aria-debug-xxx.log files appearing in TEMP

Topic

New Reply

Another topic prompted a query (since removed) by @doriel about aria-debug-xxx.log files appearing in whatever folder was designated by Windows’ TEMP environment variable.

I too noticed aria-debug-xxxx.log files in my TEMP environment folder for the last 7 days, many with a file creation time of 19:24.

I could find no mention in any event log so fired up Process Monitor (ProcMon) at 19:20 and set it to filter File Activity events for 10 minutes… but to no avail. So, I set a specific filter for a filepath beginning C:\Temp\aria-debug and just left ProcMon to it for 24 hours.

(where a is Start/Stop Capture, b is File Activity only and c is the specific filter.)

IMPORTANT: ProcMon saves events by default to your device’s virtual memory, i.e. the swapfile. Given that ProcMon can capture hundreds, if not thousands, of events per minute it is important that you don’t run out of virtual memory. As a result I changed ProcMon to *drop* filtered events (using the Drop Filtered Events option from the Filter menu), i.e. to only save events to virtual memory that specifically met the filter criteria I had set. Note also: Whilst ProcMon will thus drop the filtered events, it is still capturing them first… so your system will slow, your harddisk activity light will be on constantly and keyboard/mouse responsiveness will suffer.

Anyway… 24 hours on and several aria-debug files have been created (and at least one deleted before I noticed):

It looks like there are two culprits – OneDrive (which I have never logged into or ever used) and the built-in Disk Space Clean-up Manager for Windows utility. YMMV.

I have uninstalled OneDrive… and deleted its installation folder (which wasn’t deleted by uninstallation. More shoddiness?). I’ll check back in a few days.

(PS – If you notice a build-up of cubeb-shm files in your ‘Temp’ environment folder (all 2048KB/2MB in size) then it’s ‘cos you’ve been watching videos from within Firefox. Just close and re-open Firefox.)

Hope this helps…

2 users thanked author for this post.

Norio, Alex5723

Reply | Quote

Replies

Did you open one of the log files to see if OneDrive leaked which files were upload to Microsoft’s servers?

Reply | Quote

It would be helpful if we knew whether these findings are on a VM or bare metal installation? We have Win10 pro 20H2 x64 with onedrive in use on one machine and not on the other. None of these aria-debug-xxx.log files are present on either of our two bare metal installations.

FYI 0nly configuration tweaks are via GP, no third party blockers etc
It couldn’t possibly be your configurations within a VM, could it?

Reply | Quote

anonymous wrote:

It would be helpful if we knew whether these findings are on a VM or bare metal installation?

Neither… the aria-debug files appeared on my everyday use Dell Latitude E7440 laptop running Windows 10 Pro 1809 using a 128GB SSD (with more than 33GB free) which I’m using to type this reply. It’s just a plain workhorse with Windows Updates disabled and I never carry out any maintenance on it whilst it keeps plodding along (hence why it’s still on 1809… it just works).

I had already uninstalled the built-in OneDrive ages ago (as I never use it) yet installed OneDrive again on 7th January to answer a forum query. The OneDrive install didn’t work… it appeared to install but I couldn’t get it to open. Someone else answered the forum query so I didn’t pursue the issue any further. However, it appears that OneDrive – whilst not used – was partially responsible for creating the aria-debug files. I had noticed them but didn’t pay any attention as they were zero-byte in filesize. It wasn’t until @doriel queried them that I thought to find out what was creating them, hence my post.

I have since deleted the aria-debug files (and uninstalled OneDrive again) and a quick check shows no more have been created since. I still have the OneDriveSetup.exe installer and it’s almost worth re-installing it again, just to see whether the same behaviour occurs.

However, I’m about to do a(nother) clean install of Windows 10 Pro 20H2 on an identical E7450 which I’ve just updated with a 500GB SSD so I’m more interested in that at the moment.

I’ve carried out a test default install (i.e. bog standard, no tweaking) already and have been disappointed to find that a default 20H2 install leaves multiple ‘unknown device’ entries in Device Manager even after connecting to the internet and running Windows Update until no more updates are found. (By contrast, 1809, 1903 and 1909 all only failed on the Fingerprint scanner device.) Once I’ve identified *exactly* what additional drivers are required then I’ll download them and stick them aside and do another clean install, pausing OOBE to run my favourite Windows 10 Debloater script. That will then become my day-to-day portable workhorse device and this one will become my test laptop.

I do use VMs but I remove bucketloads of scheduled tasks and services in order to make them restore and boot within ~2 minutes with none of the usual ~10 mins delay whilst normal Windows post-boot processes settle down. As a result they are great for testing software scenarios quickly but rubbish for testing Windows issues… so I use my test laptop which I can clean install within minutes.

Hope this answers your question. Feel free to ask more.

Reply | Quote

anonymous wrote:

Only configuration tweaks are via GP, no third party blockers etc

Even though I have a Pro edition of Windows 10 installed (ex-business laptop… I bought 3 identical ones at auction several years ago) I don’t use Group Policy. I prefer finding fixes that Home edition users can use as this is the most usual edition available commercially.

I do have Windows Update Blocker in use. I cannot remember any other tweaks… it’s been several years since I first provisioned this laptop.

Hope this helps…

Reply | Quote

anonymous wrote:

Did you open one of the log files to see if OneDrive leaked which files were upload to Microsoft’s servers?

The aria-debug files were all zero-byte in size so there was no data available (even when I opened two in Notepad++).

I also checked them with two NirSoft tools in case they included any data in Alternate Data Streams (ADS). Nope… no metadata that I could find.

Hope this helps…

Reply | Quote

anonymous wrote:

Did you open one of the log files to see if OneDrive leaked which files were upload to Microsoft’s servers?

I forgot to mention… whilst I didn’t find any data in any log file to show what files may have been uploaded to Microsoft, I did find that the OneDrive FileCoAuth.exe linked to 2 DLLs, one of which referred to telemetry and the other to a LoggingPlatform:

Who knows what these refer to? Certainly not me… and I don’t really care as I never use OneDrive.

(OK, that’s not strictly true… I *do* have a Microsoft Account and I do have a OneDrive presence with a few stored files to keep it active. I have them just in case I want to answer a forum query. I don’t use them except for this purpose and it has been nearly 2 years since I logged into any MS acount… hence why my knowledge of anything to do with these is somewhat flimsy. )

Hope this helps…

Reply | Quote

A followup to this problem is in Born’s Tech and Windows World thread (with a link back to AskWoody):
https://borncity.com/win/2023/06/01/windows-temp-folder-flooded-with-aria-debug-xxx-log-files/

Apparently there is no resolution as yet as indicated by this statement and question:
“What I have noticed, however, is that the problem has been bogging down Windows for at least six years without a convincing explanation or even a solution to stop the .log files from being created. A tragedy – or is anyone from the readership aware of a cause as well as a solution?”

On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender

Reply | Quote

geekdom wrote:

Apparently there is no resolution as yet

According to several mentions in Raymond Chen’s ‘The Old New Thing’ blog, developer resources at Microsoft have no slack whatsoever to deal with something that isn’t a deal-breaker.

EDIT: The link is no longer valid.

Reply | Quote

It was the use of d***. Hold over from Woody – no cussing.

1 user thanked author for this post.

Rick Corbett

Reply | Quote

PKCano wrote:

It was the use of d***. Hold over from Woody – no cussing.

Thank you, @PKCano, for the explanation. It makes perfect sense.

My apologies… I didn’t think.

I’ve edited my offending post and will try harder in future. Sorry.

1 user thanked author for this post.

PKCano

Reply | Quote

For all of you out there still having the issue, I’ve struggled finding a solution and finally found out that this regkey prevents aria-debug files from being generated.

[HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry]
“DisableTelemetry”=dword:00000001

 

It needs to be added on every user session having this problem.

 

Have a good day!

 

 

Reply | Quote

Sebastien Langevin wrote:

For all of you out there still having the issue, I’ve struggled finding a solution and finally found out that this regkey prevents aria-debug files from being generated.

[HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry]
“DisableTelemetry”=dword:00000001

 

It needs to be added on every user session having this problem.

 

Have a good day!

 

 

Sorry for late reply – just catching up – but in my experience it’s a result of a specific Microsoft .DLL – LoggingPlatform.dll – most usually related to OneDrive.

It would be interesting to know if this is NOT relevant to your investigation and has been proven to be irrelevant.

Reply | Quote