System volume constantly loses space

[CMeyst]

I have a Dell Dimension 8300 system running Windows XP Professional where the system (boot) drive constantly loses space. This drive is 19GB and after booting has 16GB free. This drive is only used for system files, Windows and those things that insist on installing there. Programs are on a different drive. Swap file, temp files and print spooler are all on a different drive.

I previously had a Dell Dimension 4600 system with a similar configuration that did not have this problem.

I find now that over a 24 hour period, this drive will go from 16GB free to under 300MB free.

I have run virus scans and the system is clean. I used a program that shows total sizes of all folders to compare folder (and file) sizes after a reboot, and later on.

I found that from yesterday afternoon when I booted and had 16GB free to this morning when I was down to 299MB free, there was NO significant change in size of any folders or files. Obviously whatever is causing this is hidden (and not a hidden file or folder, I have those displayed).

Does anyone have any clues as to what to look for? Thanks.

 

[nanaki333]

you can always try running a chkdsk /F to see if that does anything.

 

[CMeyst]

I just tried chkdsk/f with no help. Thanks.

 

[8ballcoupe]

It sounds as though the program you are using to monitor folder and file sizes is not able to see what's growing. (Yes, I am Captain Obvious.) So maybe you need to tell Explorer to let you see EVERYTHING -- including unhiding protected operating system files.

I have seen just this sort of behavior on systems where people have run and misconfigured Bootvis while trying to optimize their boot times. But I'm certain that there are other processes which can cause similar behavior. You might want to look for and think about things that you have done which might cause the aggregation of huge amounts of temporary data that might get purged at boot time.

Ernie

 

[CMeyst]

Thanks 8ballcoupe

I do have operating system files showing (system files and hidden files).

I have indeed used Bootvis -- no idea if it is misconfigured since I accepted its default configuration. If that is the cause, wouldn't all of the space be lost right after booting rather than gradually?

How can I make sure Bootvis is configured correctly?

 

[8ballcoupe]

The Explorer option I was talking about is to UNcheck the option for keeping "protected" system files hidden. It's a different option than showing hidden and system files.

The misconfiguration of Bootvis is easy to cause inadvertently by misinterpreting what's going on and thinking that you're finished with the boot / wait / reboot / wait / reboot process and just going on with life while Bootvis goes on about its business. I would crank up Bootvis and turn everything off. It may well be gathering data constantly. I hope that's really the cause of your problem, because the fix should be simple.

And, no, Bootvis doesn't just gather data during the reboot. It can continuously gather data until it jams your partition full of temporary files. It's not SUPPOSED to work that way, but it can do so on occasion. It has been quite a while since I've bothered with this tool, so that's why I'm not being very specific about exactly what to do in the Bootvis menu system. But look around in there. You essentially want to terminate anything that Bootvis might be doing in an ongoing capacity.

I'm not sure if there's a possibility of a rogue process having been spawned that gets re-launched at every boot and is no longer under the control of Bootvis. You might need to look in Task Manager's Processes tab to see what shows up in there. Considering how much hard drive space it is chewing up the process that's doing it should be using at least a few CPU cycles, though it wouldn't have to be a high percentage.

See what you can find in the menus and what happens after you try to corrrect. If no luck please post back. In the meantime, I will look back through my archives and places online to see if I can get more specific data for your. I know that I fixed this for several people just after Windows XP was introduced and the craze for optimizing boot times caused everyone to be using Bootvis. I haven't seen the problem in quite a while now.

Ernie

PS: Just had a minor flashback. I think the filling of the hard drive gets caused by Bootvis turning on performance counter logging with a registry entry and then being interrupted by the end user before it can turn the logging off. Hence the logging gets reinstated at boot time and eats up all free space on the system partition. We'll find this if we look in the right place.

 

[CMeyst]

Yes, I have had "hide protected system files" unchecked as well as showing hidden files.

I will look into Bootvis (and dismantle it altogether). I have looked at Task Manager a number of times to try to find what causes this, but didn't find anything obvious to me (though I certainly don't know what every single process means).

I will report back after getting rid of Bootvis. Thank you very much.

 

[8ballcoupe]

Please do post back. I'll be away for a couple of hours but will take up the hunt ASAP when I return. I want to know just how this works now, and I'd like to be sure this really IS your problem, too. I'll keep my fingers crossed for you!

Ernie

 

[CMeyst]

Thanks again. I have actually uninstalled Bootvis (and deleted the trace files) to be sure its totally gone. I'll report back a little later to see if its made a difference.

 

[8ballcoupe]

Hmmm. I hope that works out. I didn't mean to remove Bootvis from the system. It makes use of, and provides a sort of GUI front end for, a part of the performance monitoring apparatus which is part of the OS. If it has turned on monitoring then the monitoring has to be turned off somehow -- though not necessarily through Bootvis. But just removing Bootvis probably wouldn't stop what's been happening on your system. That is, of course, if my tiny and ancient brain is remembering this correctly.

And now I really am going to have to hit the road. But I'll be back to try to help a little later if need be.

Ernie

 

[CMeyst]

To be honest with you, I uninstalled it because it wasn't really clear to me as to how to stop its monitoring of the system. I can certainly reinstall it if that's best, but I'll wait to hear back from you if I should do that, and then what I should set or unset in it to be sure it's stopped monitoring.

Thanks again.

 

[CMeyst]

Well, I can tell you that just uninstalling BootVis didn't do it, because I see my space going down again since I rebooted after doing that.

When you have a chance, please give me instructions as to what exactly to do with BootVis after I reinstall it. thank you.

 

[8ballcoupe]

Okay, it's possible we're assuming something that isn't true, but if Bootvis is responsible and the problem is continuing you should be able to find a trace.log file on your system. It should be at

WINDOWS\system32\LogFiles\WMI\trace.log

according to my old notes and what I can find online now.

Fixes --


1. Easy way:

Put Bootvis.exe back on the system. Run it and turn tracing off. After you do that you should probably reboot and delete the trace.log file.


2. Slightly harder way that doesn't require use of Bootvis:

Start regedit and look for this key.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\GlobalLogger\

If you find such a key look for the Start entry and set it to

Start = 0

Then reboot the system. Check to be sure that the trace.log is not growing. If not, delete it.


3. Slightly harder way that can be used to find out what tracelog is up to:

Open a CMD prompt and type this command

tracelog /?

and hit the <Enter> key. It will list everything (probably) that you ever wanted to know about using the tracelog command in Windows XP. If you examine the list closely enough you will be able to have tracelog enumerate all current logging it is performing. Even if Bootvis is not responsible for your woes I am pretty sure that some kind of WMI performance logging is causing them. Tracelog should be able to help you.

I'm very sorry to have taken so long to get back to you, and I'm going to have to help a neighbor with a project now. I know this is a pretty terse message, but I'm rushed for time. I'll try to check back in a bit to see if you have been able to fix the issue.


Ernie

 

[CMeyst]

Thanks I will get to work on this. I can handle the regedit option, and will do that so I don't need to reinstall BootVis now.

I'll report back later.

And, PLEASE don't apologize -- you've been more help on this than anyone else.

 

[CMeyst]

Well, it looks like this has fixed it! I used the regedit solution.

However, I noticed that had 2 other keys containing GlobalLogger

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\GlobalLogger\
and
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\WMI\GlobalLogger\

Both of these and the one you cited in CurrentControlSet had the Start entry set to 1. When I changed it to zero in CurrentControlSet, the one in ControlSet001 automatically changed to zero too, but the one in ControlSet002 stayed at 1 (and I left it that way).

After a reboot the trace.log file was 144,576KB and I had 16GB disk space free, and now after 3 hours of work, they both exactly the same (normally in this time period I would have lost 3-8GB).

Should I now delete the trace.log file? And should I do anything with the registry key for GlobalLogger in ControlSet002? And, is there any value in reinstalling BootVis, and if so, how to set it up to avoid this problem again?

Thank you very, very, very much.

 

[8ballcoupe]

Well, it looks like this has fixed it! I used the regedit solution.

However, I noticed that had 2 other keys containing GlobalLogger

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\GlobalLogger\
and
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\WMI\GlobalLogger\

Both of these and the one you cited in CurrentControlSet had the Start entry set to 1. When I changed it to zero in CurrentControlSet, the one in ControlSet001 automatically changed to zero too, but the one in ControlSet002 stayed at 1 (and I left it that way).

After a reboot the trace.log file was 144,576KB and I had 16GB disk space free, and now after 3 hours of work, they both exactly the same (normally in this time period I would have lost 3-8GB).

Should I now delete the trace.log file? And should I do anything with the registry key for GlobalLogger in ControlSet002? And, is there any value in reinstalling BootVis, and if so, how to set it up to avoid this problem again?

Yes, you can delete the trace.log file now. The CurrentControlSet entry is the only one you need to change, I believe, though there's no harm in changing the one in the 002 section.

With respect to Bootvis, I would only recommend using it in the first place if I had a system that was booting or resuming (from hibernation) very slowly. It has no real value as a "tweaking tool" to try to get a 3 second faster boot time, and, as you have seen, can really cramp your style if things go awry. AFAIK Bootvis doesn't bit like this unless someone turns tracing on and then somehow interferes with the program so that it doesn't get to turn the trace.log off. It's extremely easy to do this because of the way the program works. It's hardly obvious, to someone who doesn't know exactly what to expect, how the program really works. The multiple reboots to allow analysis and optimization are too easy to mistake for the program having already done its thing. So the user goes on using the computer, but with this insidious logging process going on in the background. I wouldn't be at all surprised if you find your computer to be quite a bit more functional now!

You shouldn't be afraid to use Bootvis if you need it, however. Just read up on it at the download site so that you know how to control it properly because it's not a simple point and shoot sort of program. I believe Microsoft has an information page or document on it.

I'm very happy you've got it sorted now, and I'm delighted to have been of some assistance. I'm seldom of much use these days!

Regards,
Ernie

 

[CMeyst]

No, I probably don't really have a need for BootVis, I think I leave it out for now. I'll go ahead and delete the trace.log file. Once again, thank you.

 

[8ballcoupe]

You are most welcome. I'm glad to have "met" you!

Ernie