Help CenterThe ThreatLocker Detect product includes an Event Log Watcher that is designed to monitor the Windows Event Log for important security and system activity. In most environments, this process runs quietly in the background with minimal resource usage.
However, in certain Windows configurations, particularly on systems that generate large volumes of event logs, the Event Log Watcher may receive events faster than it can process them, causing increased memory usage.
The Option "UseBlockingCollectionOnWatcher" can be enabled to normalize memory usage.
When this Option is enabled, the Event Log Watcher will use blocking collection logic, which helps to regulate the flow of incoming events so they are processed in a more controlled and efficient manner.