Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Decoding Syscore.etl

Internal Only
Do not share with customers without approval

Decoding the Syscore.etl log requires two components: the tmffiles and decoder tool (not the same ones that are used by the SCP support tool). 

  1. Create a new folder within the SCP support tool – Syscore

  2. Copy and paste the Syscore.etl into the Syscore folder

  1. Open the registeryhives.txt found in SCP support tool logs and search for “system_core_version

  1. Note down the version number

  2. Navigate to File Explorer and map the following drives (using your corpzone\username)

    1. \\\VSCORE

    2. \\\Orbit\VSCORE

      1. you might need to ping the host and try the IP address\path instead

\VSCORE directory contains older tmffiles

\Orbit\VSCORE directory contains newer tmffiles

  1. Open VSCore archive > SDK folder > tracing

  1. Copy and paste tmf files into the Syscore folder

  1. Open > Run TraceLoggingHelper4.exe > Select Syscore and “Use Existing TMF Files”

  1. Copy and paste the folder path for the following items

    1. Tracing Name: Leave as default

    2. TMF Directory: path to the TMF file copied into the Syscore folder I.e., C:\Users\<Username>\Downloads\SCPlog_Sample\support_tool_work_dir\Syscore\tmf

    3. ETL Filename: path to the Syscore.etl I.e. C:\Users\RavinesJorge\Downloads\SCPlog_Sample\support_tool_work_dir\Syscore\Syscore.etl

    4. Output Logfile Name: path to the output I.e. C:\Users\RavinesJorge\Downloads\SCPlog_Sample\support_tool_work_dir\Syscore\Syscore.log

  1. Press Generate Logfile

  • Was this article helpful?