Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. LogFiles
  5. WMI
FolderRisk: Caution

WMI C:\Windows\System32\LogFiles\WMI

ETW trace files (.etl) written by Windows AutoLogger sessions (boot traces, diagnostics); binary.

Updated on By AltF4 Formation

What it’s for

LogFiles\WMI receives the .etl trace files of Event Tracing for Windows (ETW) produced by AutoLogger sessions: trace sessions declared in the registry that start very early at boot and write to an .etl file. Despite the folder name, these are not WMI service logs, which go to C:\Windows\System32\wbem\Logs.

What it contains

  • Binary .etl files, usually one per AutoLogger session, for example EventLog-Application.etl.
  • An RtBackup subfolder.
  • The sessions are declared under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger.

Risks and best practices

  • An .etl being written is locked. Copy it or stop the session before reading it.
  • These traces hold internal diagnostic data: protect copies.
  • Do not delete files while live, and do not disable an AutoLogger without knowing what it traces: Windows recreates the files, but you lose traces support may need.
  • To save space, disable the unneeded AutoLogger in the registry (Start value set to 0) rather than deleting its file.

Useful commands

Fenêtre de terminal
# Trace files and their size
Get-ChildItem -Force "$env:windir\System32\LogFiles\WMI" -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime


# Active trace sessions
logman query -ets


# AutoLoggers declared in the registry
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\WMI\Autologger" | Select-Object PSChildName


# Convert a copied trace to readable XML
tracerpt "$env:TEMP\trace.etl" -o "$env:TEMP\trace.xml" -of XML

Report a mistake