Disable WMI logging.

wmiprov.log
Mostly necessary for WMI script developers or system administrators when
searching for the cause of errors. For the average user these logs make no
sense and can just as well be disabled to avoid unnecessary I/O and
defragmentation.
C:\WINDOWS\system32\wbem\Logs

Administrative Tools | Computer Management | Click on [+] Services and
Applications | Right click on WMI Control | Click on properties | Click on
Logging. Change the logging level to Disabled.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In newswal843sf29j$.32jh2rjt8dmr.dlg@40tude.net,
Tom Quan <tquan@telleride.com> hunted and pecked:
>> In summary, do you have insight into why filemon report thousands upon
>> thousands of access to wmiprov.log and why these logs contain these
>> errors?
>
> If it helps us get to the bottom of this, here is the filemon log showing
> constant and repetitive access to wmiprov.log yet not showing SUCCESS even
> though the content of the logs seem to show constant failure (as noted).
>
> 5 10:20:08 AM wmiprvse.exe:1660 FASTIO_QUERY_STANDARD_INFO
> C:\WINDOWS\system32\wbem\Logs\wmiprov.log SUCCESS Length: 9225
>
> 6 10:20:08 AM wmiprvse.exe:1660 FASTIO_QUERY_STANDARD_INFO
> C:\WINDOWS\system32\wbem\Logs\wmiprov.log SUCCESS Length: 9225
>
> 7 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_WRITE
> C:\WINDOWS\system32\wbem\Logs\wmiprov.log SUCCESS Offset: 9225 Length: 78
>
> 8 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CLEANUP
> C:\WINDOWS\system32\wbem\Logs\wmiprov.log SUCCESS
>
> 9 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CLOSE
> C:\WINDOWS\system32\wbem\Logs\wmiprov.log SUCCESS
>
> 10 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CREATE
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Options: OpenIf Access:
> All
>
> 11 10:20:08 AM wmiprvse.exe:1660 FASTIO_QUERY_STANDARD_INFO
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Length: 9303
>
> 12 10:20:08 AM wmiprvse.exe:1660 FASTIO_QUERY_STANDARD_INFO
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Length: 9303
>
> 13 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_WRITE
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Offset: 9303 Length: 89
>
> 14 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CLEANUP
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS
>
> 15 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CLOSE
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS
>
> 16 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CREATE
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Options: OpenIf Access:
> All
> 17 10:20:08 AM wmiprvse.exe:1660 FASTIO_QUERY_STANDARD_INFO
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Length: 9392
>
> 18 10:20:08 AM wmiprvse.exe:1660 FASTIO_QUERY_STANDARD_INFO
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Length: 9392
>
> 19 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_WRITE
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS Offset: 9392 Length: 39
>
> 20 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CLEANUP
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS
>
> 21 10:20:08 AM wmiprvse.exe:1660 IRP_MJ_CLOSE
> C:\WINDOWS\system32\WBEM\Logs\wmiprov.log SUCCESS