Windows Enterprise Desktop

May 13 2019   6:31PM GMT

Examining Windows 10 ETL files

Ed Tittel Ed Tittel Profile: Ed Tittel

Tags:
Event logs
Log files
Windows 10

An interesting post popped up on TenForums this morning. Entitled “SSD is 50% Consumed with ETL files,” it requests help in separating keepers from losers. It also asks for guidance on getting rid of unnecessary ETL files. To begin with, ETL stands for Event Trace Log. It is a binary file format that captures log info from a wide range of built-in Windows tools and diagnostic utilities. Windows 10 usually keeps a lot of them around. Using Voidtools Everything, I found ETL file counts of between 700 and 2,000 on my various Win10 machines. When it comes to examining Windows 10 ETL files — and perhaps even deleting some of them — I offer some tips to ponder. But first, here’s what Everything says about ETL files on my production PC, where it finds just over 800 in residence:

Examining Windows 10 ETL files.bysize

If you rank them by size, you’ll see most ETL files are at or under 2K in size. Deleting big ones gets the best bang for your buck!
[Click image for full-sized view.]

Tips When Examining Windows 10 ETL files

Here’s a short list of rules to live by when deciding the fate of ETL files:

  1. You don’t have to keep ETL files around. If you have a lot of them, you may have an interesting time figuring out where logging got turned on (and what should be turned off).
  2. Most ETL files are protected or live in protected directories. Run Explorer (or Everything) as Administrator, and you’ll be able to kill almost all of them. If all else fails, boot to alternate media and kill ’em from the command line there.
  3. I like to rank ETL files by size. Most are small, a very few can be quite large (I’m showing 2 in my screencap of about 1 GB in size). You get more space back by killing 1 big one than 500 small ones, in my case.
  4. If any ETL files are older than a week or two, or predate your most recent feature upgrade, you probably won’t get any use out of them anyway. They can go!
  5. If in doubt (and I’ve never been in a situation where I needed or wanted to recover a deleted ETL file), back them up before you delete them on your Windows drive.

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: