How to Read an ETL File
Microsoft Windows records application and system-level warnings, errors or other events to a binary file called the event trace log, or ETL, which can then be used to troubleshoot potential problems. Special viewers are required to parse the contents of an ETL file into useful information. Luckily, Microsoft Windows has two built-in programs that can do this. These programs are Tracerpt and the Event Viewer.
ETL File Location
Event trace logs are stored under the "Panther" folder of the Windows directory on the computer's hard drive ("C:\Windows\Panther"). Other logs may be found in "C:\Windows\Logs."
Tracerpt is a command-line tool that parses the contents of an ETL file and saves it into a comma-delimited text or XML file which can be read in Excel or in any text editor. To access Tracerpt, open a command-line window. On Windows 8, swipe up to display the "Apps" screen, locate "Windows System" and tap on the "Command Prompt" icon. On Windows 7, go to "Start" and enter "CMD" in the "Search programs and files" box. In the command window, enter the command "tracerpt FILENAME.etl -of
Microsoft Event Viewer
The Event Viewer is a graphic-interface viewer native to Windows that can read application and system-generated event logs. To access the Event Viewer on Windows 8, simultaneously press the "Win" and "X" keys to bring up the "Power Task Menu" and select "Event Viewer." On Windows 7, click "Start" and then "Control Panel." Click "System and Security" and then select "View Event Logs." Click on the arrows in the navigation pane under Event Viewer to expand the types of logs currently captured by the system (Windows or application logs), or click on "Open Saved Log" under the Actions" pane to locate a specific ETL file.
References & Resources
- Microsoft: Windows: What Information Appears In Event Logs? (Event Viewer)
- Microsoft Technet: Windows Server: Tracerpt
- Microsoft MSDN: WIndows: Trace Log
- Microsoft: Windows XP Professional Documentation: Tracerpt
- The Windows Club: Use Event Viewer In Windows to Check Unauthorized Use of Windows 8 | Windows 7 Computer
- Microsoft Technet: Windows: Windows Setup Log Files and Event Logs