Question on Autologgers

[kosmo]

I'm currently focused on reducing the .etl / .log file infestation on my W10 LTSC install. But my biggest problem, by far, is my profound ignorance about the usefulness of these files once they're written to the "disk". There's a ton of information out there on how to maim, kill and obliterate all autologgers and remove their product but if you were to ask, as I did, "Does Windoze actually use these files after they're written?" then google, etc are completely baffled by the question. As if no one had ever asked such a strange question before.

So I ask the people who know: Does Windoze programmatically "read" (and then act based on the data) these files once they're written or do they only exist for me to use for troubleshooting purposes? And if the answer is "yes - it uses them" then i'd be grateful for suggestions of specific files to leave alone.

 

[MacVap]

From my very amateurish standpoint, I think it doesn't read them/act on them, BUT it may expect them to be present. I've noticed weird behavior of Task Scheduler with UBPM disabled and, of course, I would never ever disable Event Logs because I would like to know if something went wrong (and sometimes why). That's on Windows 7, I still haven't transitioned fully to 10, but I've seen no problems on 10 with just these 4 enabled - I repeat, not tested enough.

GL

 

[kosmo]

Thanks for replying.

I think it doesn't read them/act on them, BUT it may expect them to be present.

Well this is the core of my question: does Windows actually need these files that it scatters all over my drive? Does it use them in any way after they're written? Some of the files are protected from (normal) deletion so it would seem logical that M$ considers them necessary to the successful functioning of the OS.

We have several options available to us to reduce the number of or eliminate these files but it seems really illogical to me to modify a process when I don't know the value of the output of that process. The fact that the files annoy me isn't, by itself, sufficient reason to just nuke the logging process.

So does the OS actually need & use etl & log files?