You can also search for *.etl files to find what is traced. There are Autologger and GlobalLogger for live kernel tracing. Some of the tracing entries are present by default, but others are added by Intel's drivers! I could not control my anger when I discovered it. And it's not the .sys files, but the .inf files that add entries to Autologger. Now if I need to install Intel's drivers I first clean the .inf files. It ruins driver's signature of course, but at least I will not have any tracing sessions constantly written to disk.