What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WPR_initiated_DiagTrackAotLogger_WPR System Collector.etl is an Event Tracing for Windows (ETW) recording created by Windows Performance Recorder (WPR). If the recording remains active, Windows continues appending events to the ETL file, which can consume disk space and bandwidth. In an elevated Terminal, check it with wpr -status, then use wpr -cancel to discard an unwanted trace or wpr -stop C:Tempwpr-trace.etl to save one needed for analysis. If WPR cannot stop the session, identify it with logman query -ets and stop the exact session name using logman stop "<session name>" -ets.
What this ETL filename means
Windows Performance Recorder is Microsoft’s front end for Event Tracing for Windows (ETW). Microsoft describes WPR as a tool that records detailed system and application behavior and resource usage, usually for troubleshooting. Windows Performance Analyzer (WPA) then opens the completed recording so you can inspect CPU, disk, memory, and other activity.
As an Amazon Associate I earn from qualifying purchases.
The filename identifies a trace output associated with WPR collectors. WPR’s General profile uses an NT Kernel Logger Collector and a WPR_initiated_WPR Event Collector. Names containing DiagTrackAotLogger vary with Windows build and recording profile, so the exact spelling on your PC may differ. The important part is the WPR_initiated_…WPR System Collector.etl pattern: it is an ETW trace file, not an ordinary application cache or a Windows component that must be kept for normal operation.
Why the file can cause sustained disk activity
When a WPR recording starts, it continues until a stop action completes. Every event collected during that period is written to the trace output. A session that was started accidentally, left running after a diagnostic exercise, or failed to stop can therefore keep extending the ETL file while the System process shows high disk usage.
#1 Best Overall
- [INTEL POWERED CONTENT] - Built with a 8th Generation Hexa-Core Intel i5 and 32GB of DDR4 RAM; Modern, Windows 11 ready, with 4K support, Executive multitasking, media streaming and smooth, multi-tab web browsing; Perfect as an all-purpose multimedia computer; built for content creators; Plenty of RAM and Mass storage for photo and video editing powered by Intel HD 630
- [LATEST WIRELESS TECH] - This Dell Desktop Computer easily connects to the internet through the Built In WiFi / Bluetooth
- [SOLID STATE STORAGE] - This Dell Computer setup comes with an ultra-fast 1TB Solid State Drive (SSD); Setup as the primary boot device; Boot and load programs with lightning speed ; Additional expansion available
- [BUY & OWN WITH CONFIDENCE] - From the world's largest Microsoft Authorized Refurbisher; Quality Guarantee and Free Tech Support; Award-winning Customer Service; | Support Sustainable Business
- [MODERN HI-SPEED PORTS] - USB 3.0 (x4) | USB 2.0 (x4) | DisplayPort (x1) | HDMI Port (x1) | Audio Combo Jack (x1) | Audio Out (x1) | RJ-45 Ethernet (x1) | Internal SATA (x3)
Microsoft Q&A includes an incident in which both WPR_initiated_WprApp_WPR System Collector.etl and WPR_initiated_WprApp_WPR Event Collector.etl grew continuously while System consumed disk bandwidth. That report demonstrates the failure mode, but it is not a promise that every computer will grow at the same rate. There is no dependable universal growth-rate, maximum-size, or throughput figure for this exact logger. Measure the file size and disk activity on the affected machine instead of relying on a claimed number.
- An active trace explains why the file keeps growing; deleting a file while its session is still active does not solve the underlying writer.
- The logger name and output path can change with Windows versions, profiles, and diagnostic tools.
- A completed ETL may be large but harmless once the recording has stopped; the immediate concern is a session that is still writing.
Before you stop anything
Confirm that the file is really changing
Note the ETL’s full path, current size, and “Date modified” value in File Explorer. Wait a few minutes and check again. A stable, completed trace is a storage-cleanup decision, not an active-recording problem. If the size or modified time increases, continue with the session checks below.
Use an elevated terminal
Open Start, type Terminal (or Command Prompt), right-click it, choose Run as administrator, and approve the User Account Control prompt. WPR and ETW-session commands can fail or return incomplete information without elevation.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsPreserve evidence when support needs it
If the high disk usage is part of a support case, do not discard the only trace before asking what evidence is required. Saving a trace gives support or an analyst something to inspect in WPA. If the file is simply consuming the system drive and no investigation requires it, cancellation is usually the quickest way to stop new writes.
Rank #2
- Model: Dell OptiPlex 7050 Small Form Factor (SFF)
- Processor: Intel Core i7-7700 3.60 GHz
- Memory: 32GB DDR4 Ram
- Storage: 1TB Solid State Drive (SSD) Fast Boot + Storage
- Operating System: Windows 11 Pro (64-bit)
Step 1: Check whether WPR has an active recording
- In the elevated Terminal, run
wpr -status. - Read the result for recording state and the collectors currently running. Microsoft documents
-statusas the WPR command that displays this information. - Look for a session or collector corresponding to the
WPR_initiated_…ETL. Record the exact names shown; they may not match the filename character-for-character.
If the command reports no active recording, the ETL may already be complete, or another ETW controller may own the session. Recheck whether the file is still growing, then use the fallback inspection later in this guide.
Step 2: Cancel an unwanted recording
Use cancellation when the trace is not needed for diagnostics and your priority is to stop disk writes without creating another saved copy.
- Run
wpr -cancelin the elevated Terminal. - Wait for the command to return. Do not close the terminal immediately if it reports an error or that no recording is active.
- Run
wpr -statusagain. The recording should no longer be active. - Check the ETL’s size and modified time. They should stop changing once the writer has closed.
Cancellation discards the in-progress recording. It is different from deleting the ETL: the WPR session must be cancelled first so that Windows stops writing to it.
Recommended Free Tools
Step 3: Stop and save a trace you need
Choose this path when support, troubleshooting, or your own analysis requires the captured data.
Rank #3
- IMMERSIVE 24 INCH DISPLAY: Experience stunning clarity on a Full HD IPS screen with ultra-thin bezels, offering a 90% screen-to-body ratio that makes everything from spreadsheets to streaming come alive with vibrant colors and crisp details.
- POWERFUL INTEL PROCESSING: Tackle demanding tasks with ease thanks to the Intel processor and 16GB of high-speed memory, delivering smooth performance whether you're multitasking between applications or running productivity software.
- GENEROUS STORAGE: Store all your important files, photos, and programs with blazing-fast solid state drive technology that ensures quick boot times, rapid file access, and plenty of space for your digital life.
- ENHANCED PRIVACY AND COLLABORATION: Work confidently with the pop-up privacy camera that tucks away when not in use, plus dual microphones with noise reduction for crystal-clear video calls that keep you connected professionally.
- ECO-CONSCIOUS DESIGN: Feel good about your purchase with an EPEAT Gold registered and ENERGY STAR certified computer that combines premium performance with responsible environmental manufacturing practices.
- Create or choose a destination on a drive with adequate free space. The example below uses
C:Temp; substitute a path that exists on your computer. - Run
wpr -stop C:Tempwpr-trace.etl. - Wait until WPR confirms that the recording has stopped and the ETL has been written. A large trace can take time to finalize.
- Run
wpr -statusto verify that the recording is no longer active. - Check that the saved file exists and has stopped growing before opening it for analysis.
Microsoft documents -stop as stopping the recording and saving an ETL file. Use a destination with enough free space; saving can require additional room while the output is finalized.
Step 4: Use Logman when WPR will not stop the session
Sometimes wpr -cancel or wpr -stop returns an error, reports no recording, or leaves the ETL growing. In that situation, inspect the active ETW sessions directly.
- Run
logman query -etsfrom the elevated Terminal. - Find the entry associated with the WPR output. The session can have a build- or profile-specific name beginning with
WPR_initiated_. - Copy the session name exactly as displayed, including spaces and punctuation.
- Stop that exact session with
logman stop "<session name>" -ets. Replace the angle-bracketed text with the copied local name; keep the quotation marks when the name contains spaces. - Run
logman query -etsagain and confirm that the session has disappeared or is no longer active. - Check the ETL’s modified time and the disk activity. Both should settle after the writer closes.
This fallback controls the ETW session directly. Do not guess a session name or stop unrelated collectors: stopping the wrong logger can interrupt another diagnostic or monitoring task.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat to do if the commands report errors
“No recording” or an empty WPR status
First verify whether the ETL is still growing. If it is not, you are looking at a completed trace and can decide whether to retain or remove it. If it is growing, run logman query -ets; another controller may have created the session, or the WPR-facing state may no longer reflect the active ETW session.
Rank #4
- This Certified Refurbished product is tested and certified to look and work like new. The refurbishing process includes functionality testing, basic cleaning, inspection, and repackaging. The product ships with all relevant accessories, a minimum 90-day warranty, and may arrive in a generic box. Only select sellers who maintain a high-performance bar may offer Certified Refurbished products on Amazon.com.
- Dell Optiplex 3050 SFF Desktop computer PC, Intel Quad Core i5-6500 up to 3.6GHz, 16GB DDR4, 256GB SSD
- Includes: USB Keyboard & Mouse, USB WiFi adapter, Microsoft office 30 days free trail.
- Port: Front: USB 3.0(2), USB 2.0(2); Rear: DP, HDMI, USB 3.0(2), USB 2.0(2), RJ-45.
- Support 4K (3840x2160) Dual display, makes it easy to connect two monitors at the same time, and you can expand working Windows, mirror content, or expand a single window across multiple monitors.
Access denied
Close the window, reopen Terminal with Run as administrator, and repeat the command. A standard, non-elevated shell may not have permission to query or stop system ETW sessions.
WPR stop fails while the file continues to grow
Do not repeatedly delete the file. Capture the exact error text, run logman query -ets, and stop only the matching WPR session with the quoted command. If the session immediately returns, note what application or support utility is running; a process that owns a diagnostic workflow may be restarting it.
The disk remains busy after a successful stop
Allow time for the ETL handle to close and for pending writes to flush. Confirm that the file’s size is stable, then use Task Manager’s disk column to see whether a different process is responsible. Stopping WPR ends that recording; it does not explain unrelated disk activity from Windows Update, indexing, a failing drive, or another application.
Clean up the ETL safely
Retain it for analysis
Keep a completed trace if support requested it or if you intend to investigate the cause of the slowdown. Record its path and the circumstances under which it was captured so the file remains useful.
Best Value
- Connectivity: Includes WiFi, Bluetooth, and LAN for wireless and wired connections
- Memory: Features 16GB DDR4 RAM for smooth multitasking and performance
- Storage: Combines 500GB SSD and 1TB HDD for ample storage space
- Graphics: Integrated Intel UHD Graphics 630 for crisp visuals and video playback
- Design: Sleek desktop tower with black color and slim profile for modern look
Remove an unwanted completed trace
- Verify with
wpr -statusand, if necessary,logman query -etsthat the corresponding session is stopped. - Confirm that the ETL’s size and modified time are stable.
- Check the full path carefully. Delete only the unwanted completed ETL from that location, using File Explorer or an elevated command prompt if Windows requires permission.
- Empty the Recycle Bin only if you are certain the trace is not needed; deletion is irreversible after that point.
Stopping the recording is the source-backed fix for continued writes. Deleting a completed file is optional operational cleanup and should never be treated as a substitute for stopping its session.
Open the trace in Windows Performance Analyzer
If you saved the ETL, WPA can show what the recording captured before you remove it. Microsoft support guidance describes loading an ETL in WPA, configuring symbols when needed, and using the analysis graphs to identify resource-consuming activity.
- Launch Windows Performance Analyzer and open the saved
.etlfile. - Allow the trace to load; very large recordings can take longer and require substantial free memory and disk space.
- If a graph lacks useful process or module names, configure symbols as appropriate for the analysis environment.
- Use disk- and system-activity graphs to identify which process, provider, or interval corresponds to the reported slowdown.
- Export or document findings before deleting the trace.
The ETL records what the selected WPR profile collected. It does not automatically prove that the WPR logger caused every performance problem on the computer; use the graphs to separate trace-writing overhead from an independent workload.
Prevent the session from returning
If the WPR session reappears after a restart, stopping it once is not enough. Identify what starts it before changing startup configuration.
- Review scheduled tasks, services, startup tracing entries, and diagnostic utilities that were recently used.
- Ask whether a support engineer, performance test, troubleshooting script, or application launched WPR as part of a workflow.
- Compare the exact session name and ETL path each time it returns; collector names are profile- and build-dependent.
- Disable or remove only the confirmed trigger, and retain a way to re-enable it if support still needs diagnostics.
There is no universal, version-independent mapping from DiagTrackAotLogger to one startup component. Verify the trigger on the affected Windows installation rather than disabling a vaguely named service or registry entry.
Quick Recap
Cancel, save, or use the fallback?
| Situation | Action | What happens to the trace |
|---|---|---|
| You do not need diagnostic evidence and disk writes must stop | wpr -cancel |
The active recording is cancelled without saving it. |
| Support or analysis needs the captured events | wpr -stop C:Tempwpr-trace.etl |
The recording stops and is saved as an ETL at the path you specify. |
| WPR commands fail or do not show the active session | logman query -ets, then logman stop "<session name>" -ets |
The matching ETW session is stopped directly; copy its local name exactly. |
| The session is stopped and the file is no longer changing | Retain or delete the completed ETL after checking its path | This is storage cleanup, not a recording-control operation. |
Safety and practical limits
- The ETL is diagnostic data. It is not required as a normal cache for Windows to run.
- Stopping a WPR session can end an intentional investigation, so save it when evidence matters.
- Collector names and filenames can differ between Windows builds and WPR profiles.
- No authoritative typical growth rate exists for this exact logger; local measurement is the reliable way to judge urgency.
- If high disk usage continues after the session is stopped, investigate the process now using the disk rather than assuming the ETL remains responsible.
If you prefer an optional automated shortcut after trying the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, tune settings, clean temporary and cache files, and provide diagnostics such as an app-crash log. It complements an antivirus rather than replacing one; results vary, and no tool repairs every crash. It runs on Windows 11, 10, 8 and 7 with a free trial by category of at least two days before a paid subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
