38

In Windows 10 Resource Monitor I found that the system process is constantly writing C:\ProgramData\Microsoft\Windows\wfp\wfpdiag.etl at like 30-100KB/s. This equals 1TB write/year which is not healthy for SSD. There are other log write like C:\Windows\System32\LogFiles*** too.

Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured.

Is it possible to disable as much system logs as possible to decrease garbage write amoung to SSD?

19
  • I use Resource Monitor from time to time to find issues. The locations you mention above (Program Data and Windows) are not large on my machine. Run Admin Tools, Disk Cleanup, Cleanup System Files and enable all selections for cleanup. Do this weekly for a bit and see if the folder size for the logs is reasonable. I do not turn system logs off and all that I read supports this position
    – John
    Jan 13, 2020 at 1:27
  • 1
    @John I care total write amount more than space consumption. In my case wfpdiag.etl is only 1MB, this may indicates small size doesn't mean small total amount of write which harm SSD.
    – jw_
    Jan 13, 2020 at 1:37
  • 2
    @jw_: It definitely matters. If part of the file is overwritten while still in cache then the original write never hits the disk. This can even happen with caches on the SSD itself (so invisible to the OS).
    – MSalters
    Jan 13, 2020 at 11:27
  • 14
    "Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured." Eh?? Jan 13, 2020 at 16:43
  • 1
    @Nat Although you're technically correct, you only need the first few characters of their name, and 9 chars are enough, so "@Lightness" works :) Jan 14, 2020 at 11:30

7 Answers 7

33

By default, Windows has a huge number of log files, constantly writing data.

Two ways to stop some of this churning:

Stop logging "Audit Success" in Windows Filtering Platform (WFP), log only "Audit Failure"

  • Open the CMD prompt as Administrator: Press Windows, type cmd, press Ctrl+Shift+Enter and confirm.
  • Type (or copy/paste) the following and press Enter: auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

If this succeeds, expect fewer events to be logged.

Disable individual logs Windows Event Viewer

  • Open the Windows Event Viewer: press WindowsR, type eventvwr.msc and press Enter.
  • Scroll down to Application and Service Logs, Microsoft, Windows, WFP.
  • Right-click on a log process and select Disable Log.

A useful tool to search the Event Logs by name is Nirsoft's Full Event Log View. Nirsoft's Full Event Log View

7
  • 3
    "netsh wfp set options netevents = off" this works for wfpdiag.etl, too
    – jw_
    Jan 13, 2020 at 3:26
  • Can there be a batch to disable every single log there?
    – jw_
    Jan 13, 2020 at 3:26
  • If already know the log file name, is there a general way to know which entry in the event log viewer to disable? For example, System32\LogFile\WMI\NetCore.etl, there is a WMI entry, no NetCore under that entry, hope it works
    – jw_
    Jan 13, 2020 at 3:33
  • NetCore.etl is still being written after disable the event under Application and Service Logs->Microsoft-> Windows->WMI , can this be stoped using the above method?
    – jw_
    Jan 13, 2020 at 6:49
  • @jw_, to disable ASP.NET logging (NeCore, etc.) see StackOverflow: stackoverflow.com/questions/35251078/… Jan 13, 2020 at 17:00
4

Going hardcore:

If you want to disable specific event logging, go to Event Viewer and right-click on an event log you want to get rid of. Click Event Properties.

A new window should open - click XML view, where you'll be able to see the event's GUID. We'll try to find the event logging service in the registry based on this GUID. Not all events have this GUID, and we won't be able to find every GUID in the registry.

Event properties

After we have our GUID, we navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System in regedit, and we search for our GUID inside curved brackets.

If we find it, we can then proceed to change the Enabled and EnabledProperty keys:

"Enabled"=dword:0
"EnableProperty"=dword:0

Registry editing

4
  • You skipped a step that I haven't been able to figure out. Where you wrote "right-click on an event log you want to get rid of" how does one identify which event log corresponds to the file that Resource Monitor shows is being written to heavily? (For example: C:\Windows\System32\LogFiles\WMI\NetCore.etl) I see no search function in Event Viewer, and I couldn't find NetCore.etl. Is NetCore.etl there somewhere -- a needle in a haystack -- or is it not the kind of log that Event Viewer displays? Jul 31, 2020 at 20:47
  • 1
    That could be another question (or questions) on its own. I was never concerned with files in my answer, only events. I think some reverse engineering would be required to find that out, or at least I am not aware of ways to find out which logging service writes to which file. You can always go into EventViewer and try to find the event which corresponds to the contents of your NetCore.etl file.
    – GChuf
    Aug 2, 2020 at 12:07
  • When I import NetCore.etl into Event Viewer the resulting list seems useless: "unknown" events, etc. A blog ( medium.com/palantir/… ) gave me the idea to run logman.exe: When I ran "logman.exe query NetCore -ets" the output listed many Providers: some have readable names (Network Profile Manager, Microsoft-Windows-SruMon, Network Location Awareness Trace, Microsoft-Windows-NetworkConnectivityStatus) and the rest have names equal to the Provider Guid. Most are set to Level 5 (Verbose). Aug 2, 2020 at 17:39
  • I think I found how to get NetCore.etl to be written to hard drive instead of ssd. I ran Performance Monitor (a Windows app), drilled to Data Collector Sets | Event Trace Sessions, right-clicked NetCore, clicked Properties, clicked Directory, and browsed to the desired folder. I don't know yet if the change will be permanent. If one wished to stop the writing entirely, clicking Stop instead of Properties would presumably do that, but I'm even less confident that that change would be permanent... some app might restart it, perhaps the next time Windows is restarted. Aug 2, 2020 at 18:11
2

I think I figured out how to get NetCore.etl to be written to hard drive instead of ssd. I ran Performance Monitor (a Windows app), drilled down to Data Collector Sets | Event Trace Sessions, right-clicked NetCore, clicked Properties in the menu that popped up, clicked the Directory tab, and browsed to the desired folder. Time will tell if the change is permanent, but at the moment the log is being written to my hard drive E:, according to Resource Monitor.

If one wished to stop the writing of NetCore.etl entirely, clicking Stop instead of Properties would presumably stop it. But I'm less confident that that change would be permanent. Some app might restart it, perhaps the next time Windows is restarted. If anyone tries this, I hope s/he will post the result in this thread.

Several other log files could be redirected (or stopped) in a similar manner.

1
  • 2
    I found a second way to change the folder where NetCore.etl is written, using logman.exe with appropriate command-line parameters. This technique has a big advantage over the Performance Monitor gui technique since it can be placed in a .bat file and can be run every time Windows starts. I also learned today that the Performance Monitor technique doesn't permanently change the folder, so a Windows startup task that runs logman is the way to do it effectively. Example command line: "logman update trace NetCore -ets -o E:\Windows_System32_LogFiles_WMI\NetCore.etl" (without the quotes) Aug 15, 2020 at 22:26
1

Re. the original post: the Windows Event Log does indeed write an enormous amount of data to disk over time; and there are a lot of use cases where this is very undesirable; like embedded systems that can't be serviced and disk wear is a concern and resources are at a premium so reducing all unnecessary i/o as much as possible is desirable.

There are also User use cases where no control over Windows Event Logging is in typical Microsoft fashion, user hostile design, as there is no longer any simple method of suspending logging when it's not needed, wanted, and is actually a liability. There have been a lot of circuitous attempts, like this one via suspending threads but none work reliably for simply in suspending Windows Event Logging.

One approach that may work for some just wanting to reduce disk wear, is using the Windows UWF or Unified Write Filter redirecting to a small RAM disk, but to make this fly in any general purpose computing application you'll be editing extensive exclusion list -- which is time consuming and cumbersome, and again right in line with Microsoft's user hostile experience.

Microsoft remains completely tone deaf on this subject, or is completely indifferent; Developers get the same canned smarmy 'make it a great day' answer Users do. So, any cheap and dirty hack anyone finds would be most welcome and appreciated.

1
  • 1
    Please add further details to expand on your answer, such as working code or documentation citations.
    – Community Bot
    Sep 5, 2021 at 17:28
0

Method 1) NOT RECOMMENDED: Disable "Windows Event Log" service and reboot. But on win7 will disable TaskScheduler (and Defragment Disk). Worst on win10 will disable Network list and devices autosetup.

Method 2) Run this batch as admin:

      rem https://docs.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging
      rem https://social.technet.microsoft.com/Forums/en-US/ec2b033f-3e9b-4727-88d2-e6e358393734/how-to-disable-stop-windows-filtering-platform-filtering-platform-packet-drop
      rem  ALL
    Auditpol /set /category:* /Success:disable /failure:disable
      rem FIREWALL
    auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
    auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
      rem https://thesystemengineers.wordpress.com/2014/05/08/the-best-advanced-audit-script-and-advanced-audit-policy-i-use/
      rem http://www.ultimatewindowssecurity.com/wiki/WindowsSecuritySettings/Recommended-Baseline-Audit-Policy-for-Windows-Server-2008
    auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable
    auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
    auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable
    auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
    auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
    auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
    auditpol /set /subcategory:"SAM" /success:disable /failure:disable
    auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
      rem may be enabled on failure
    auditpol /set /subcategory:"Other System Events" /success:disable /failure:disable
      rem Usually all enabled
    auditpol /set /subcategory:"Account Lockout" /success:disable /failure:disable
    auditpol /set /subcategory:"Application Generated" /success:disable /failure:disable
    auditpol /set /subcategory:"Application Group Management" /success:disable /failure:disable
    auditpol /set /subcategory:"Audit Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Authentication Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Authorization Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Certification Services" /success:disable /failure:disable
    auditpol /set /subcategory:"Computer Account Management" /success:disable /failure:disable
    auditpol /set /subcategory:"Credential Validation" /success:disable /failure:disable
    auditpol /set /subcategory:"Directory Service Access" /success:disable /failure:disable
    auditpol /set /subcategory:"Directory Service Changes" /success:disable /failure:disable
    auditpol /set /subcategory:"Distribution Group Management" /success:disable /failure:disable
    auditpol /set /subcategory:"File Share" /success:disable /failure:disable
    auditpol /set /subcategory:"File System" /success:disable /failure:disable
    auditpol /set /subcategory:"Kerberos Authentication Service" /success:disable /failure:disable
    auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:disable /failure:disable
    auditpol /set /subcategory:"Kernel Object" /success:disable /failure:disable
    auditpol /set /subcategory:"Logoff" /success:disable /failure:disable
    auditpol /set /subcategory:"Logon" /success:disable /failure:disable
    auditpol /set /subcategory:"Network Policy Server" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Account Logon Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Account Management Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Logon/Logoff Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Process Creation" /success:disable /failure:disable
    auditpol /set /subcategory:"Process Termination" /success:disable /failure:disable
    auditpol /set /subcategory:"RPC Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Registry" /success:disable /failure:disable
    auditpol /set /subcategory:"Security Group Management" /success:disable /failure:disable
    auditpol /set /subcategory:"Security State Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Security System Extension" /success:disable /failure:disable
    auditpol /set /subcategory:"Special Logon" /success:disable /failure:disable
    auditpol /set /subcategory:"System Integrity" /success:disable /failure:disable
    auditpol /set /subcategory:"User Account Management" /success:disable /failure:disable
      rem Apply immediatly
    gpupdate /force

Method 3) Create folder C:\TEMP
Open regedit. Navigate and place selector on this branch HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
Right Click and export selected branch to C:\TEMP\WMI_backup.reg (will keep this as a backup) Right Click and export selected branch to C:\TEMP\WMI_disable.reg, close regedit Open C:\TEMP\WMI_disable.reg with TEXTPAD editor:

  Search and Replace, enable Regular Expressions, SEARCH:
^(?!("Enabled"|"EnableProperty"|\[|\n|Windows)).+\n
  Replace with:
(empty)
  REPLACE ALL
  Second Search and replace, Search:
dword:.+
  Replace with:
dword:00000000
  REPLACE ALL
  Third (optional) Search and replace, Search:
(^\[.*(?:\n*\h*)*)+(^\[.*)
  Replace with:
$+
  REPLACE ALL
  Save and exit.

Apply generated .REG, some keys won't be applied unless entered as System user with nirsoft advancedrun:

AdvancedRun_x64.exe /EXEFilename "%windir%\regedit.exe" /CommandLine "c:\TEMP\WMI_disable.reg" /RunAs 8 /Run

Replace explanation: First one will eliminate all lines that doesn't start with one of these: [; "Enabled"; "EnableProperty"; Windows; (empty)

Second search will change all remaining Execute dword:xxxxxxxx to dword:00000000

Third (optional cleanup) searchs consucutive lines starting with [... and leave the last one

Method 4) Do all the same as Method 3 but with the key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT]

Method 5) Apply this .REG file to disable some of the log, dont reset START of: EventLog-Application, EventLog-Security, EventLog-System

    Windows Registry Editor Version 5.00

    ;* no autolog
    ; https://www.reddit.com/r/Windows10/comments/8lpttt/howto_make_w10_log_less_prune_the_amount_of/
    ; https://gist.github.com/FadeMind/9500d49948654b50aa870706a8ac9f04
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AppModel]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AppPlat]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Audio]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener]
    ;* Disables %systemroot%\System32\LogFiles\WMI\Diagtrack-Listener.etl
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DefenderApiLogger]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DiagLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DefenderAuditLogger]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\FamilySafetyAOT]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\LwtNetLog]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\NtfsLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\RadioMgr]
    ;* Disables %SystemRoot%\System32\LogFiles\WMI\RadioMgr.etl
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\UBPM]
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\WiFiSession]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
0

thanks to others for helpful informations, i created a batch script for disabling almost all logs.

Note 1: Gaming service tracing logs needed for Xbox app, so its not included in my script, if you dont use Xbox app simply uninstall it or disable Gaming service and reboot to disable such tracing.

Note 2: UBPM tracing wont disable even if you disable related event logs registry (included in my script). i heard that its bonded into kernel.

Note 3: Script must run as Trustedinstaller to works correctly, otherwise accessing to some keys denied. if you have Nsudo path in your system environment variable, the script runs itself as Trustedinstaller using Nsudo, otherwise you need to manually run script with Nsudo or AdvancedRun or etc as Trustedinstaller.

here is my script for auto find all loggers in registry and disable them (i separated it into 2 parts to make it easier to understand, if you have Nsudo, merge 2 parts into one batch file, otherwise you need to run Part 2 as Trustedinstaller manually):

Part 1) check and run itself as Trustedinstaller

@echo off
setlocal & set runState=user
whoami /groups | findstr /b /c:"Mandatory Label\High Mandatory Level" > nul && set runState=administrator
whoami /groups | findstr /b /c:"Mandatory Label\System Mandatory Level" > nul && set runState=TISYSTEM
echo [42m Running in state: "%runState%" [0m
if "%runState%"=="TISYSTEM" (goto gotTISYSTEM) else (NSudoLG.exe -U:T -P:E -UseCurrentConsole "%~0" %* && exit /b)
:gotTISYSTEM
echo [42m Running as TtustesInstaller.[0m

Part 2) got Trustedinstaller privileges (main job)

@echo off
echo [33m Auto-find and Disable all WMI\AutoLogger [0m
echo [33m find all Auto-Loggers and set Enabled to 0[0m
for /f "usebackq tokens=1*" %%a in (`reg query "HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger" /s /f "Enabled"^| findstr "HKEY"`) do reg add "%%a %%b" /v "Enabled" /t REG_DWORD /d 0 /f
echo.
echo [33m find all Auto-Loggers and set Start to 0[0m
for /f "usebackq tokens=1*" %%a in (`reg query "HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger" /s /f "Start"^| findstr "HKEY"`) do reg add "%%a %%b" /v "Start" /t REG_DWORD /d 0 /f
echo.
echo.
echo.
echo [33m Auto-find and Disable all WINEVT [0m
echo [33m find all WINEVT items and set Enabled to 0[0m
for /f "usebackq tokens=1*" %%a in (`reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT" /s /f "Enabled"^| findstr "HKEY"`) do reg add "%%a %%b" /v "Enabled" /t REG_DWORD /d 0 /f
echo.
pause
exit

Extra step: some loggings arennt related to windows (like .Net apps that create some logs into C:\USERS\Your_User_Name\APPDATA\LOCAL\MICROSOFT\CLR_V4.0\USAGELOGS), how we stop such thing? answer: by fooling windows, i learned it from someone in Ntlite forum, just delete that folder (for example USAGELOGS), then create new text document but without extension and then rename it to that folder name, windows thinks that folder is existed so prevents you and apps from creating new folder with that name so apps cant create logs into that folder :)

im trying to create a script for this part too, i will update my post when it's ready.

Update1: Use new script here to avoid issue that breaks Ethernet network adapter when you disable/enable it. If you dont use Ethernet or dont disable it (always on), you can still use the old script to even suppress loggers more.

0

You can completely remove the event log service and its related residual registry + winevt folder & evts files under win10, as long as you are sure not to use it.

Regarding the solution to the failure to start the network status and its dependent services caused by removing the event log service:

in Regedit: HKLM\System\CurrentControlSet\Services\NlaSvc

  1. remove EventLog from DependOnService
  2. restart windows

and don't forgot remove EventLog from Computer Management(use mmc.exe)

Hope this helps.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jan 29, 2023 at 19:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .