I occasionally notice in Resource Monitor hard disk activity related to ETL files in the folder C:\Windows\System32\LogFiles\WMI\RtBackup.

Which process/service creates these ETL files and what is their purpose?

Resource Monitor shows "System" as the process which is correct since ETW traces (that is what ETL files are) are created by the kernel. But I am interested in the process that causes the traces to be created.

This happens on Windows 7, by the way.


I found the answer myself after digging around some more.

The directory C:\Windows\System32\LogFiles\WMI\RtBackup stores ETW trace files (extension .etl) for real time event trace sessions. Looking into the RtBackup directory is a little difficult because by default only System has permissions, but my application SetACL Studio can display the contents anyway. When putting the directory's content next to the list of running event trace sessions, one immediately notices the similarities:

enter image description here

enter image description here

Not every event trace session generates a file in the directory RtBackup. As the directory's name implies, it stores backups for real time trace sessions. Comparing the list of files in RtBackup to each trace session's properties confirms this:

enter image description here

| improve this answer | |

I was hoping this would be an easy answer, but I guess I would have to force a read/write of the file or know when it is happening. In any event, this is what I tried hoping for a quick one-off. You will need the handle utility from SysInternals.

\path\to\handle.exe | find /i "etl"

Good luck and happy hunting.

| improve this answer | |
  • 1
    The ETL file is accessed by the kernel. That much I see in Resource Monitor. My question is who makes the kernel create the file in the first place? – Helge Klein Feb 20 '11 at 20:07
  • Ok. Possible technique to determine you answer. They are just backup files, so move (do not delete) to a separate location. Run Process Monitor. Create a filter on the file names, and look at the Kernel API calls and until they are created. Apparently you might need to get the debug symbols involved. I know this is not solid advice, but this is the best way I can think of. Sorry if it does not help too much. – songei2f Feb 21 '11 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.