ETW autologgers in Windows 11: what actually writes to disk

Short answer

In a clean Windows 11 26H2, 39 ETW autologger sessions are registered, 19 are enabled, but only 9 actually write to disk from boot. Another 3 live in a ring buffer in memory (zero disk cost), 5 run in real time without a file, and 2 Defender sessions effectively do not start. The main event generator is Diagtrack-Listener: about 110 MB of events in 2 hours with the telemetry service running. Of the 32 MB occupied by autologger files, 28 MB are preallocated dummies.

Status: the catalog was assembled by static reading of the registry; the actual state was verified with a snapshot 2 hours after boot. One build, one virtual machine; transfer to other configurations (laptops with WiFi, systems with ReFS) changes the composition of active files.

Testable claim

We tested three claims:

1. “Disabling autologgers” is one clear operation, and the composition of active sessions is small.
2. Autologger files take up significant space.
3. Diagnostic traces produce a noticeable event stream at idle.

Scope of research

• Windows 11 Pro, build 26300.9457 (26H2), virtual machine without a WiFi module;
• the Autologger registry key: all 39 sessions, their start flags, file modes and connected providers;
• the actual state of sessions and files 2 hours after boot of a clean system;
• 1115 registered ETW providers and 1049 “provider in session” entries.

Not tested: other builds, machines with radio modules, ReFS volumes and RDP load; session behavior with telemetry disabled over a long window.

Methodology

The session catalog was assembled from the Autologger registry configuration: start flag, file mode, limits and providers. The actual state was compared 2 hours after boot: running sessions, occupied buffers and file sizes. The estimate of the Diagtrack-Listener event volume was obtained from the number of recorded buffers.

Results

Composition of autologgers

Category	Sessions
Registered total	39
Enabled by registry (Start=1)	19
Of these, actually running	17
Write to disk from boot	9
Live in memory (buffering)	3
Real time without a file	5
Configuration without a Start value (do not start)	3

Two Defender sessions, enabled by registry, effectively do not start: the protection replaces them with its own session of lower privileges.

Nine file sessions: who and how much

Session	Purpose	Occupied	Feature
Diagtrack-Listener	telemetry receiver	no file while the service is alive	about 110 MB of events in 2 hours go to the telemetry service
NetCore	network stack diagnostics	22 MB	preallocated file; about 2.5 MB of events recorded
RadioMgr	state of radio modules	6 MB	preallocated; on a machine without WiFi — a dummy file
WdiContextLog	boot and PnP diagnostics	2.2 MB	rotation by boots
NtfsLog	NTFS tracing	1.7 MB	rotation of 8 files; the only noticeable stream after DiagTrack
WiFiSession	WLAN diagnostics	80 KB	almost empty without WiFi
LwtNetLog	network diagnostics	64 KB
RdpIdd-Trace	RDP graphics	64 KB
ReFSLog	ReFS tracing	4 KB	not written without ReFS volumes

In total, the files of active autologgers occupy 32 MB, of which 28 MB are the preallocation of NetCore and RadioMgr: files of this size always exist, regardless of the actual event volume.

Diagtrack-Listener: a heavy stream without a file

While the telemetry service is running, it intercepts the session in real time: there is no file, but the event stream does not disappear — about 110 MB in 2 hours. 254 providers are connected to the session, most of them have the maximum recording level enabled. If the telemetry service is disabled, the autologger will continue writing to a file without a consumer — therefore it must be silenced together with the service.

Levels and providers

The recording level is set not on the session, but on the providers. Of the 1115 registered providers, 607 do not appear in any autologger — they are connected only in runtime sessions. Of the 1049 “provider in session” entries, 425 are GUIDs without registered names, mostly scenario telemetry identifiers.

What is confirmed

• Observed: 39 sessions in the registry, 19 enabled, 17 actually running, 9 write to disk.
• Measured: the files of active autologgers occupy 32 MB; 28 MB of them are the preallocation of NetCore and RadioMgr.
• Measured: Diagtrack-Listener records about 110 MB of events in 2 hours with the telemetry service running.
• Observed: two Defender sessions do not start because the protection replaces them.

What is not confirmed

• The composition and volumes on other builds and configurations (WiFi, ReFS, RDP load).
• Long-term growth of rotation files over many boots.
• The effect of disabling individual sessions on problem diagnosability: we did not disable sessions in this research.

Limitations

One snapshot 2 hours after one boot; night and maintenance windows are not represented. The estimate of the Diagtrack-Listener volume is by buffers, not by file. Preallocated files always exist, but their size is not a measurement of the “recorded” volume.

Practical conclusion

A mass “disable all autologgers” makes no sense: most sessions do not write to disk anyway, and the three really heavy sources are pinpoint. If the goal is to reduce telemetry, disable Diagtrack-Listener together with the telemetry service: in BoosterX this is done by the setting “Background ETW autologgers”. If the goal is disk space, keep in mind that 28 MB of the 32 is the preallocation of two files, not growing logs. We would rate the diagnostic value of the remaining file sessions (NTFS, WDI, network) higher than their disk cost.

State restoration

The research is purely observational: no session was disabled or changed. The system remained in its original state.

Sources and boundaries

The catalog was assembled by BoosterX Research on the described virtual machine. The research belongs to the BoosterX developer, and the developer has a direct interest in the result; the methodology and limitations are described above.

• Microsoft: Configuring and Starting an Autologger Session, checked 2026-09-22.
• Microsoft: Event Tracing, checked 2026-09-22.

Last check: 2026-09-22.