[River Horse]

This process - C:\WINDOWS\system32\Logfiles\WMI\RtBackup\EtwRTNT Kernel Logger.etl - seems to read and write all the time:

 

In about 7 minutes over 3 GB. Is it like it should be? Can / should one stop that process? Because it impacts the performance?

[Advertisements]

Sorry to say I've had this issue for weeks and still no joy. Over the years I've largely migrated to Linux because of nonsense such as this and rarely use Windows for much other than for Windows-centric photo programs such as Lightroom, etc. As near as I can tell this kernel logging seems to be something new since I "upgraded" to the Creator's Update last year. In any case I've Googled myself into oblivion and by all accounts this idiotic file is essential to this OS running at all. I find it patently ridiculous that an OS, sitting essentially idle, needs to constantly read/write to a log file and worse yet not provide an obvious and easy way for the user to disable it.

 

Good luck finding out any useful info on this utter foolishness.

 

 

[winstinks]

Sorry to say I've had this issue for weeks and still no joy. Over the years I've largely migrated to Linux because of nonsense such as this and rarely use Windows for much other than for Windows-centric photo programs such as Lightroom, etc. As near as I can tell this kernel logging seems to be something new since I "upgraded" to the Creator's Update last year. In any case I've Googled myself into oblivion and by all accounts this idiotic file is essential to this OS running at all. I find it patently ridiculous that an OS, sitting essentially idle, needs to constantly read/write to a log file and worse yet not provide an obvious and easy way for the user to disable it.

 

Good luck finding out any useful info on this utter foolishness.

 

 

[River Horse]

Thank you very much, yes, good luck is very welcome not only for that foolishing process but also for using the foolish respectively senseless Windows.

[Guy...]

Just had the same exact problem - and it seems to be caused by NirSoft's FileActivityWatch itself (the monitoring tool from the screenshot).

When I close it and open Resource Monitor I don't see any writing to EtwRTNT Kernel Logger.etl, and when I denied writing access to the file and opened FileActivityWatch the program stayed empty (didn't display any information about files).

I guess it uses this file as part of its log.