool that parses the contents of an ETL file and saves it into a comma-delimited text or XML file which can be read in Excel or in any text editor. To access Tracerpt, open a command-line window. On Windows 8, swipe up to display the "Apps" screen, locate "Windows System" and tap on the "Command Prompt" icon. On Windows 7, go to "Start" and enter "CMD" in the "Search programs and files" box.

In the command window, enter the command "tracerpt FILENAME.etl -of " to dump the contents of a specific ETL file into a CSV file format. Enter "tracerpt FILENAME.etl -of " at the prompt to instead create an XML file.

The Event Viewer is a graphic-interface viewer native to Windows that can read application and system-generated event logs. To access the Event Viewer on Windows 8, simultaneously press the "Win" and "X" keys to bring up the "Power Task Menu" and select "Event Viewer." On Windows 7, click "Start" and then "Control Panel." Click "System and Security" and then select "View Event Logs."

Click on the arrows in the navigation pane under Event Viewer to expand the types of logs currently captured by the system (Windows or application logs), or click on "Open Saved Log" under the Actions" pane to locate a specific ETL file.