Is there a way to analyze sevral .etl trace files?

nachoarmaniii · 2019-07-02T07:12:29.000Z

I want a script that will analyze several .etl trace files generated from running Windows Performance Recorder and filtering or narrowing the result of this analysis down to the top 10 running processes with high CPU usgae. Any help will be much appreciated!

Also, I’ve been looking online but haven’t found anything yet. What other formats can .etl files be converted to?

Thank you all in advance

@gregory-for-microsoft

patrickdeno2 · 2019-07-02T11:17:16.000Z

Please read before posting.

We are not a script writing service. We’ll be glad to help you debug your code or to give you a snippet or two to help you past a rough patch. But we do expect you to have something already started and to participate in the development. So, with that in mind, what have you already tried?

Also, if you’re going to post code, please use the “Insert Code” button to do so.

Evan7191 · 2019-07-02T11:17:32.000Z

What have you tried so far? We can help with an existing script, but we do not write scripts from scratch on demand.

patrickdeno2 · 2019-07-02T12:26:01.000Z

About a minute and a half of Google-Binging told me that what you’re asking for may be a little more complex than you realize. A better tool might be Microsoft Network Monitor 3.4 (archive)

Tutorial: Using Network Monitor to View ETL Files

“Network Monitor 3.3 enables users to parse, filter, and view an ETL file (using Windows Vista or later).”

nachoarmaniii · 2019-07-02T12:45:05.000Z

This is what I have done so far but it hasn't worked. I am trying to see if I could merger all the .etl files I have just like one could decide to merge all .csv files

$getFirstLine = $true

get-childItem "C:\WPR_FILES\*.etl" | foreach {
    $filePath = $_

    $lines = Get-Content $filePath  
    $linesToWrite = switch($getFirstLine) {
           $true  {$lines}
           $false {$lines | Select -Skip 1}

    }

    $getFirstLine = $false
    Add-Content "C:\New folder" $linesToWrite
    }

@techadmin8 @patrickdeno2

Evan7191 · 2019-07-02T13:36:43.000Z

Thelegendary:

This is what I have done so far but it hasn't worked. I am trying to see if I could merger all the .etl files I have just like one could decide to merge all .csv files

$getFirstLine = $true

get-childItem "C:\WPR_FILES\*.etl" | foreach {
    $filePath = $_

    $lines = Get-Content $filePath  
    $linesToWrite = switch($getFirstLine) {
           $true  {$lines}
           $false {$lines | Select -Skip 1}

    }

    $getFirstLine = $false
    Add-Content "C:\New folder" $linesToWrite
    }

Have you tried something like this?

get-childItem "C:\WPR_FILES\*.etl" | Get-Content | Add-Content "C:\New folder\newfile.etl"

nachoarmaniii · 2019-07-03T04:49:19.000Z

Hi Evan, I tried that already but everytime I try to open the supposed merged file created, I get a "…etl file could not be successfully opened [0x80070570]

Aborting operation

Evan7191 · 2019-07-03T11:26:18.000Z

Thelegendary:

Hi Evan, I tried that already but everytime I try to open the supposed merged file created, I get a "…etl file could not be successfully opened [0x80070570]

Aborting operation

That error means that the file is corrupt. I think you have your answer: combining ETL files will corrupt them.

GillieHammer’s suggestion of Network Monitor is probably your best option.

nachoarmaniii · 2019-07-03T11:48:42.000Z

So after all my research, I found out that .etl files cannot be merged. Not with the above commands. Merging the files will break the Data Structure of .etl files. The commands above can however be used to successfully merge other file types such as .txt or .csv

Thanks to everyone that contributed