Glasswire writing hundreds of GB per day

After the reports of Spotify causing excessive writes to drives recently, I decided to check my own system.
Well Spotify hasn’t been a problem for me - but GlassWire is.

My current system uptime is 46 hours and GlassWire has written 375GB of data.

Checking HD Sentinel shows that my SSD’s total host writes number has been spiraling out of control so this is not an error in Process Explorer.

I’ve also had problems with GlassWire’s log files ballooning in size - often to tens of GB and having to manually clear them every month or so.

Something is going very wrong here.
I suspect that applications which are making lots of small connections are causing this.
I don’t know what the solution is, but I find that I don’t need the highly specific information that GlassWire is logging all the time. I only really need a generalized look at how much bandwidth an application has used each day this week, then four weekly averages and monthly averages after that, not being able to see every single connection an application has made to the minute from months ago. Would a “light” logging option fix this?

Maybe GlassWire just isn’t the program for me?
It’s mainly the firewall functionality that I’m using, and I find that once you actually have a list of hundreds of applications, it starts to become unmanageable for that purpose with no search/sort options or automatic block/ignore/allow rules.

Hmmm The main Glasswire.exe shows in my process explorer but I can’t get the actual service to show up and what it’s written and read.

I’m on Win 10. Is there an option I’m missing to have procexp show service executables and their R/W??

Thanks,
Matt

I use a default configuration of Process Explorer and have no problems seeing GlassWire services on Windows 10:

Same here.

Fix this, i dont like Glasswire destroying my SSD!

Glasswire tries to be as flexible as possible in what it does and the way it does things. It keeps quite a detailed amount of information in a fairly compact way because the big problem with logging is that the user does not necessarily know what they need until something happens and even then they may need completely different information than they did on a previous occasion. I guess you could say that logs are a little like insurance policies in that you hope that you do not need them but ….

I am sure it would be possible for the team to add some facilities such that you either store less information or perhaps allowing some granularity to be wiped after a certain period of time. This later option may be the better balance.

If you consider how it stores information relating to each separate process you can see how the amount of data soon mounts up but then again to find out what went wrong with something say 10 days ago you need this granularity really.

Depending on speed and amount of data being stored it may be possible to redirect these logs to a traditional HDD without performance degradation or perhaps to a ramdisk as a larger buffer?

Cheers

1 Like

Yes, GlassWire logs data so it has to write to your HD. To avoid this you can set GlassWire to Incognito mode by going to the top left GlassWire menu and choosing “Incognito”.

I have also read about the Spotify problem, but the issues are not the same. GlassWire is an application that is made to log network data, so it will write data to your hard drive. With Spotify’s case it was a bug because Spotify is not a logging program that logs information so it should not write to the hard drive much at all.

Users who use Bittorrent will probably write significantly more data than a normal GlassWire user because Bittorrent uses so many hosts simultaneously. Therefore switching to “Incognito” while using Bitorrent will solve the issue.

We may add a mode in the future that allows you to not log any IP information if users are very concerned about writing any data to their hard drive. This concern has been discussed below also.

It’s understandable that GlassWire has to write a lot of data due to how much it’s logging.
I did not expect it to be something in the region of 150GB/day though.

Incognito Mode works but enabling the option only seems to be temporary - it switches back to regular mode the next time GlassWire is started.

And it seems to defeat the purpose of using GlassWire to disable logging entirely.
It sounds like the best option may be different “logging levels” where you could choose between Full/Partial/Off.

Or perhaps it might be possible to exclude certain applications from the full logs to avoid constant writes to the drive.
Perhaps there could be a control for granularity of logging? Cache the past X minutes in RAM and then only write the total bandwidth used in that period to disk, without logging all the IP addresses.

Do you use Bittorrent? Moving your database is another option.

To move your database to another HD please create a “glasswire.conf” file in notepad with these two lines only (the lines in quotes):
"# db_file_path=\glasswire.db
db_file_path=d:\glasswire\glasswire.db"

This file should be copied to the c:\programdata\glasswire\service folder
The database path is set to D:\glasswire\ folder in the file sample, but you can change the path to something else.

You should restart the GlassWire service when the file is copied.

Yes, when developers make it an option to download their application/game via BitTorrent, I always use it to do what I can to help keep their hosting costs low.
Examples would be LibreOffice or DRM-free games/soundtracks purchased on the Humble Store.

Moving the database doesn’t really help, it just shifts the problem to another drive.
I’m aware of having to stop the service first, because I had to delete another 60GB ‘stats’ file today.

Bittorrent uses an enormous number of hosts that are logged to your hard drive. GlassWire does not write that much with non-Bittorrent usage of the application.

You should switch to Incognito mode if you don’t want to write any logs while using Bittorrent.

We will probably add a feature in the future where you can just log app usage and not host usage for people who don’t want to write many logs.

Also please keep in mind that Bittorrent itself also writes files to your hard drive and uses it.

But i dont use Bittorrent.
Just normal Browsing and Play Overwatch.

And everyday Glasswire write 30-50 GB Data on my SSD.
Thats INSANE!

It would be very nice you fix this problem like Spotify did.

@DevNull

There is a difference between I/O read\write operations and actual read\write operations.

Any process can read\write to disk to store or load data.

Also any process can read\write data to the network connection when it wants to receive or send data to another host. And a process can read\write data to a device driver for driver interaction.

Writing and reading operations are called Input\Output (IO) operations. So ProcessExplorer’s “IO read bytes” or “IO write bytes” stats are about the total amount of bytes transmitted as IO operations. In other words 8GB of “IO write bytes” means that the total amount of bytes written by GlassWire to a network connection or to disk or to a device driver is 8GB, but it does not mean that GlassWire has written 8GB to disk.

We tested this ourselves with ProcessExplorer and we estimated with heavy network usage GlassWire might write about 200MB to disk over a 7 day period while GlassWire is sending around 7.8GB of data from its user interface to its driver (not writing to the SSD).

If you want to see the real amount of data written to the SSD you should check the “Disk Write Bytes” column of ProcessExplorer.

With GlassWire 2.0 we plan to have a setting to disable host monitoring if you don’t want to write to your SSD at all.

You can also move your GlassWire database to another HD as explained above by me in another post.

1 Like

@Ken_GlassWire

Thank you for your detailed description.
Its good to know, that IO Wrire issent write on Disk.

I installed Glasswire Again

1 Like

May be is possible to add checkbox that allow or disallow logging for custom applications.

I have same issue and using time by time utorrent, but not frequntly. Windows say glassware write 150Gb in 1 day.

An option should be added. Let the user choose if logging needs to be enabled or disabled.
If possible what type of logs to be enabled or disabled as well.

You may have missed it above but you can turn on “incognito” mode to not log anything. This is on the top left GlassWire menu and it’s free for everyone.

Meanwhile for 2.0 we are going to add the ability to not log hosts if you don’t want to write any data to your drive.

So today i had 10GB network usage, and 5.5GB Disk writes from GlassWire. Is that normal? What exactly is GW writing and where it is writing? I definitely havent lost 5.5GB space on my C drive. What files and folders do i need to check for those huge files that some other people do get?

In other words 8GB of “IO write bytes” means that the total amount of bytes written by GlassWire to a network connection or to disk or to a device driver is 8GB, but it does not mean that GlassWire has written 8GB to disk.

You are not correct, try using Process Monitor to monitor Write Operations of GWCtlSrv.exe then export them to csv and do some excel magic to sum up length of non-cached writes (those with “I/O Flags: Non-cached” as only those are real writes to disk). I did this right now and the number I got was the same as incresed difference of “I/O Write Bytes” in Process Explorer.

If you want to see the real amount of data written to the SSD you should check the “Disk Write Bytes” column of ProcessExplorer.

Also, not correct, see this example:


Using Total Commander I copied 2GB file from one HDD to another. Do you see any Disk Writes in Total Commander? No, but you can see them under System. Those 2GB I/O Read Bytes from System are from VeraCrypt driver (source HDD is encrypted, destination HDD is not)

@Kapela86, in your first example I don’t think that you disproved @Ken_GlassWire’s statement because it depends what is happening on your computer.

In his examples, disk writes are often a lot less than I/O writes. In your example, they are the same. In my example, disk writes are somewhat more than I/O writes.

Here’s an example where GlassWire had been running for less than an hour (3:42 to 4:35).

I don’t think that you’ve disproved the second quote either. Your example does show that the disk writes are not necessarily recorded for the process a user is interacting with. But the quote was in relation to GlassWire and you haven’t actually shown that there are additional disk writes for GlassWire that Process Explorer records under a different process.

Maybe you’re right, still, it doesn’t change the fact that Glasswire is writing a lot of data. I noticed it some time ago and symlinked that folder to my HDD. There is no gui configuration to change it or to disable it. I for once don’t care about “Usage” tab, I use Firewall and Alerts from free version, I should be able to disable it.

1 Like