WSLg msrdc.exe high-frequency RdClientAutoTrace writes: expected behavior and IPC-related?

[cavanaug]

Windows build number:

26100.7781

Your Distribution version:

Debian GNU/Linux 13

Your WSL versions:

WSL version: 2.6.3.0
Kernel version: 6.6.87.2-1
WSLg version: 1.0.71
MSRDC version: 1.2.6353
Direct3D version: 1.611.1-81528511
DXCore version: 10.0.26100.1-240331-1435.ge-release
Windows version: 10.0.26100.7781

Steps to reproduce:

1. Start WSL / WSLg (Linux GUI integration active).
2. Observe msrdc.exe running from C:\Program Files\WSL\msrdc.exe with command line including:
   msrdc.exe /wslg /silent ... /plugin:WSLDVC_PACKAGE ... "C:\Program Files\WSL\wslg.rdp"
3. Monitor %LOCALAPPDATA%\Temp\DiagOutputDir\RdClientAutoTrace\.
4. Observe continuous writes to:
   MSRDCEventProcessor_0.etl, MSRDCEventProcessor_1.etl, MSRDCEventProcessor_2.etl.

Expected behavior:

This volume of continuous ETL writes seems unusual for normal end-user operation unless it is intentionally part of a high-frequency IPC/transport path for WSLg.

Could you confirm whether this write pattern is expected/normal for WSLg, and if it is IPC-related, whether there is a supported way to reduce trace volume in non-debug scenarios?

Actual behavior:

msrdc.exe continuously writes ETL files in %LOCALAPPDATA%\Temp\DiagOutputDir\RdClientAutoTrace\ at high frequency while WSLg is running.

Observed process details:

• Executable: C:\Program Files\WSL\msrdc.exe
• Parent chain: wslservice.exe -> wslhost.exe -> msrdc.exe
• Command line includes:
  /wslg /silent /plugin:WSLDVC_PACKAGE /wslgsharedmemorypath:WSL\<vm-guid>\wslg "C:\Program Files\WSL\wslg.rdp"

Observed volume on this host:

• ~649 FileCreate events/hour to the three rotating MSRDCEventProcessor_*.etl files (via Sysmon monitoring).

WSL logs:

Not attached yet. I can provide /mnt/wslg logs (weston.log, stderr.log, pulseaudio.log) if needed.

WSL dumps:

None observed.