18

I occasionally notice in Resource Monitor hard disk activity related to ETL files in the folder C:\Windows\System32\LogFiles\WMI\RtBackup.

Which process/service creates these ETL files and what is their purpose?

Resource Monitor shows "System" as the process which is correct since ETW traces (that is what ETL files are) are created by the kernel. But I am interested in the process that causes the traces to be created.

This happens on Windows 7, by the way.

Helge Klein
  • 2,031
  • 1
  • 15
  • 22

2 Answers2

11

I found the answer myself after digging around some more.

The directory C:\Windows\System32\LogFiles\WMI\RtBackup stores ETW trace files (extension .etl) for real time event trace sessions. Looking into the RtBackup directory is a little difficult because by default only System has permissions, but my application SetACL Studio can display the contents anyway. When putting the directory's content next to the list of running event trace sessions, one immediately notices the similarities:

enter image description here

enter image description here

Not every event trace session generates a file in the directory RtBackup. As the directory's name implies, it stores backups for real time trace sessions. Comparing the list of files in RtBackup to each trace session's properties confirms this:

enter image description here

Helge Klein
  • 2,031
  • 1
  • 15
  • 22
2

I was hoping this would be an easy answer, but I guess I would have to force a read/write of the file or know when it is happening. In any event, this is what I tried hoping for a quick one-off. You will need the handle utility from SysInternals.

\path\to\handle.exe | find /i "etl"

Good luck and happy hunting.

songei2f
  • 1,924
  • 1
  • 20
  • 30
  • 1
    The ETL file is accessed by the kernel. That much I see in Resource Monitor. My question is who makes the kernel create the file in the first place? – Helge Klein Feb 20 '11 at 20:07
  • Ok. Possible technique to determine you answer. They are just backup files, so move (*do not delete*) to a separate location. Run [Process Monitor](http://technet.microsoft.com/en-us/sysinternals/bb896645). Create a filter on the file names, and look at the Kernel API calls and until they are created. Apparently you might need to get [the debug symbols involved](http://natesstuff.spaces.live.com/Blog/cns!927B27E35FC3B535!426.entry). I know this is not solid advice, but this is the best way I can think of. Sorry if it does not help too much. – songei2f Feb 21 '11 at 18:07