23

In Windows 10 Resource Monitor I found that the system process is constantly writing C:\ProgramData\Microsoft\Windows\wfp\wfpdiag.etl at like 30-100KB/s. This equals 1TB write/year which is not healthy for SSD. There are other log write like C:\Windows\System32\LogFiles*** too.

Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured.

Is it possible to disable as much system logs as possible to decrease garbage write amoung to SSD?

|improve this question
  • I use Resource Monitor from time to time to find issues. The locations you mention above (Program Data and Windows) are not large on my machine. Run Admin Tools, Disk Cleanup, Cleanup System Files and enable all selections for cleanup. Do this weekly for a bit and see if the folder size for the logs is reasonable. I do not turn system logs off and all that I read supports this position – John Jan 13 at 1:27
  • @John I care total write amount more than space consumption. In my case wfpdiag.etl is only 1MB, this may indicates small size doesn't mean small total amount of write which harm SSD. – jw_ Jan 13 at 1:37
  • 2
    @jw_: It definitely matters. If part of the file is overwritten while still in cache then the original write never hits the disk. This can even happen with caches on the SSD itself (so invisible to the OS). – MSalters Jan 13 at 11:27
  • 13
    "Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured." Eh?? – Lightness Races with Monica Jan 13 at 16:43
  • 1
    @Nat Although you're technically correct, you only need the first few characters of their name, and 9 chars are enough, so "@Lightness" works :) – Lightness Races with Monica Jan 14 at 11:30
23

By default, Windows has a huge number of log files, constantly writing data.

Two ways to stop some of this churning:

Stop logging "Audit Success" in Windows Filtering Platform (WFP), log only "Audit Failure"

  • Open the CMD prompt as Administrator: Press Windows, type cmd, press Ctrl+Shift+Enter and confirm.
  • Type (or copy/paste) the following and press Enter: auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

If this succeeds, expect fewer events to be logged.

Disable individual logs Windows Event Viewer

  • Open the Windows Event Viewer: press WindowsR, type eventvwr.msc and press Enter.
  • Scroll down to Application and Service Logs, Microsoft, Windows, WFP.
  • Right-click on a log process and select Disable Log.

A useful tool to search the Event Logs by name is Nirsoft's Full Event Log View. Nirsoft's Full Event Log View

|improve this answer
  • 2
    "netsh wfp set options netevents = off" this works for wfpdiag.etl, too – jw_ Jan 13 at 3:26
  • Can there be a batch to disable every single log there? – jw_ Jan 13 at 3:26
  • If already know the log file name, is there a general way to know which entry in the event log viewer to disable? For example, System32\LogFile\WMI\NetCore.etl, there is a WMI entry, no NetCore under that entry, hope it works – jw_ Jan 13 at 3:33
  • NetCore.etl is still being written after disable the event under Application and Service Logs->Microsoft-> Windows->WMI , can this be stoped using the above method? – jw_ Jan 13 at 6:49
  • @jw_, to disable ASP.NET logging (NeCore, etc.) see StackOverflow: stackoverflow.com/questions/35251078/… – DrMoishe Pippik Jan 13 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.