ETL file parsing using powershell script

Question

#Defining the etl file $etlFile = 'test.etl'

#Retrieving the content $log = Get-WinEvent -Path $etlFile –Oldest

Is there any other way of parsing .etl file to read etw events?

Answer 1

There is no built in command for reading an etl file with PowerShell but calling tracerpt.exe in windows\system32 for converting the etl file into xml (the file is always called dumpfile.xml) seems to be a simple solution:

tracerpt.exe .\WindowsUpdate.20220813.100210.641.1.etl -lr
([Xml](Get-Content .\dumpfile.xml)).Events
([Xml](Get-Content .\dumpfile.xml)).Events.Event
([Xml](Get-Content .\dumpfile.xml)).Events.Event.EventData
([Xml](Get-Content .\dumpfile.xml)).Events.Event.EventData.Data
etc.

See also Converting ETL to XML in powershell using traceprt, issues with dashes and spaces in arguments