PowerShell Transcript Files Filling Disk on Cribl Edge Windows Nodes

Symptom

Cribl Edge Windows nodes experience high disk usage caused by large PowerShell_transcript.<host>.*.txt files accumulating in a Cribl directory, C:\Program Files\Cribl\bin\). Files can grow to 50–130MB+ each, with total disk consumption exceeding 12GB per node.

Environment

• Cribl Edge 4.15.0
  • However, any Cribl Edge version on Windows can be impacted where Use Windows Tools is toggled ON
• Windows Server
• Group Policy Object (GPO) with PowerShell transcription logging

Resolution

1. Navigate to Edge > Fleets > select the affected fleet > More (dropdown) > Sources > Windows Event Logs.
2. Click on Advanced Settings > Use Windows Tools toggle. If it is toggled ON, toggle it OFF.
   • When toggled OFF, the Windows Event Logs source uses the native Windows Event Log API and no PowerShell processes are spawned for event log collection.
3. Click Save, then Commit & Deploy the configuration change to the fleet.
4. If other sources such as Windows Metrics or System State also have Use Windows Tools toggled ON, repeat the same steps for those sources.
5. Delete the existing PowerShell_transcript.<host>.*.txt files from the Cribl bin directory on affected nodes to reclaim disk space.

Note: If any Exec sources are enabled and use powershell in their command, those sources will continue to spawn PowerShell. To try and address those, consider tuning the interval or cron schedule in an effort to reducing their run frequency.

Cause

The Use Windows Tools setting in the Windows Event Logs source causes Edge to collect event logs via PowerShell cmdlets (Get-WinEvent, ConvertTo-Json) instead of the native Windows Event Log API. This spawns PowerShell processes that run continuously.

When the Windows servers has GPO-enforced PowerShell transcription enabled, every PowerShell cmdlet execution is logged to a transcript file on disk. Because the Windows Event Logs source polls event log channels every few seconds and each poll executes multiple cmdlets, the transcript files accumulate millions of entries and grow to hundreds of megabytes.

Starting with Edge 4.8.0, the Windows Event Logs source defaults to the native Windows API (no PowerShell and the recommended for newer Cribl versions). However, if the Use Windows Tools toggle was manually enabled or toggled ON from an older configuration, the legacy PowerShell method remains active.

Last Validated

Cribl Edge 4.15.0

Additional Information

For more information, see Windows Event Logs Source - Advanced Settings.