Trace.log eating up HD space?!

[xmyxgiantx]

Hey guys, I have a quick question...

With the help of SequoiaView, I was able to figure out what was taking up all my HD space.
Its a file called Trace.log, when I boot up it is about 5MB, last time i shut down it was over 900MB, I recently just installed WinXP and SP1...the only programs I've been using are WinAMP, AIM, IE6, Outlook Express, and Defrag...

any help would be appreciated....

also when ever i try to open it, its either too large, or it just causes notepad/wordpad to freeze.

thanks alot for the help

 

[johnlog]

>also when ever i try to open it, its either too large, or it just causes notepad/wordpad to freeze. <<<

If you cannot delete that file within Windows try deleting it from a DOS window. Just type DEL filename

If that does not work or the file is in use then boot to DOS and type the same thing to delete the file.

Whatever created that huge file may start creating a new one after you delete it.

Just ran a search for LOG files with that name in them. Found 194 files with LOG in their name. I am not sure what those log files are doing or recording so am hesitant to delete any of them. The largest LOG file I found was 21 megs.

 

[prosaic]

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/tracelog-o.asp

Been using Bootvis.exe or Tracelog.exe or some such? If it has been set to run continuously at every boot you can get multi-gigabyte log files. That sort of thing can choke a system pretty quickly.

- prosaic

 

[xmyxgiantx]

hey man, ya im using bootvis.exe on WinXP...is there a way i can disable this file?

 

[prosaic]

You need to read up on how to use Bootvis. There is a whitepaper on the proper use of the utility that you can download from the same area on the Microsoft site. Basically you need to turn it off! It's not supposed to be on all the time except for when you're doing certain types of intense testing. Normally you run it through a several-reboot sequence (or even a single one) and then let it optimize the startup behavior of the system. If you have it running continuously it just builds these humongous logs for troubleshooting arcane startup issues -- which is something you don't really want to be doing.

- prosaic

 

[xmyxgiantx]

hey i downloaded the white paper file, but its not saying anythin on how to remove the trace.log or disable it.

the reason i have bootvis is because i read a tweak guide on www.tweaktown.com

could cacheman be doing this too?

 

[prosaic]

So Bootvis isn't running, eh?

Anything that makes use of the tracelog could be causing this issue. Sounds like something is misconfigured or malfunctioning. You need to find out what is invoking the tracelog function on your system so that you can turn it off. You might try reversing the "tweaks" you're using. You can do that manually, or you might try using System Restore to revert the system to its configuration before all of this began.

If that doesn't help you could use Process Explorer and / or Handle, freeware utilities, that you can download from this site. Process Explorer is a GUI utility that can show you what process is calling the tracelog function. Alternatively, Handle is a CLI utility can show you what process is opening the problem file.

Why are you trying to tweak the system? Were you having a problem with it beforehand?

- prosaic

 

[xmyxgiantx]

Nope, just trying to get the best performance I could before I upgrade...I'm only running a PIII 800MHz and I'm gonna move up to something new. Not sure what..next paycheck will determine that.

But Im going to try those programs right now, thanks man

 

[xmyxgiantx]

okay process explorer is working...found out what is running the program i believe

first of all the processes are as follows
System Idle Process
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SPOOLSV.EXE
LASASS.EXE
EXPLORER.EXE

i searched for trace.log and it says its in 'System'
TYPE: FILE
Handle: Ox570
Access: 0x0012008B
Name:C:\WINDOWS\SYSTEM32\LogFiles\WMI\trace.log

if i right click and choose close handle i can delete the file, but it still comes back when i restart...i really dont want to have to do that everytime...so is there away i can automate the 'close handle' or is there enough info there so you could maybe come up with a solution?

thanks man

 

[prosaic]

Originally posted by: xmyxgiantx
okay process explorer is working...found out what is running the program i believe

first of all the processes are as follows
System Idle Process
System
SMSS.EXE
CSRSS.EXE
WINLOGON.EXE
SERVICES.EXE
SVCHOST.EXE
SVCHOST.EXE
SVCHOST.EXE
SPOOLSV.EXE
LASASS.EXE
EXPLORER.EXE

i searched for trace.log and it says its in 'System'
TYPE: FILE
Handle: Ox570
Access: 0x0012008B
Name:C:\WINDOWS\SYSTEM32\LogFiles\WMI\trace.log

if i right click and choose close handle i can delete the file, but it still comes back when i restart...i really dont want to have to do that everytime...so is there away i can automate the 'close handle' or is there enough info there so you could maybe come up with a solution?

thanks man

Okay, so you're certain that bootvis isn't running continuously? And you're sure that this trace.log file you found in Process Explorer is THE trace.log file that's giving you the trouble, right? (Because there could be more than one file with this name. It's used commonly for all sorts of performance monitoring functions, and the search function in Process Explorer should show you all of them on the system.)

I wanted to check to see if this was going to be some independent module that was causing the creation of a trace log so that you could just tell that module to stop creating the file. As it is I'm not sure whether the log is being generated due to some "tweaking" that you may have done (Did you go into the system admin tools and turn on logging in the system / performance monitor, perhaps as part of a procedure you were following on a tweaking guide?) or if it has been instigated by a call from a program that is either experiencing an error or is creating the log as a normal part of its function (because it has been TOLD to do so by something in the system or software configuration).

The thing is that we want to know WHY it is being created. Just repeatedly deleting the file or whacking whatever process is producing it is not the way I would deal with this. (You can't very well whack the SYSTEM process anyway. ) It's better to learn why it's being generated and then deal with that issue

You might start MSCONFIG and list everything on the Startup tab. We may see something there that may be of help. But I'm thinking that either you or some program you've installed on the system have (perhaps unknowingly) told the system to produce the log. So you should also go into the Performance applet under Administrative Tools and check out what's being logged there. By default there should be very little going on here -- just a sample counter log and no trace logs. What do you see there?

- prosaic

 

[xmyxgiantx]

true, it would be better to find out what is causing this problem...but when i got to admin tools / performance....and i go to expand the performance logs and alerts...it tells me
"This service cannot be started, either because it is disabled or because it has no enabled devices with it"

 

[prosaic]

Ouch! That shouldn't be doing that!

This is beginning to sound like a system misconfiguration issue. I'm wondering if it's possible that you were given some bad advice as you sought information about how to optimize your system. It sounds as though one or more services have been disabled. I'm not sure whether or not this error message is related to the existence and continual buildup of the trace.log file. The possibilities may be too numerous to try to track down through Q&A via a message board.

Did you check the Event Viewer for any error messages pertaining to the creation of the trace.log file, running of a debugger, Wndows Management Instrumentation, etc?

- prosaic

PS: Gonna be away for a little bit. I'll get back here as soon as I can.

 

[xmyxgiantx]

so i just formatted my hd and installed xp again...i got sick of it...but there was nothing on my computer that was important anyway. now i stayed away from all the tweaks i wasnt sure what they did, and its working great.

thanks soo much for the help man

 

[prosaic]

You're welcome.

Heh-heh. Yeah, there's a fair amount of misinformation floating around out there. I only hope that I don't increase the quantity myself. So many of the people with tweaking sites or who post tweaking tips on boards seem unaware or unconcerned that the configuration changes they suggest may work fine on their personal machines and wreak havoc on other people's systems. This is an incredibly versatile OS, and your configuration -- especially if it's an OEM-supplied image that came on a purpose-built comptuer, like a video editing machine or a gaming machine, for instance -- can suffer greatly from some of the more invasive registry fiddling.

Don't get me wrong, I think that it's fun to get in there and poke the buttons, but it's more of a learning experience than it is an exercise in improving the functionality of the OS -- until you've got a lot of experience under your belt with the operating system, anyway. And you have to be ready to blow away the system and start over should the worst occur.

Maybe the worst thing about the tweaking sites is that, just by dint of the way the information is presented as a sort of Smorgasbord of performance tips, the temptation is for us to make wholesale changes in the OS configuration. Once you've made twenty or thirty changes and something goes wrong, you're left wondering just which change or combination of changes scuppered your system. The tweaking sites should, at the very least, post large, bold warning signs telling users to make changes one-at-a-time and to test their systems thoroughly after each change. They should also include warnings about the possible adverse consequences, if known, of each change they suggest instead of just promising you that the Internet will tremble each time you use your mighty computer after you change your receive/transmit window.

Anyway, it was nice talking with you. I'm sorry that I couldn't be of more help to you, but I'm glad to hear that you didn't lose important data and that your system is behaving itself again.

- prosaic