How can I trim down my WRData folder as it's getting really big?

I know you can dump it and let it start over, but usually we advise making sure that there are no unknowns being monitored before doing that, to address point 2. Not sure on question 1 - there may be stuff in the logs but I generally don't delve that deep into the tech side. I'd say give support a call. I'll also ping one of them to take a look at this post.

I just checked in with support - they confirmed what I suspected. While the logs will show you when monitoring started, that's a moot point because you can't selectively delete parts of the wrdata folder. They recommend looking at the logs with you to figure out what was being monitored and get that whitelisted, then do an uninstall and reinstall to force recreation of the wrdata folder. I know that you can also manually delete it and recreate it, at least from some experiments that folks on the consumer side have done on the community, but that's not officially recommended. The other thing I know is ongoing work is that dev is trying to make that folder get cleaned up better when processes stop getting monitored. Right now stuff gets left behind and piles up, as you've noticed.

Ah ok.
 
I'm in the process of upgrading my work notebook now to Windows 10, so I've since uninstalled the agent, completely deleted the WRData folder and will re-install after the upgrade finishes.
 
I was shocked to see 48+GB there.
 
And yes, finding a way to parse the data once a software has been whitelisted or a determination has been made would be beneficial.

In an ideal world stuff would be whitelisted and the WRData folder purged quickly. Are you installing lots of new software that is getting monitored? That's the only reason I could think of that your folder would be filling up that fast. Is it just your machine or happening to others in your company as well?

In my case, it's likely over time.
 
We have A LOT of software being monitored across all of our client sites.
 
Especially things like database software for clinics etc...
 
 

Makes sense. I'd say talk to support about it and see if they have any recommendations about how to handle it over time. Perhaps a monthly review of any unknowns being monitored, or a periodic uninstall/reinstall to clear out WRData.