In Windows 10 Resource Monitor I found that the system process is constantly writing C:\ProgramData\Microsoft\Windows\wfp\wfpdiag.etl at like 30-100KB/s. This equals 1TB write/year which is not healthy for SSD. There are other log write like C:\Windows\System32\LogFiles*** too.
Although logs is needed for diagnostics, it's better to be turned on only when problem has already occured.
Is it possible to disable as much system logs as possible to decrease garbage write amoung to SSD?
By default, Windows has a huge number of log files, constantly writing data.
Two ways to stop some of this churning:
Stop logging "Audit Success" in Windows Filtering Platform (WFP), log only "Audit Failure"
cmd, press Ctrl+Shift+Enter and confirm.auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enableIf this succeeds, expect fewer events to be logged.
Disable individual logs
eventvwr.msc and press Enter.Application and Service Logs, Microsoft, Windows, WFP.Disable Log.A useful tool to search the Event Logs by name is Nirsoft's Full Event Log View.
Going hardcore:
If you want to disable specific event logging, go to Event Viewer and right-click on an event log you want to get rid of. Click Event Properties.
A new window should open - click XML view, where you'll be able to see the event's GUID. We'll try to find the event logging service in the registry based on this GUID. Not all events have this GUID, and we won't be able to find every GUID in the registry.
Edit: As mentioned by EvgenKo423 in the coments, these GUIDs are not event GUIDs, but provider GUIDs - so disabling logging for a certian GUID will disable logging for any events related to that provider.
After we have our GUID, we navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System in regedit, and we search for our GUID inside curved brackets.
If we find it, we can then proceed to change the Enabled and EnabledProperty keys:
"Enabled"=dword:0
"EnableProperty"=dword:0
I think I figured out how to get NetCore.etl to be written to hard drive instead of ssd. I ran Performance Monitor (a Windows app), drilled down to Data Collector Sets | Event Trace Sessions, right-clicked NetCore, clicked Properties in the menu that popped up, clicked the Directory tab, and browsed to the desired folder. Time will tell if the change is permanent, but at the moment the log is being written to my hard drive E:, according to Resource Monitor.
If one wished to stop the writing of NetCore.etl entirely, clicking Stop instead of Properties would presumably stop it. But I'm less confident that that change would be permanent. Some app might restart it, perhaps the next time Windows is restarted. If anyone tries this, I hope s/he will post the result in this thread.
Several other log files could be redirected (or stopped) in a similar manner.
Re. the original post: the Windows Event Log does indeed write an enormous amount of data to disk over time; and there are a lot of use cases where this is very undesirable; like embedded systems that can't be serviced and disk wear is a concern and resources are at a premium so reducing all unnecessary i/o as much as possible is desirable.
There are also User use cases where no control over Windows Event Logging is in typical Microsoft fashion, user hostile design, as there is no longer any simple method of suspending logging when it's not needed, wanted, and is actually a liability. There have been a lot of circuitous attempts, like this one via suspending threads but none work reliably for simply in suspending Windows Event Logging.
One approach that may work for some just wanting to reduce disk wear, is using the Windows UWF or Unified Write Filter redirecting to a small RAM disk, but to make this fly in any general purpose computing application you'll be editing extensive exclusion list -- which is time consuming and cumbersome, and again right in line with Microsoft's user hostile experience.
Microsoft remains completely tone deaf on this subject, or is completely indifferent; Developers get the same canned smarmy 'make it a great day' answer Users do. So, any cheap and dirty hack anyone finds would be most welcome and appreciated.
Method 1) NOT RECOMMENDED: Disable "Windows Event Log" service and reboot. But on win7 will disable TaskScheduler (and Defragment Disk). Worst on win10 will disable Network list and devices autosetup.
Method 2) Run this batch as admin:
rem https://docs.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging
rem https://social.technet.microsoft.com/Forums/en-US/ec2b033f-3e9b-4727-88d2-e6e358393734/how-to-disable-stop-windows-filtering-platform-filtering-platform-packet-drop
rem ALL
Auditpol /set /category:* /Success:disable /failure:disable
rem FIREWALL
auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
rem https://thesystemengineers.wordpress.com/2014/05/08/the-best-advanced-audit-script-and-advanced-audit-policy-i-use/
rem http://www.ultimatewindowssecurity.com/wiki/WindowsSecuritySettings/Recommended-Baseline-Audit-Policy-for-Windows-Server-2008
auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable
auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable
auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
auditpol /set /subcategory:"SAM" /success:disable /failure:disable
auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
rem may be enabled on failure
auditpol /set /subcategory:"Other System Events" /success:disable /failure:disable
rem Usually all enabled
auditpol /set /subcategory:"Account Lockout" /success:disable /failure:disable
auditpol /set /subcategory:"Application Generated" /success:disable /failure:disable
auditpol /set /subcategory:"Application Group Management" /success:disable /failure:disable
auditpol /set /subcategory:"Audit Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Authentication Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Authorization Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Certification Services" /success:disable /failure:disable
auditpol /set /subcategory:"Computer Account Management" /success:disable /failure:disable
auditpol /set /subcategory:"Credential Validation" /success:disable /failure:disable
auditpol /set /subcategory:"Directory Service Access" /success:disable /failure:disable
auditpol /set /subcategory:"Directory Service Changes" /success:disable /failure:disable
auditpol /set /subcategory:"Distribution Group Management" /success:disable /failure:disable
auditpol /set /subcategory:"File Share" /success:disable /failure:disable
auditpol /set /subcategory:"File System" /success:disable /failure:disable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:disable /failure:disable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:disable /failure:disable
auditpol /set /subcategory:"Kernel Object" /success:disable /failure:disable
auditpol /set /subcategory:"Logoff" /success:disable /failure:disable
auditpol /set /subcategory:"Logon" /success:disable /failure:disable
auditpol /set /subcategory:"Network Policy Server" /success:disable /failure:disable
auditpol /set /subcategory:"Other Account Logon Events" /success:disable /failure:disable
auditpol /set /subcategory:"Other Account Management Events" /success:disable /failure:disable
auditpol /set /subcategory:"Other Logon/Logoff Events" /success:disable /failure:disable
auditpol /set /subcategory:"Process Creation" /success:disable /failure:disable
auditpol /set /subcategory:"Process Termination" /success:disable /failure:disable
auditpol /set /subcategory:"RPC Events" /success:disable /failure:disable
auditpol /set /subcategory:"Registry" /success:disable /failure:disable
auditpol /set /subcategory:"Security Group Management" /success:disable /failure:disable
auditpol /set /subcategory:"Security State Change" /success:disable /failure:disable
auditpol /set /subcategory:"Security System Extension" /success:disable /failure:disable
auditpol /set /subcategory:"Special Logon" /success:disable /failure:disable
auditpol /set /subcategory:"System Integrity" /success:disable /failure:disable
auditpol /set /subcategory:"User Account Management" /success:disable /failure:disable
rem Apply immediatly
gpupdate /force
Method 3) Create folder C:\TEMP
Open regedit. Navigate and place selector on this branch
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
Right Click and export selected branch to C:\TEMP\WMI_backup.reg (will keep this as a backup)
Right Click and export selected branch to C:\TEMP\WMI_disable.reg, close regedit
Open C:\TEMP\WMI_disable.reg with TEXTPAD editor:
Search and Replace, enable Regular Expressions, SEARCH:
^(?!("Enabled"|"EnableProperty"|\[|\n|Windows)).+\n
Replace with:
(empty)
REPLACE ALL
Second Search and replace, Search:
dword:.+
Replace with:
dword:00000000
REPLACE ALL
Third (optional) Search and replace, Search:
(^\[.*(?:\n*\h*)*)+(^\[.*)
Replace with:
$+
REPLACE ALL
Save and exit.
Apply generated .REG, some keys won't be applied unless entered as System user with nirsoft advancedrun:
AdvancedRun_x64.exe /EXEFilename "%windir%\regedit.exe" /CommandLine "c:\TEMP\WMI_disable.reg" /RunAs 8 /Run
Replace explanation: First one will eliminate all lines that doesn't start with one of these: [; "Enabled"; "EnableProperty"; Windows; (empty)
Second search will change all remaining Execute dword:xxxxxxxx to dword:00000000
Third (optional cleanup) searchs consucutive lines starting with [... and leave the last one
Method 4) Do all the same as Method 3 but with the key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT]
Method 5) Apply this .REG file to disable some of the log, dont reset START of: EventLog-Application, EventLog-Security, EventLog-System
Windows Registry Editor Version 5.00
;* no autolog
; https://www.reddit.com/r/Windows10/comments/8lpttt/howto_make_w10_log_less_prune_the_amount_of/
; https://gist.github.com/FadeMind/9500d49948654b50aa870706a8ac9f04
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AppModel]
;+ Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AppPlat]
;+ Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Audio]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener]
;* Disables %systemroot%\System32\LogFiles\WMI\Diagtrack-Listener.etl
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DefenderApiLogger]
;+ Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DiagLog]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\DefenderAuditLogger]
;+ Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\FamilySafetyAOT]
;+ Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\LwtNetLog]
;+ Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\NtfsLog]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\RadioMgr]
;* Disables %SystemRoot%\System32\LogFiles\WMI\RadioMgr.etl
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\ReadyBoot]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\UBPM]
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog]
; Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\WiFiSession]
;+ Disables Event Trace Session in Perfmon Data Collector Sets
"Start"=dword:00000000
thanks to others for helpful informations, i created a batch script for disabling almost all logs.
Note 1: Gaming service tracing logs needed for Xbox app, so its not included in my script, if you dont use Xbox app simply uninstall it or disable Gaming service and reboot to disable such tracing.
Note 2: UBPM tracing wont disable even if you disable related event logs registry (included in my script). i heard that its bonded into kernel.
Note 3: Script must run as Trustedinstaller to works correctly, otherwise accessing to some keys denied. if you have Nsudo path in your system environment variable, the script runs itself as Trustedinstaller using Nsudo, otherwise you need to manually run script with Nsudo or AdvancedRun or etc as Trustedinstaller.
here is my script for auto find all loggers in registry and disable them (i separated it into 2 parts to make it easier to understand, if you have Nsudo, merge 2 parts into one batch file, otherwise you need to run Part 2 as Trustedinstaller manually):
Part 1) check and run itself as Trustedinstaller
@echo off
setlocal & set runState=user
whoami /groups | findstr /b /c:"Mandatory Label\High Mandatory Level" > nul && set runState=administrator
whoami /groups | findstr /b /c:"Mandatory Label\System Mandatory Level" > nul && set runState=TISYSTEM
echo [42m Running in state: "%runState%" [0m
if "%runState%"=="TISYSTEM" (goto gotTISYSTEM) else (NSudoLG.exe -U:T -P:E -UseCurrentConsole "%~0" %* && exit /b)
:gotTISYSTEM
echo [42m Running as TtustesInstaller.[0m
Part 2) got Trustedinstaller privileges (main job)
@echo off
echo [33m Auto-find and Disable all WMI\AutoLogger [0m
echo [33m find all Auto-Loggers and set Enabled to 0[0m
for /f "usebackq tokens=1*" %%a in (`reg query "HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger" /s /f "Enabled"^| findstr "HKEY"`) do reg add "%%a %%b" /v "Enabled" /t REG_DWORD /d 0 /f
echo.
echo [33m find all Auto-Loggers and set Start to 0[0m
for /f "usebackq tokens=1*" %%a in (`reg query "HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger" /s /f "Start"^| findstr "HKEY"`) do reg add "%%a %%b" /v "Start" /t REG_DWORD /d 0 /f
echo.
echo.
echo.
echo [33m Auto-find and Disable all WINEVT [0m
echo [33m find all WINEVT items and set Enabled to 0[0m
for /f "usebackq tokens=1*" %%a in (`reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT" /s /f "Enabled"^| findstr "HKEY"`) do reg add "%%a %%b" /v "Enabled" /t REG_DWORD /d 0 /f
echo.
pause
exit
Extra step: some loggings arennt related to windows (like .Net apps that create some logs into C:\USERS\Your_User_Name\APPDATA\LOCAL\MICROSOFT\CLR_V4.0\USAGELOGS), how we stop such thing? answer: by fooling windows, i learned it from someone in Ntlite forum, just delete that folder (for example USAGELOGS), then create new text document but without extension and then rename it to that folder name, windows thinks that folder is existed so prevents you and apps from creating new folder with that name so apps cant create logs into that folder :)
im trying to create a script for this part too, i will update my post when it's ready.
Update1: Use new script here to avoid issue that breaks Ethernet network adapter when you disable/enable it. If you dont use Ethernet or dont disable it (always on), you can still use the old script to even suppress loggers more.
You can completely remove the event log service and its related residual registry + winevt folder & evts files under win10, as long as you are sure not to use it.
in Regedit: HKLM\System\CurrentControlSet\Services\NlaSvc
and don't forgot remove EventLog from Computer Management(use mmc.exe)
Hope this helps.
