Windows XP trace.log?

[wintertide]

When I was defragmenting my hard drive, one particular file kept coming up: trace.log. I searched for it on my hard drive and found it under /windows/system32/logfiles/wmi - the file was over one GB in size! Everytime i did something like open a folder, it kept growing in size and eventually reached 3GB. Is there a way to disable this log so it doesn't keep eating up my hard drive space and what the heck is it?

[stu140103]

> what the heck is it?

What does it say inside of it????

[wintertide]

I couldn't open it... but I rebooted and it became smaller. I tried opening it when it was only 200MB in size but Notepad crashed :(

[stu140103]

> I couldn't open it... but I rebooted and it became
> smaller. I tried opening it when it was only 200MB
> in size but Notepad crashed :(

try wordpad

[Babe Ruth]

Wintertide,
Have you used the BOOTVIS.EXE program from microsoft - if so and even if not:

then modify the registry using REGEDIT - navigate to the following key:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr ol\WMI\GlobalLogger\
NOTE there are NO spaces in the above registry key)

Set the value of the START variable to 0 (zero)

The usual cavets re backing up the registry apply.


If that doesn't work try using the TRACELOG utility from the command (CMD) prompt to see what systems are set to logging
TRACELOG -L
This will list all systems that are running and creating/updating tracelogs.

You can then use:
TRACELOG -STOP {mylogger}
TRACELOG -DISABLE {mylogger}
TRACELOG -X
TRACELOG -REMOVE GlobalLogger
commands to stop and disable the particular logger - where {mylogger} - without the braces - is whichever is running...

Cheers, Babe.

[PoWa]

Tracelog won't run from my XP Pro at all?

[Babe Ruth]

If you type tracelog /? at the CMD prompt you should get:

Microsoft (R) TraceLog.Exe (5.1.2600.0)
⌐ Microsoft Corporation. All rights reserved.
Usage: tracelog [actions] [options] | [-h | -help | -?]

actions:
-start [LoggerName] Starts up the [LoggerName] trace session
-stop [LoggerName] Stops the [LoggerName] trace session
-update [LoggerName] Updates the [LoggerName] trace session
-enable [LoggerName] Enables providers for the [LoggerName] session
-disable [LoggerName] Disables providers for the [LoggerName] session
-flush [LoggerName] Flushes the [LoggerName] active buffers
-remove GlobalLogger Removes registry keys that activate GlobalLogger
-enumguid Enumerate Registered Trace Guids
-q [LoggerName] Query status of [LoggerName] trace session
-l List all trace sessions
-x Stops all active trace sessions

options:
-b <n> Sets buffer size to <n> Kbytes
-min <n> Sets minimum buffers
-max <n> Sets maximum buffers
-f <name> Log to file <name>
-append Append to file
-prealloc Pre-allocate
-seq <n> Sequential logfile of up to n Mbytes
-cir <n> Circular logfile of n Mbytes
-newfile <n> Log to a new file after every n Mbytes
-ft <n> Set flush timer to n seconds
-paged Use pageable memory for buffers
-noprocess Disable Process Start/End tracing
-nothread Disable Thread Start/End tracing
-nodisk Disable Disk I/O tracing
-nonet Disable Network TCP/IP tracing
-fio Enable file I/O tracing
-pf Enable page faults tracing
-hf Enable hard faults tracing
-img Enable image load tracing
-cm Enable registry calls tracing
-um Enable Process Private tracing
-guid <file> Start tracing for providers in file
-rt Enable tracing in real time mode
-age <n> Modify aging decay time to n minutes
-level <n> Enable Level passed to the providers
-flag <n> Enable Flags passed to the providers
-eflag <n> <flag...> Enable flags (several) to providers
-ls Generate Local Sequence Numbers
-gs Generate Global Squence Numbers
-pids <n> <pid1 pid2 ... > Tracing for Heap and Crit Sect for different process

-h
-help
-? Display usage information
Cheers, Babe.

[wintertide]

The GlobalLogger Start registry key had 1 in hex in it - set that to 0 and will restart to see if it takes effect.

Thanks!
Wintertide

[wintertide]

That key cleared the log just fine. Thank you for everyone who helped.

[PoWa]

Nope, keeps saying 'tracelog' is not recognized as a command...

Maybe I disabled the service or something :|

[wintertide]

I couldn't get tracelog to work either... but if you have a look in /windows/system32/logfiles/wmi and you find a log that keeps going up, that's the sucker that I killed with that 'start' registry key