{"id":10028,"date":"2025-04-22T22:33:00","date_gmt":"2025-04-22T20:33:00","guid":{"rendered":"https:\/\/michlstechblog.info\/blog\/?p=10028"},"modified":"2025-04-23T09:35:06","modified_gmt":"2025-04-23T07:35:06","slug":"windows-convert-an-etl-event-tracing-file-into-a-human-readable-format","status":"publish","type":"post","link":"https:\/\/michlstechblog.info\/blog\/windows-convert-an-etl-event-tracing-file-into-a-human-readable-format\/","title":{"rendered":"Windows: Convert an ETL (Event tracing file) into a human readable format"},"content":{"rendered":"<div class=\"twoclick_social_bookmarks_post_10028 social_share_privacy clearfix 1.6.4 locale-en_US sprite-en_US\"><\/div><div class=\"twoclick-js\"><script type=\"text\/javascript\">\/* <![CDATA[ *\/\njQuery(document).ready(function($){if($('.twoclick_social_bookmarks_post_10028')){$('.twoclick_social_bookmarks_post_10028').socialSharePrivacy({\"services\":{\"flattr\":{\"uid\":\"Michl\",\"status\":\"on\",\"the_title\":\"Windows%3A%20Convert%20an%20ETL%20%28Event%20tracing%20file%29%20into%20a%20human%20readable%20format\",\"the_excerpt\":\"Hi%2C%0D%0A%0D%0Aevent%20tracing%20files%2C%20for%20example%20produced%20by%20wusa.exe%20log%20parameter%2C%20are%20binary%20files.%20The%20powershell%20command%20let%20Get-WinEvent%20couldn%27t%20open%20it%20but%20Windows%20Eventviewer%20is%20able%20to%20read%20those%20files.%0D%0AThere%20is%20also%20an%20option%20to%20convert%20ETL%20files.%0D%0A%20%28more%26hellip%3B%29\",\"txt_info\":\"2 clicks for more data protection:\\r\\n\\r\\nOnly when you click here, the button will be come active and you can send your recommendation to Flattr. When activating, data are transmitted to third parties. \",\"perma_option\":\"off\"}},\"txt_help\":\"When you activate these fields by clicking, information to Flattr may be transferred abroad, and probably may also stored there.\",\"settings_perma\":\"Enable permanently and accept data transmission. \",\"info_link\":\"http:\\\/\\\/www.heise.de\\\/ct\\\/artikel\\\/2-Klicks-fuer-mehr-Datenschutz-1333879.html\",\"uri\":\"https:\\\/\\\/michlstechblog.info\\\/blog\\\/windows-convert-an-etl-event-tracing-file-into-a-human-readable-format\\\/\",\"post_id\":10028,\"post_title_referrer_track\":\"Windows%3A+Convert+an+ETL+%28Event+tracing+file%29+into+a+human+readable+format\",\"display_infobox\":\"on\"});}});\n\/* ]]> *\/<\/script><\/div><p>Hi,<\/p>\n<p>event tracing files, for example produced by wusa.exe log parameter, are binary files. The powershell command let Get-WinEvent couldn&#8217;t open it but Windows Eventviewer is able to read those files.<br \/>\nThere is also an option to convert ETL files.<br \/>\n<!--more--><\/p>\n<p>The command line utility<strong> tracerpt.exe<\/strong> could convert it in different formats:<br \/>\n&#8211; CSV<br \/>\n&#8211; Evtx (Eventlog format, then Get-WinEvent can read this)<br \/>\n&#8211; XML<\/p>\n<p>This converts a ETL file into a csv file <\/p>\n<pre class=\"brush: powershell; title: ; notranslate\" title=\"\">\r\nPS D:\\&gt; tracerpt.exe kb5055518.log.etl -of csv -o kb5055518.csv\r\n<\/pre>\n<p>or to an evtx file<\/p>\n<pre class=\"brush: powershell; title: ; notranslate\" title=\"\">\r\nPS D:\\&gt; tracerpt.exe kb5055518.log.etl -of evtx -o kb5055518.evtx\r\nPS D:\\&gt; Get-WinEvent -Path kb5055518.evtx\r\n<\/pre>\n<p>Michael<\/p>\n<p><!--https:\/\/serverfault.com\/questions\/1053521\/how-to-download-tmf-files-for-tracefmt-from-microsoft-symbol-server--><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi, event tracing files, for example produced by wusa.exe log parameter, are binary files. The powershell command let Get-WinEvent couldn&#8217;t open it but Windows Eventviewer is able to read those files. There is also an option to convert ETL files.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[450,2077,2078,20],"class_list":["post-10028","post","type-post","status-publish","format-standard","hentry","category-windowsknowhow","tag-convert","tag-etl","tag-readable","tag-windows-2"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/10028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/comments?post=10028"}],"version-history":[{"count":1,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/10028\/revisions"}],"predecessor-version":[{"id":10029,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/posts\/10028\/revisions\/10029"}],"wp:attachment":[{"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/media?parent=10028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/categories?post=10028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michlstechblog.info\/blog\/wp-json\/wp\/v2\/tags?post=10028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}