.etl · application/x-etl
What is a .etl file?
Event Trace Log
About the format
An .etl file is an Event Trace Log — the high-volume, binary output of Event Tracing for Windows (ETW), the instrumentation system underneath Performance Monitor, Windows Performance Recorder, boot tracing, Windows Update logs and much of the OS's own diagnostics. Unlike .evtx logs, which store discrete administrative events, .etl files are dense streams: thousands of events per second from kernel and application providers, designed for performance analysis rather than casual reading. You'll find them scattered through C:\Windows (boot traces, WindowsUpdate logs before conversion, DirectX diagnostics) and produced deliberately by troubleshooting sessions. The natural consumer is Windows Performance Analyzer (WPA), which turns a trace into interactive CPU, disk, and wait-analysis graphs; tracerpt can convert one to XML/CSV on any Windows machine. If a support engineer asked you to 'capture an ETL', WPR (wprui) records one; if you found a big one on disk, it's almost certainly a leftover diagnostic trace and safe to delete.
How to open a .etl file
Windows
- Windows Performance Analyzer (WPA)
- tracerpt (built in)
- PerfView (Microsoft, free)
macOS
- no native tools — convert on Windows first
Linux
- no native tools — convert on Windows first
Is a .etl file dangerous?
No — it's trace data. Traces can include file paths and process names from the capture period.
Related file types
Not sure what a file is? Check its bytes.
File names lie; magic numbers don't. Drop any file into the identifier — nothing is uploaded.
Identify a file →