EtwRTDefenderApiLogger.etl

What is this process:

Windows\System32\LogFiles\WMI\Rtbackup\EtwRTDefenderApiLogger.etl

I see in resource manager this comes up sometimes and chews away at my HDD for a good 10 minutes. Very annoying as it loves to run while I'm trying to use my PC for other things.

Can this be disabled?

I don't even have defender enabled so I have no idea why this runs.

Nobody has any idea what this process is?

Superfly said:

Uhmmm.. no, but WMI is a resource hog

Windows Defender (like Internet Explorer before), if that is what it represents, is an embedded resource...so it writes to EventLog like all OS API's. Disable it.

How can I disable it from writing to event logs? I should have defender disabled as I use Kaspersky, but maybe there'a still a part of defender that's still running?

TairikuOkami said:

Start - Run - perfmon - Data Collector Sets - Startup Event Trace Sessions - Check if it is present there.

If it is, open it (double click) - Trace Sessions - un-check Enabled - OK - restart

I checked. I have these two items listed there, and listed as enabled:

- DefenderAPILogger
- DefenderAuditLogger

Are those the two things that are causing EtwRTDefenderApiLogger to go nuts? Is it safe to mark both of those as disabled?

I tried disabling those two listed above.

DefenderAuditLogger allowed me to uncheck the "enabled' checkbox.

DefenderAPILogger pops up a window saying "When attempting to commit the changes the following system error occurred: Access is Denied".