3 ms·

I think it is not true in this case. The thing that does telemetry in Windows is called SQM AFAIK. I think it might use ETW sometimes, but this is only one thin

by yuhong 10y ago

I think it is not true in this case. The thing that does telemetry in Windows is called SQM AFAIK. I think it might use ETW sometimes, but this is only one thing ETW can be used for.

acqq 10y ago
I'm quite sure Windows uses ETW on various places: searching for etl files, I find 136 on my C: disk, and all are generated by the system, and not due to my debugging actions. E.g. C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl C:\Users\myname\AppData\Local\Microsoft\Windows\SkyDrive\logs\app\SkyDriveApp-2015-08-30.2157.4952-1.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveCommLast.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.Mail.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.People.etl C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashApp.etl C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashShare.etl C:\Windows\Inf\netcfgx.4.etl C:\Windows\Logs\PBR\RjvTrace_Configure.etl C:\Windows\Logs\SystemRestore\restore.0.etl C:\Windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{fef283f0-94cd-4a98-a8e7-4fd5e3eca941}\snapshot.etl C:\Windows\System32\wdi\LogFiles\BootCKCL.etl C:\Windows\System32\wdi\LogFiles\SecondaryLogonCKCL.etl C:\Windows\System32\wdi\LogFiles\ShutdownCKCL.etl C:\Windows\System32\wfp\wfpdiag.etl If we would track everything that their different telemetries uploads, I'm quite sure .etl files would be somewhere inside. Or that their number rises with the installation of the KB updates that mention telemetry (e.g. everything related to "prepare your system for Windows 10," for example). Or that they really planned to use .etl files too fro these purposes but just haven't yet. But the .etl are widely used, they are simply system-level provided effective logs. Everybody can check for himself too.
- yuhong 10y ago
  The point is that the particular ETW logs in question in this case are unlikely to be in the list.
  - acqq 10y ago
    Personally I don't see that they invade privacy more than they can with other their information gathering methods, I however do belive that the names weren't given randomly but really related to some telemetry they planned, even when unfinished.

by yuhong 10y ago

I think it is not true in this case. The thing that does telemetry in Windows is called SQM AFAIK. I think it might use ETW sometimes, but this is only one thing ETW can be used for.

acqq 10y ago

I'm quite sure Windows uses ETW on various places: searching for etl files, I find 136 on my C: disk, and all are generated by the system, and not due to my debugging actions. E.g. C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl C:\Users\myname\AppData\Local\Microsoft\Windows\SkyDrive\logs\app\SkyDriveApp-2015-08-30.2157.4952-1.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveCommLast.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.Mail.etl C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.People.etl C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashApp.etl C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashShare.etl C:\Windows\Inf\netcfgx.4.etl C:\Windows\Logs\PBR\RjvTrace_Configure.etl C:\Windows\Logs\SystemRestore\restore.0.etl C:\Windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{fef283f0-94cd-4a98-a8e7-4fd5e3eca941}\snapshot.etl C:\Windows\System32\wdi\LogFiles\BootCKCL.etl C:\Windows\System32\wdi\LogFiles\SecondaryLogonCKCL.etl C:\Windows\System32\wdi\LogFiles\ShutdownCKCL.etl C:\Windows\System32\wfp\wfpdiag.etl If we would track everything that their different telemetries uploads, I'm quite sure .etl files would be somewhere inside. Or that their number rises with the installation of the KB updates that mention telemetry (e.g. everything related to "prepare your system for Windows 10," for example). Or that they really planned to use .etl files too fro these purposes but just haven't yet. But the .etl are widely used, they are simply system-level provided effective logs. Everybody can check for himself too.

yuhong 10y ago
The point is that the particular ETW logs in question in this case are unlikely to be in the list.
- acqq 10y ago
  Personally I don't see that they invade privacy more than they can with other their information gathering methods, I however do belive that the names weren't given randomly but really related to some telemetry they planned, even when unfinished.