28

In Windows 10 Resource Monitor I found that the system process is constantly writing C:\ProgramData\Microsoft\Windows\wfp\wfpdiag.etl at like 30-100KB/s. This equals 1TB write/year which is not healthy for SSD. There are other log write like C:\Windows\System32\LogFiles*** too.

Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured.

Is it possible to disable as much system logs as possible to decrease garbage write amoung to SSD?

Improve this question
  • I use Resource Monitor from time to time to find issues. The locations you mention above (Program Data and Windows) are not large on my machine. Run Admin Tools, Disk Cleanup, Cleanup System Files and enable all selections for cleanup. Do this weekly for a bit and see if the folder size for the logs is reasonable. I do not turn system logs off and all that I read supports this position – John Jan 13 '20 at 1:27
  • @John I care total write amount more than space consumption. In my case wfpdiag.etl is only 1MB, this may indicates small size doesn't mean small total amount of write which harm SSD. – jw_ Jan 13 '20 at 1:37
  • 2
    @jw_: It definitely matters. If part of the file is overwritten while still in cache then the original write never hits the disk. This can even happen with caches on the SSD itself (so invisible to the OS). – MSalters Jan 13 '20 at 11:27
  • 13
    "Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured." Eh?? – Lightness Races in Orbit Jan 13 '20 at 16:43
  • 1
    @Nat Although you're technically correct, you only need the first few characters of their name, and 9 chars are enough, so "@Lightness" works :) – Lightness Races in Orbit Jan 14 '20 at 11:30
27

By default, Windows has a huge number of log files, constantly writing data.

Two ways to stop some of this churning:

Stop logging "Audit Success" in Windows Filtering Platform (WFP), log only "Audit Failure"

  • Open the CMD prompt as Administrator: Press Windows, type cmd, press Ctrl+Shift+Enter and confirm.
  • Type (or copy/paste) the following and press Enter: auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

If this succeeds, expect fewer events to be logged.

Disable individual logs Windows Event Viewer

  • Open the Windows Event Viewer: press WindowsR, type eventvwr.msc and press Enter.
  • Scroll down to Application and Service Logs, Microsoft, Windows, WFP.
  • Right-click on a log process and select Disable Log.

A useful tool to search the Event Logs by name is Nirsoft's Full Event Log View. Nirsoft's Full Event Log View

Improve this answer
  • 3
    "netsh wfp set options netevents = off" this works for wfpdiag.etl, too – jw_ Jan 13 '20 at 3:26
  • Can there be a batch to disable every single log there? – jw_ Jan 13 '20 at 3:26
  • If already know the log file name, is there a general way to know which entry in the event log viewer to disable? For example, System32\LogFile\WMI\NetCore.etl, there is a WMI entry, no NetCore under that entry, hope it works – jw_ Jan 13 '20 at 3:33
  • NetCore.etl is still being written after disable the event under Application and Service Logs->Microsoft-> Windows->WMI , can this be stoped using the above method? – jw_ Jan 13 '20 at 6:49
  • @jw_, to disable ASP.NET logging (NeCore, etc.) see StackOverflow: stackoverflow.com/questions/35251078/… – DrMoishe Pippik Jan 13 '20 at 17:00
1

Going hardcore:

If you want to disable specific event logging, go to Event Viewer and right-click on an event log you want to get rid of. Click Event Properties.

A new window should open - click XML view, where you'll be able to see the event's GUID. We'll try to find the event logging service in the registry based on this GUID. Not all events have this GUID, and we won't be able to find every GUID in the registry.

Event properties

After we have our GUID, we navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System in regedit, and we search for our GUID inside curved brackets.

If we find it, we can then proceed to change the Enabled and EnabledProperty keys:

"Enabled"=dword:0
"EnableProperty"=dword:0

Registry editing

Improve this answer
  • You skipped a step that I haven't been able to figure out. Where you wrote "right-click on an event log you want to get rid of" how does one identify which event log corresponds to the file that Resource Monitor shows is being written to heavily? (For example: C:\Windows\System32\LogFiles\WMI\NetCore.etl) I see no search function in Event Viewer, and I couldn't find NetCore.etl. Is NetCore.etl there somewhere -- a needle in a haystack -- or is it not the kind of log that Event Viewer displays? – Dolores Stevens Jul 31 '20 at 20:47
  • That could be another question (or questions) on its own. I was never concerned with files in my answer, only events. I think some reverse engineering would be required to find that out, or at least I am not aware of ways to find out which logging service writes to which file. You can always go into EventViewer and try to find the event which corresponds to the contents of your NetCore.etl file. – GChuf Aug 2 '20 at 12:07
  • When I import NetCore.etl into Event Viewer the resulting list seems useless: "unknown" events, etc. A blog ( medium.com/palantir/… ) gave me the idea to run logman.exe: When I ran "logman.exe query NetCore -ets" the output listed many Providers: some have readable names (Network Profile Manager, Microsoft-Windows-SruMon, Network Location Awareness Trace, Microsoft-Windows-NetworkConnectivityStatus) and the rest have names equal to the Provider Guid. Most are set to Level 5 (Verbose). – Dolores Stevens Aug 2 '20 at 17:39
  • I think I found how to get NetCore.etl to be written to hard drive instead of ssd. I ran Performance Monitor (a Windows app), drilled to Data Collector Sets | Event Trace Sessions, right-clicked NetCore, clicked Properties, clicked Directory, and browsed to the desired folder. I don't know yet if the change will be permanent. If one wished to stop the writing entirely, clicking Stop instead of Properties would presumably do that, but I'm even less confident that that change would be permanent... some app might restart it, perhaps the next time Windows is restarted. – Dolores Stevens Aug 2 '20 at 18:11
1

I think I figured out how to get NetCore.etl to be written to hard drive instead of ssd. I ran Performance Monitor (a Windows app), drilled down to Data Collector Sets | Event Trace Sessions, right-clicked NetCore, clicked Properties in the menu that popped up, clicked the Directory tab, and browsed to the desired folder. Time will tell if the change is permanent, but at the moment the log is being written to my hard drive E:, according to Resource Monitor.

If one wished to stop the writing of NetCore.etl entirely, clicking Stop instead of Properties would presumably stop it. But I'm less confident that that change would be permanent. Some app might restart it, perhaps the next time Windows is restarted. If anyone tries this, I hope s/he will post the result in this thread.

Several other log files could be redirected (or stopped) in a similar manner.

Improve this answer
  • I found a second way to change the folder where NetCore.etl is written, using logman.exe with appropriate command-line parameters. This technique has a big advantage over the Performance Monitor gui technique since it can be placed in a .bat file and can be run every time Windows starts. I also learned today that the Performance Monitor technique doesn't permanently change the folder, so a Windows startup task that runs logman is the way to do it effectively. Example command line: "logman update trace NetCore -ets -o E:\Windows_System32_LogFiles_WMI\NetCore.etl" (without the quotes) – Dolores Stevens Aug 15 '20 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.