Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

so at one point in time, my Windows 7 was booting slowly, and to find out and fix the issue, I downloaded xbootmgr and used it to log the boot and find out what was causing the issue. Sure enough, I figured it out, and didn't have any more use for it.

Long story short, after some time (a few weeks or so), I noticed that our C:\ drive was being used up completely, and after running WinDirStat, we found out the issue: two .etl files (one HUGE (~30GB), and one smaller (~200MB) sitting in System32.

I tried to delete it using the conventional way of the delete button, but it didn't give me permission to remove the file, nor gave me the permission to change the file's permissions.

I panicked, and uninstalled Windows' Performance Toolkit, and once it did, xbootmgr was gone, and the .etl files disappeared.

..but that was not all. A couple of days later, the .etl files appeared again, and while I noticed that the hard drive was rapidly being used up, I noticed that it was not xbootmgr that was doing it, but the Windows Event Log service. This time around, I could easily delete it without a problem, but it still kept popping back up and eating the hard drive. I have no idea what is causing it to show up, but it's not going away.

I cannot disable the Windows Event Log service, as it won't let me, even with Administrator priveleges, so I don't know how to go about fixing it.


tl;dr the files "boot_Latency+DISPATCHER_1_km_premerge.etl" and "boot_Latency+DISPATCHER_1_um_premerge.etl", even after deletion, does not stop appearing and getting to sizes around 30+GB (at least the km file, the um file hovers at around 200MB) until it eats up the entire hard drive, believed to be started by a command in xbootmgr, and created/added onto by the Windows Event Log service, which I can't disable.

share|improve this question

Run xbootmgr -remove to stop the boot logging. Now you don't get the files any longer.

share|improve this answer
edit: I got an error. "Unexpected argument at -cancel", so I did -remove instead, so let's hope it goes away, will wait a couple of days before I see if it really goes away – Ivan Jun 2 '13 at 18:46
ok, thanks. I mixed this. Why have you done the xbootmgr logging? Which issue do you have? – magicandre1981 Jun 2 '13 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .