# CollectGuestLogs.exe – High Disk Usage on Azure VM If CollectGuestLogs.exe is hammering disk on an Azure VM, check the Azure Guest Agent log-collection behavior and reduce that workload before the VM becomes unusably slow. blog 26 Jun 2018 de ![CollectGuestLogs.exe – High Disk Usage on Azure VM](/wp-content/uploads/2018/06/img_5b3283c0eeb85.png) [Bilder ansehen (4)](#pf-content-image-1-0) **CollectGuestLogs.exe** is part of the Azure Windows Guest Agent tooling, and under normal conditions you rarely notice it. In one customer environment, however, it became the main source of disk activity and made the VM feel slow almost all the time. While investigating the performance problem, I noticed the process was doing heavy reads against **Security.evtx**. Once that log grew large enough, the process appeared to get stuck in a constant read/write loop. In our case the disk impact ranged from roughly **5 MB/s** to **30 MB/s**, which was more than enough to hurt the machine. [!\[Process activity showing CollectGuestLogs.exe causing heavy disk usage on an Azure virtual machine\](/wp-content/uploads/2018/06/img_5b32830de520a.png)](/wp-content/uploads/2018/06/img_5b32830de520a.png) ## What I changed - Open `C:\WindowsAzure` [!\[WindowsAzure folder opened to locate the Azure Guest Agent installation directory\](/wp-content/uploads/2018/06/img_5b32835ce8c5b.png)](/wp-content/uploads/2018/06/img_5b32835ce8c5b.png) - Find the newest version of the **Guest Agent** [!\[Azure Guest Agent version folder showing where CommonAgentConfig.config can be edited\](/wp-content/uploads/2018/06/img_5b328383767a6.png)](/wp-content/uploads/2018/06/img_5b328383767a6.png) - Open `CommonAgentConfig.config` [!\[CommonAgentConfig.config with enablePushInVMLogs set to false to stop CollectGuestLogs.exe disk activity\](/wp-content/uploads/2018/06/img_5b3283c0eeb85.png)](/wp-content/uploads/2018/06/img_5b3283c0eeb85.png) - Find `enablePushInVMLogs` and set it to `false` - Restart the **RDAgent** service ## Why this helps This reduces the guest-agent log push behavior that was triggering the constant disk churn in the environment I was working on. In our case, that was enough to stop the sustained disk pressure and bring the VM back to normal responsiveness. ## Current note Microsoft still documents **CollectGuestLogs.exe** as part of the Azure Windows Guest Agent automatic log collection feature on Azure VMs. So even though this post describes an older field workaround, the process itself is still real and still part of Azure VM guest diagnostics. As always with agent-level changes, treat this as a targeted troubleshooting step. If you rely on those guest logs for support workflows or diagnostics, make sure you understand what you are reducing before you leave the setting disabled. ## Zugehörige Projekte Projekte, die zu Tags, Kategorien und Inhalt dieses Beitrags passen. [Alle Projekte](/de/projekte/) Projekte werden abgeglichen... [Zurück zum Blog](/blog) ## Ähnliche Beiträge - [Accessing AzureVM with NLA and broken domain trust relationship](/de/blog/accessing-azurevm-with-nla-and-broken-domain-trust-relationship/) - [Free Microsoft Azure/Office365 Fundamentals Training starting February 6th 2023](/de/blog/microsoft-fundamental-free-training-starting-february-6th-2023/) - [Getting Azure Health by parsing HTML using PSParseHTML](/de/blog/getting-azure-health-parsing-html-website-using-psparsehtml/)