30

In Windows 10 Resource Monitor I found that the system process is constantly writing C:\ProgramData\Microsoft\Windows\wfp\wfpdiag.etl at like 30-100KB/s. This equals 1TB write/year which is not healthy for SSD. There are other log write like C:\Windows\System32\LogFiles*** too.

Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured.

Is it possible to disable as much system logs as possible to decrease garbage write amoung to SSD?

Improve this question
20
  • I use Resource Monitor from time to time to find issues. The locations you mention above (Program Data and Windows) are not large on my machine. Run Admin Tools, Disk Cleanup, Cleanup System Files and enable all selections for cleanup. Do this weekly for a bit and see if the folder size for the logs is reasonable. I do not turn system logs off and all that I read supports this position
    – John
    Jan 13 '20 at 1:27
  • @John I care total write amount more than space consumption. In my case wfpdiag.etl is only 1MB, this may indicates small size doesn't mean small total amount of write which harm SSD.
    – jw_
    Jan 13 '20 at 1:37
  • 2
    @jw_: It definitely matters. If part of the file is overwritten while still in cache then the original write never hits the disk. This can even happen with caches on the SSD itself (so invisible to the OS).
    – MSalters
    Jan 13 '20 at 11:27
  • 13
    "Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured." Eh??
    – Lightness Races in Orbit
    Jan 13 '20 at 16:43
  • 1
    @Nat Although you're technically correct, you only need the first few characters of their name, and 9 chars are enough, so "@Lightness" works :)
    – Lightness Races in Orbit
    Jan 14 '20 at 11:30
28

By default, Windows has a huge number of log files, constantly writing data.

Two ways to stop some of this churning:

Stop logging "Audit Success" in Windows Filtering Platform (WFP), log only "Audit Failure"

  • Open the CMD prompt as Administrator: Press Windows, type cmd, press Ctrl+Shift+Enter and confirm.
  • Type (or copy/paste) the following and press Enter: auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

If this succeeds, expect fewer events to be logged.

Disable individual logs Windows Event Viewer

  • Open the Windows Event Viewer: press WindowsR, type eventvwr.msc and press Enter.
  • Scroll down to Application and Service Logs, Microsoft, Windows, WFP.
  • Right-click on a log process and select Disable Log.

A useful tool to search the Event Logs by name is Nirsoft's Full Event Log View. Nirsoft's Full Event Log View

Improve this answer
7
  • 3
    "netsh wfp set options netevents = off" this works for wfpdiag.etl, too
    – jw_
    Jan 13 '20 at 3:26
  • Can there be a batch to disable every single log there?
    – jw_
    Jan 13 '20 at 3:26
  • If already know the log file name, is there a general way to know which entry in the event log viewer to disable? For example, System32\LogFile\WMI\NetCore.etl, there is a WMI entry, no NetCore under that entry, hope it works
    – jw_
    Jan 13 '20 at 3:33
  • NetCore.etl is still being written after disable the event under Application and Service Logs->Microsoft-> Windows->WMI , can this be stoped using the above method?
    – jw_
    Jan 13 '20 at 6:49
  • @jw_, to disable ASP.NET logging (NeCore, etc.) see StackOverflow: stackoverflow.com/questions/35251078/…
    – DrMoishe Pippik
    Jan 13 '20 at 17:00
2

Going hardcore:

If you want to disable specific event logging, go to Event Viewer and right-click on an event log you want to get rid of. Click Event Properties.

A new window should open - click XML view, where you'll be able to see the event's GUID. We'll try to find the event logging service in the registry based on this GUID. Not all events have this GUID, and we won't be able to find every GUID in the registry.

Event properties

After we have our GUID, we navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System in regedit, and we search for our GUID inside curved brackets.

If we find it, we can then proceed to change the Enabled and EnabledProperty keys:

"Enabled"=dword:0
"EnableProperty"=dword:0

Registry editing

Improve this answer
4
  • You skipped a step that I haven't been able to figure out. Where you wrote "right-click on an event log you want to get rid of" how does one identify which event log corresponds to the file that Resource Monitor shows is being written to heavily? (For example: C:\Windows\System32\LogFiles\WMI\NetCore.etl) I see no search function in Event Viewer, and I couldn't find NetCore.etl. Is NetCore.etl there somewhere -- a needle in a haystack -- or is it not the kind of log that Event Viewer displays?
    – Dolores Stevens
    Jul 31 '20 at 20:47
  • 1
    That could be another question (or questions) on its own. I was never concerned with files in my answer, only events. I think some reverse engineering would be required to find that out, or at least I am not aware of ways to find out which logging service writes to which file. You can always go into EventViewer and try to find the event which corresponds to the contents of your NetCore.etl file.
    – GChuf
    Aug 2 '20 at 12:07
  • When I import NetCore.etl into Event Viewer the resulting list seems useless: "unknown" events, etc. A blog ( medium.com/palantir/… ) gave me the idea to run logman.exe: When I ran "logman.exe query NetCore -ets" the output listed many Providers: some have readable names (Network Profile Manager, Microsoft-Windows-SruMon, Network Location Awareness Trace, Microsoft-Windows-NetworkConnectivityStatus) and the rest have names equal to the Provider Guid. Most are set to Level 5 (Verbose).
    – Dolores Stevens
    Aug 2 '20 at 17:39
  • I think I found how to get NetCore.etl to be written to hard drive instead of ssd. I ran Performance Monitor (a Windows app), drilled to Data Collector Sets | Event Trace Sessions, right-clicked NetCore, clicked Properties, clicked Directory, and browsed to the desired folder. I don't know yet if the change will be permanent. If one wished to stop the writing entirely, clicking Stop instead of Properties would presumably do that, but I'm even less confident that that change would be permanent... some app might restart it, perhaps the next time Windows is restarted.
    – Dolores Stevens
    Aug 2 '20 at 18:11
1

I think I figured out how to get NetCore.etl to be written to hard drive instead of ssd. I ran Performance Monitor (a Windows app), drilled down to Data Collector Sets | Event Trace Sessions, right-clicked NetCore, clicked Properties in the menu that popped up, clicked the Directory tab, and browsed to the desired folder. Time will tell if the change is permanent, but at the moment the log is being written to my hard drive E:, according to Resource Monitor.

If one wished to stop the writing of NetCore.etl entirely, clicking Stop instead of Properties would presumably stop it. But I'm less confident that that change would be permanent. Some app might restart it, perhaps the next time Windows is restarted. If anyone tries this, I hope s/he will post the result in this thread.

Several other log files could be redirected (or stopped) in a similar manner.

Improve this answer
1
  • 1
    I found a second way to change the folder where NetCore.etl is written, using logman.exe with appropriate command-line parameters. This technique has a big advantage over the Performance Monitor gui technique since it can be placed in a .bat file and can be run every time Windows starts. I also learned today that the Performance Monitor technique doesn't permanently change the folder, so a Windows startup task that runs logman is the way to do it effectively. Example command line: "logman update trace NetCore -ets -o E:\Windows_System32_LogFiles_WMI\NetCore.etl" (without the quotes)
    – Dolores Stevens
    Aug 15 '20 at 22:26
0

Re. the original post: the Windows Event Log does indeed write an enormous amount of data to disk over time; and there are a lot of use cases where this is very undesirable; like embedded systems that can't be serviced and disk wear is a concern and resources are at a premium so reducing all unnecessary i/o as much as possible is desirable.

There are also User use cases where no control over Windows Event Logging is in typical Microsoft fashion, user hostile design, as there is no longer any simple method of suspending logging when it's not needed, wanted, and is actually a liability. There have been a lot of circuitous attempts, like this one via suspending threads but none work reliably for simply in suspending Windows Event Logging.

One approach that may work for some just wanting to reduce disk wear, is using the Windows UWF or Unified Write Filter redirecting to a small RAM disk, but to make this fly in any general purpose computing application you'll be editing extensive exclusion list -- which is time consuming and cumbersome, and again right in line with Microsoft's user hostile experience.

Microsoft remains completely tone deaf on this subject, or is completely indifferent; Developers get the same canned smarmy 'make it a great day' answer Users do. So, any cheap and dirty hack anyone finds would be most welcome and appreciated.

Improve this answer
1
  • 1
    Please add further details to expand on your answer, such as working code or documentation citations.
    – Community Bot
    Sep 5 '21 at 17:28
0

Method 1) NOT RECOMMENDED: Disable "Windows Event Log" service and reboot. But on win7 will disable TaskScheduler (and Defragment Disk). Worst on win10 will disable Network list and devices autosetup.

Method 2) Run this batch as admin:

      rem https://docs.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging
      rem https://social.technet.microsoft.com/Forums/en-US/ec2b033f-3e9b-4727-88d2-e6e358393734/how-to-disable-stop-windows-filtering-platform-filtering-platform-packet-drop
      rem  ALL
    Auditpol /set /category:* /Success:disable /failure:disable
      rem FIREWALL
    auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
    auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
    auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
      rem https://thesystemengineers.wordpress.com/2014/05/08/the-best-advanced-audit-script-and-advanced-audit-policy-i-use/
      rem http://www.ultimatewindowssecurity.com/wiki/WindowsSecuritySettings/Recommended-Baseline-Audit-Policy-for-Windows-Server-2008
    auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable
    auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
    auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable
    auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
    auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
    auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
    auditpol /set /subcategory:"SAM" /success:disable /failure:disable
    auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
      rem may be enabled on failure
    auditpol /set /subcategory:"Other System Events" /success:disable /failure:disable
      rem Usually all enabled
    auditpol /set /subcategory:"Account Lockout" /success:disable /failure:disable
    auditpol /set /subcategory:"Application Generated" /success:disable /failure:disable
    auditpol /set /subcategory:"Application Group Management" /success:disable /failure:disable
    auditpol /set /subcategory:"Audit Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Authentication Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Authorization Policy Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Certification Services" /success:disable /failure:disable
    auditpol /set /subcategory:"Computer Account Management" /success:disable /failure:disable
    auditpol /set /subcategory:"Credential Validation" /success:disable /failure:disable
    auditpol /set /subcategory:"Directory Service Access" /success:disable /failure:disable
    auditpol /set /subcategory:"Directory Service Changes" /success:disable /failure:disable
    auditpol /set /subcategory:"Distribution Group Management" /success:disable /failure:disable
    auditpol /set /subcategory:"File Share" /success:disable /failure:disable
    auditpol /set /subcategory:"File System" /success:disable /failure:disable
    auditpol /set /subcategory:"Kerberos Authentication Service" /success:disable /failure:disable
    auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:disable /failure:disable
    auditpol /set /subcategory:"Kernel Object" /success:disable /failure:disable
    auditpol /set /subcategory:"Logoff" /success:disable /failure:disable
    auditpol /set /subcategory:"Logon" /success:disable /failure:disable
    auditpol /set /subcategory:"Network Policy Server" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Account Logon Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Account Management Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Other Logon/Logoff Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Process Creation" /success:disable /failure:disable
    auditpol /set /subcategory:"Process Termination" /success:disable /failure:disable
    auditpol /set /subcategory:"RPC Events" /success:disable /failure:disable
    auditpol /set /subcategory:"Registry" /success:disable /failure:disable
    auditpol /set /subcategory:"Security Group Management" /success:disable /failure:disable
    auditpol /set /subcategory:"Security State Change" /success:disable /failure:disable
    auditpol /set /subcategory:"Security System Extension" /success:disable /failure:disable
    auditpol /set /subcategory:"Special Logon" /success:disable /failure:disable
    auditpol /set /subcategory:"System Integrity" /success:disable /failure:disable
    auditpol /set /subcategory:"User Account Management" /success:disable /failure:disable
      rem Apply immediatly
    gpupdate /force

Method 3) Create folder C:\TEMP
Open regedit. Navigate and place selector on this branch HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
Right Click and export selected branch to C:\TEMP\WMI_backup.reg (will keep this as a backup) Right Click and export selected branch to C:\TEMP\WMI_disable.reg, close regedit Open C:\TEMP\WMI_disable.reg with TEXTPAD editor:

  Search and Replace, enable Regular Expressions, SEARCH:
^(?!("Enabled"|"EnableProperty"|\[|\n|Windows)).+\n
  Replace with:
(empty)
  REPLACE ALL
  Second Search and replace, Search:
dword:.+
  Replace with:
dword:00000000
  REPLACE ALL
  Third (optional) Search and replace, Search:
(^\[.*(?:\n*\h*)*)+(^\[.*)
  Replace with:
$+
  REPLACE ALL
  Save and exit.

Apply generated .REG, some keys won't be applied unless entered as System user with nirsoft advancedrun:

AdvancedRun_x64.exe /EXEFilename "%windir%\regedit.exe" /CommandLine "c:\TEMP\WMI_disable.reg" /RunAs 8 /Run

Replace explanation: First one will eliminate all lines that doesn't start with one of these: [; "Enabled"; "EnableProperty"; Windows; (empty)

Second search will change all remaining Execute dword:xxxxxxxx to dword:00000000

Third (optional cleanup) searchs consucutive lines starting with [... and leave the last one

Method 4) Do all the same as Method 3 but with the key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT]

Method 5) Apply this .REG file to disable some of the log, dont reset START of: EventLog-Application, EventLog-Security, EventLog-System

    Windows Registry Editor Version 5.00

    ;* no autolog
    ; https://www.reddit.com/r/Windows10/comments/8lpttt/howto_make_w10_log_less_prune_the_amount_of/
    ; https://gist.github.com/FadeMind/9500d49948654b50aa870706a8ac9f04
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AppModel]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AppPlat]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Audio]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener]
    ;* Disables %systemroot%\System32\LogFiles\WMI\Diagtrack-Listener.etl
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DefenderApiLogger]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DiagLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DefenderAuditLogger]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\FamilySafetyAOT]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\LwtNetLog]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\NtfsLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\RadioMgr]
    ;* Disables %SystemRoot%\System32\LogFiles\WMI\RadioMgr.etl
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\UBPM]
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog]
    ; Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\WiFiSession]
    ;+ Disables Event Trace Session in Perfmon Data Collector Sets
    "Start"=dword:00000000
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.