The C:\Windows\Logs directory has tons of useful information in it, but it’s all in the obscure ETL file format. What’s an ETL file, why did Microsoft switch to this format, and how do you open the file to read it?
ETL stands for Event Trace Log, and they contain information from kernel events generated by Tracelog. Windows uses them because they are more efficient than logging in plaintext, and you can open ETL files in Event Viewer, but it’s also possible to convert them into XML, CSV, or plaintext for troubleshooting.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.