Find Performance Log Registry Keys in Windows

This guide provides the exact Windows Registry locations used to store registered system diagnostic performance logs, Data Collector Sets, and performance trace configurations. You will learn the specific registry paths within the Registry Editor (regedit) to locate, inspect, and manage system diagnostic logging entries.

Primary Registry Path for Performance Logs and Alerts (PLA)

The primary location for registered System Diagnostic and System Performance data collector logs is managed under the Performance Logs and Alerts (PLA) subsystem:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PLA

Inside this key, you will find subkeys corresponding to registered system and user-defined Data Collector Sets: * System: Contains default templates and configurations for built-in diagnostic sessions, including “System Diagnostics” and “System Performance”. * Templates: Holds predefined XML-based collector configurations used to generate diagnostic reports.

Diagnostic Trace Sessions and Autologgers

For event-based diagnostic performance logs and Event Tracing for Windows (ETW) sessions, Windows registers configurations under the WMI Autologger registry hive:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger

Under this path, each subkey represents a registered diagnostic trace session (for example, DiagLog, PerfDiag-Logger, or ReadyBoot). Key values within these folders define: * BufferSize: The size of individual trace buffers in kilobytes. * LogFileMode: Bitmask controlling how the log file is written (circular, sequential, etc.). * FileName: The exact path where the .etl trace log is stored on the disk. * Start: Set to 1 to enable the logger on boot, or 0 to disable it.

Performance Counter Libraries

If you need the registry definitions for the performance counters that supply metrics to diagnostic logs, they are located at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

Individual service-level performance counters are stored within their respective service entries at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ServiceName>\Performance

How to Access These Keys

  1. Press Windows Key + R to open the Run dialog.
  2. Type regedit and press Enter to open the Registry Editor.
  3. Paste any of the paths listed above into the address bar at the top of the Registry Editor window and press Enter to jump directly to the target key.