Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I occasionally notice in Resource Monitor hard disk activity related to ETL files in the folder C:\Windows\System32\LogFiles\WMI\RtBackup.

Which process/service creates these ETL files and what is their purpose?

Resource Monitor shows "System" as the process which is correct since ETW traces (that is what ETL files are) are created by the kernel. But I am interested in the process that causes the traces to be created.

This happens on Windows 7, by the way.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

I found the answer myself after digging around some more.

The directory C:\Windows\System32\LogFiles\WMI\RtBackup stores ETW trace files (extension .etl) for real time event trace sessions. Looking into the RtBackup directory is a little difficult because by default only System has permissions, but my application SetACL Studio can display the contents anyway. When putting the directory's content next to the list of running event trace sessions, one immediately notices the similarities:

enter image description here

enter image description here

Not every event trace session generates a file in the directory RtBackup. As the directory's name implies, it stores backups for real time trace sessions. Comparing the list of files in RtBackup to each trace session's properties confirms this:

enter image description here

share|improve this answer
add comment

I was hoping this would be an easy answer, but I guess I would have to force a read/write of the file or know when it is happening. In any event, this is what I tried hoping for a quick one-off. You will need the handle utility from SysInternals.

\path\to\handle.exe | find /i "etl"

Good luck and happy hunting.

share|improve this answer
1  
The ETL file is accessed by the kernel. That much I see in Resource Monitor. My question is who makes the kernel create the file in the first place? –  Helge Klein Feb 20 '11 at 20:07
    
Ok. Possible technique to determine you answer. They are just backup files, so move (do not delete) to a separate location. Run Process Monitor. Create a filter on the file names, and look at the Kernel API calls and until they are created. Apparently you might need to get the debug symbols involved‌​. I know this is not solid advice, but this is the best way I can think of. Sorry if it does not help too much. –  ajstein Feb 21 '11 at 18:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.