When Outlook behaves unexpectedly, technical support often needs detailed diagnostic data to find the cause. This data is captured in a special file called an Event Trace Log, or ETL. This article explains how to create this log file and understand its basic contents to provide better information to support teams.
Key Takeaways: Creating and Using Outlook ETL Logs
- Outlook.exe /enablelogging: This command-line switch starts Outlook with diagnostic logging turned on to record events.
- %localappdata%\Microsoft\Outlook\Logging: This is the default folder where Outlook saves the generated ETL log files.
- Windows Performance Analyzer (WPA):b> This free Microsoft tool can open and decode ETL files to show detailed event timelines and errors.
What an Outlook Diagnostic ETL Log Captures
An Event Trace Log is a binary file that records a chronological sequence of events, errors, and operations performed by Outlook and related components. It is far more detailed than standard error messages. The log tracks activities like sending and receiving emails, syncing with the server, loading add-ins, and accessing data files.
You generate this log only when instructed by a support professional, as it can contain sensitive data like folder names, account IDs, and process identifiers. The logging must be active while you reproduce the specific problem you are reporting. Once you close Outlook, the logging session ends and the final ETL file is saved.
Prerequisites for Logging
You need local administrator rights on your Windows 10 or Windows 11 PC to enable this level of logging. Ensure you know the exact steps to trigger the issue, as you will need to perform them while logging is active. Close Outlook completely before you begin the process.
Steps to Generate an Outlook ETL Log File
Follow these steps to start Outlook with diagnostic tracing enabled and create the log file.
- Close Outlook and open the Run dialog
First, ensure Outlook is not running. Press the Windows key + R on your keyboard to open the Run command box. - Enter the Outlook logging command
In the Run dialog, type the full path to Outlook.exe followed by /enablelogging. The typical command is: “C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE” /enablelogging. Then click OK. - Reproduce the issue
Outlook will start. Immediately perform the exact actions that cause the error or unexpected behavior you need to diagnose. - Close Outlook to finalize the log
After reproducing the problem, close Outlook normally via File > Exit. This action stops the trace session and finalizes the ETL file. - Locate the saved log file
Navigate to the logging folder on your PC. Open File Explorer and paste this path into the address bar: %localappdata%\Microsoft\Outlook\Logging. Look for the newest .etl file, named with the date and time it was created.
How to Read and Analyze the Basic Log Contents
ETL files are not plain text and require a special viewer. Microsoft provides the Windows Performance Analyzer for this purpose.
- Download and install Windows Performance Analyzer
WPA is part of the Windows Assessment and Deployment Kit. Download the ADK installer from Microsoft’s website. During installation, select only the Windows Performance Toolkit component. - Open the ETL file in WPA
Launch Windows Performance Analyzer from the Start menu. Go to File > Open and select your saved .etl file. The tool will load and process the trace data. - Examine the Graph Explorer pane
On the left side, you will see the Graph Explorer. Expand the Outlook Activity node to find specific providers like Outlook, Mail, or Sync. Double-click on a graph to add its timeline to the analysis view. - Look for errors and warnings
In the timeline view, look for red or yellow markers indicating errors or warnings. You can zoom in on the timeline around the time you reproduced the issue. The details pane at the bottom shows event names, results, and component IDs.
Common Mistakes and Limitations of ETL Logs
Logging the Wrong Activity or Timeframe
A common error is starting the logging session but not performing the problematic action, or performing unrelated actions first. The log file becomes large and the critical events are buried. Always reproduce the issue immediately after Outlook starts with the /enablelogging switch.
ETL File is Too Large to Send
Logging for an extended period can create multi-gigabyte files. Support channels often have attachment size limits. To avoid this, keep the logging session short and focused only on the problem. If the file is already large, you may need to use a cloud storage link instead of email.
Cannot Open ETL File or Data Seems Missing
If WPA cannot open the file, it may be corrupted because Outlook crashed instead of closing properly. Try generating a new log. If certain expected events are missing, the correct trace provider might not have been enabled. Advanced logging requires specific registry keys that support should provide.
Manual Logging vs. Microsoft Support and Recovery Assistant
| Item | Manual ETL Logging (/enablelogging) | Microsoft Support and Recovery Assistant (SaRA) |
|---|---|---|
| Primary User | IT professionals or advanced users guided by support | End-users performing automated troubleshooting |
| Data Detail | Low-level system events, provider traces, precise timings | High-level configuration checks, common issue detection |
| Output Format | Binary .etl file requiring WPA to analyze | Plain text summary report or automated fix |
| Best For | In-depth analysis of crashes, hangs, or complex sync errors | Quick diagnosis of setup, send/receive, or profile issues |
| Skill Required | High – needs interpretation of trace data | Low – guided, automated process |
You can now create a detailed diagnostic log when Outlook has a complex problem. Provide the ETL file to your support technician along with a description of what you did while logging was active. For less severe issues, try running the Microsoft Support and Recovery Assistant first. Remember that the keyboard shortcut Windows key + R is the fastest way to launch the Run dialog for the logging command.