Unrelenting flood of EVTX files chokes 1TB drive

Topic

New Reply

LANGALIST By Fred Langa A wild system error is generating some 600 EVTX files per minute! Not surprisingly, the PC is unusable — even at full throttle
[See the full post at: Unrelenting flood of EVTX files chokes 1TB drive]

3 users thanked author for this post.

Elly, woody, abbodi86

Reply | Quote

Replies

FF75 giving me hhttps://www.askwoody.com/newsletter/unrelenting-flood-of-evtx-files-chokes-1tb-drive/ as the url when clicking the link to the newsletter, same in Susan’s preceding post. Might need a tweak 😉

1 user thanked author for this post.

woody

Reply | Quote

Fixed it. Thanks!

Reply | Quote

I experienced almost identical symptoms a few months ago.  It took me a long time but I managed to determine the “cause” as follows.  I was trying to move a large amount of data (in the neighborhood of 300 GB) from my hardrive to OneDrive.  I began seeing the pauses, the not responding messages, and the disk space warnings.  Turns out that the transfer was spewing out hundreds of temporary files that had filled up the C: drive.  In my case the C: drive was physically assigned to a 112 gb SSD.  Guessing that if OneDrive had enough temp space to absorb all that it was trying to use, the transfer would complete normally and the temp files would all be deleted.  After much hair pulling research, trial, and error I managed to  point OneDrive operations at the D: drive (1 TB) instead of the C: drive.

Happy? ending – my guess was correct.  I got the data moved my system is working well.  I decided to leave the change in place and so far with no repercussions.  Hope this write-up helps someone.

 

2 users thanked author for this post.

GoneToPlaid, bratkinson

Reply | Quote

In the past, the office experienced so many problems with OneDrive that we had our IT guy uninstall OneDrive from every computer. Things worked well after that.

Reply | Quote

Omigosh I found Fred again! I lost track and found him here today!! 🙂

Reply | Quote

Fred,

I am looking at this EVTX business late in the game.   But it seems to me that the first and foremost advice is ALWAYS to run diagnostics (not necessarily Microsoft’s, but from a bootable Win 10 flash stick) to determine if the hardware is or is not A-OK.  In this particular situation, if the hard drive is going south, nothing will help fix the problem via software.  As a rule when repairing computers these many years, I examine the SMART data for the drive(s) to see if there are bad sectors, reallocated sectors or unrecoverable sectors.  If so, I have to do what I can to recover what is on the drive, and maybe even get lucky and clone it successfully onto another fully working drive.  If the drive(s) shows no bad sectors etc, then it is time to look for software solutions.

For me, first making sure that the hardware is fully and properly operational is inviolate.  Nuf said.

Reply | Quote

[bratkinson]

The original post FINALLY explained what I’ve been experiencing for maybe 2 years!  I was Win 7 64-bit Pro until 5 months ago.

My 4.7ghz overclocked 8-processor computer would simply lock up for a minute or so with the SSD light continuously on, then return to normal like nothing ever happened.  It was so locked up both computer monitoring programs would freeze too!  Just the mouse moved.   It would irregularly occur any time from 1-2 seconds after POST to 3-4 hours later!  I cloned my C: drive (Windows & My Docs only) to a brand new SSD but the problem continued.  So, I started rolling back Windows updates, driver updates, etc.  I even resorted to reinstalling the original drivers from the CD that came with my mobo, printers, and other hardware.  Nothing solved the problem.

As I regularly clean out all temporary file folders I can find, I never had a problem with it filling my SSD.  Knowing the end was near for Win 7, I finally upgraded to Win 10 64bit Pro in December, hoping the problem would go away.  It didn’t.  So, I finally bit the bullet and did a clean install on a spare SSD.  Problem solved.  I think I spent over 100 hours trying to figure out THAT one.  Glad it’s over!

• This reply was modified 5 years, 1 month ago by bratkinson.

Reply | Quote

[Elly]

I had a similar situation a year or so ago with my main computer which is running Win 7 64 bit.  Files were also being created in the Windows/Temp folders.  They were all small, averaging less than a Mb each.  It reached a point where my C drive, an SSD, was filled within less than a 100 Mb of being totally filled, scary as heck!  I tried all manner of deletion methods and utils.  (I did find a good one that I still use on occasion, Temp File Cleaner by Oldtimer.)  Searched all over the web and found that others were having the same issue but no one had a solution.  I used WinDirStat to try and identify what the files were and their source and nuttin’!  WDS showed the area, (graphically and in the file list), of the drive occupied by the mystery files, nearly all of the open space at one point, and total area that the files occupied, but they were shown as  “Unknown”.  The volume of the files and their number started slowing on their own, to a point where I could manage them.  The only way that I was able to remove them was to restore my drive image from a previous day, (I create a DI every evening using Acronis True Image.  That habit has saved my a__ more than once!),  TI disregards any temp or recycle bin files.  For a while, the files continued to create themselves albeit at a slower rate.  The situation occasionally crops every so often to this day, but to very minor degree, so I just restore the previous day’s DI to clean out the files.  I have never found the cause and that drives me nuts to the present.  As a Mechanical Engineer in Manufacturing, I am highly analytical and nothing frosts me more that not being able to determine the cause of a problem.  Anyway, it was weird as heck!  Just thought that I’d post it, although it’s not the same situation that the other gentleman/lady poster was experiencing but similar in result.  Unfortunately, I don’t have a solution.

I used to tell all of my employees that they should not come to me with problems unless they’d discovered a solution, and here I am doing just that!

Edit:  I forgot to mention that the extension was <span style=”text-decoration: underline;”>not</span> “EVTX” and, unfortunately, I do not remember what the extension was.

Montana Bob

Edited for HTML. Please use text tab for copy/paste.

• This reply was modified 5 years, 1 month ago by Elly.
• This reply was modified 5 years, 1 month ago by Montana Bob. Reason: Clarification of file type

Reply | Quote

I’ve encountered this failure pattern twice, and documented it on my blog here with follow-up here.  I’ve since seen a possibly similar failure pattern in Windows 7 here (unrelated logging fiasco) and on Microsoft’s own Surface systems (related AppX) here and there.  Aside from the ComputerWorld link, these are within AskWoody’s site and forums.

Don’t be distracted by the apparent particular cause – the background issue is more likely faulty logic within logging and error handling of the AppX (UWP) subsystem, if not more generalized to error logging per se (as the unrelated OneDrive case suggests).  May be a Permissions issue between TrustedInstaller and others, causing access to silently fail, so that code A is unable to curb runaway code B.

This is a serious, crippling bug that’s persisted for years, and needs to be chased and fixed by Microsoft – but finding the right “ear” there, will be a challenge!

 

Reply | Quote