Tracerpt

  • Article

 

Applies To: Windows Server 2003, Windows Vista, Windows XP, Windows Server 2008, Windows 7, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2000, Windows Server 2012, Windows 8

The tracerpt command can be used to parse Event Trace Logs, log files generated by Performance Monitor, and real-time Event Trace providers. It generates dump files, report files, and report schemas.

For examples of how to use tracerpt, see Examples.

Syntax

tracerpt <[-l] <value [value [...]]>|-rt <session_name [session_name [...]]>> [options]

Options

Option flag

Description

-?

Displays context sensitive help.

-config <filename>

Load a settings file containing command options.

-y

Answer yes to all questions without prompting.

-f <XML | HTML>

Define report format.

-of <CSV | EVTX | XML>

Define dump format. Default is XML.

-df <filename>

Create a Microsoft-specific counting/reporting schema file.

-int <filename>

Dump the interpreted event structure to the specified file.

-rts

Report raw timestamp in the event trace header. Can only be used with -o, not -report or -summary.

-tmf <filename>

Specify a Trace Message Format definition file.

-tp <value>

Specify the TMF file search path. Multiple paths may be used, separated by a semicolon (;).

-i <value>

Specify the provider image path. The matching PDB will be located in the Symbol Server. Multiple paths can be used, separated by a semicolon (;).

-pdb <value>

Specify the symbol server path. Multiple paths can be used, separated by a semicolon (;).

-gmt

Convert WPP payload timestamps to Greenwich Mean Time.

-rl <value>

Define System Report Level from 1 to 5. Default is 1.

-summary [filename]

Generate a summary report text file. Filename if not specified is summary.txt.

-o [filename]

Generate a text output file. Filename if not specified is dumpfile.xml.

-report [filename]

Generate a text output report file. Filename if not specified is workload.xml.

-lr

Specify "less restrictive." This uses best efforts for events that do not match the events schema.

-export [filename]

Generate an Event Schema export file. Filename if not specified is schema.man.

[-l] <value [value […]]>

Specify the Event Trace log file to process.

-rt <session_name [session_name […]]>

Specify Real-time Event Trace Session data sources.

Examples

  • This example creates a report based on the two event logs logfile1.etl and logfile2.etl and creates the dump file logdump.xml in XML format.

    tracerpt logfile1.etl logfile2.etl -o logdump.xml -of XML

  • This example creates a report based on the event log logfile.etl, creates the dump file logdmp.xml in XML format, uses best efforts to identify events not in the schema, produces a summary report file logdump.txt, and produces the report file logrpt.xml.

    tracerpt logfile.etl -o logdmp.xml -of XML -lr -summary logdmp.txt -report logrpt.xml

  • This example uses the two event logs logfile1.etl and logfile2.etl to produce a dump file and report file with the default filenames.

    tracerpt logfile1.etl logfile2.etl -o -report

  • This example uses the event log logfile.etl and the performance log counterfile.blg to produce the report file logrpt.xml and the Microsoft-specific XML schema file schema.xml.

    tracerpt logfile.etl counterfile.blg -report logrpt.xml -df schema.xml

  • This example reads the real-time Event Trace Session "NT Kernel Logger" and produces the dump file logfile.csv in CSV format.

    tracerpt -rt "NT Kernel Logger" -o logfile.csv -of CSV