Share via

Windows Event tracing: How to collect a shutdown trace

  • Article

Introduction

This article is step-by-step instructions on how to collect an Event Tracing for Windows (ETW) trace when a computer running Microsoft Windows is shutting down.

Prerequisites

These steps require the Windows Performance Toolkit (WPT) to be installed. If you do not have the WPT installed, then install the latest version from here. During the installation wizard, uncheck all items except for Windows Performance Toolkit (WPT).

Steps

  1. Start, Run, Windows Performance Recorder (WPRUI.exe). If it is not installed, then follow the prerequisites steps above.
  2. Expand More options, and select CPU usage, Disk I/O activity, File I/O activity, Networking I/O activity, Power usage, GPU activity, and Desktop composition activity.
  3. Select Shutdown in the Performance scenario drop down menu.
  4. Set Number of iterations to 1.
  5. Click Start and provide a file path for the resulting ETL file.
  6. After logging back into the system, locate the resulting ETL file and optionally compress it. It has a very high compression ratio.