MSFN Forum: Netcfg log files in System32 - MSFN Forum

Jump to content


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

Netcfg log files in System32 CSteelhead

#1 User is offline   Tripredacus 

  • K-Mart-ian Legend
  • Group: Super Moderator
  • Posts: 8,665
  • Joined: 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Posted 29 August 2012 - 01:32 PM

Go take a look in C:\Windows\System32. I bet you'll find some text files called (example) netcfg-17040843. Everytime the NIC connects or disconnects (even on reboots), another one of these files are created! What is creating them? Contents of each as the same:

Command line arguments: C: \ Windows \ system32 \ svchost.exe-k netsvcs
CSteelhead :: CSteelhead
CSteelhead :: ~ CSteelhead


Found some postings from earlier this year on a Russian and Chinese website about this behaviour in the CP/RP version, but no fix. Do you think these types of log files can be disabled? It would add a bit (well they are only 1KB files each) of bloat after a while of using the OS I would think. :unsure:

If you want, you can see the creation of these files. Just sort your System32 folder by Date Modified (Descending) and unplug and replug in your ethernet cable. :sneaky:


#2 User is offline   MagicAndre1981 

  • after Windows 7 GA still Vista lover :)
  • Group: Patrons
  • Posts: 4,963
  • Joined: 28-August 05
  • OS:Vista Ultimate x86
  • Country: Country Flag

Posted 29 August 2012 - 01:45 PM

I've also seen this and no idea why those files are created.

#3 User is offline   cluberti 

  • Gustatus similis pullus
  • Group: Supervisor
  • Posts: 11,208
  • Joined: 09-September 01
  • OS:Windows RT
  • Country: Country Flag

Posted 29 August 2012 - 05:00 PM

It should apparently be fixed sometime in the (hopefully near) future, but it's a known issue and there will be a resolution for it.

#4 User is offline   jaclaz 

  • The Finder
  • Group: Developers
  • Posts: 11,420
  • Joined: 23-July 04
  • OS:none specified
  • Country: Country Flag

Posted 30 August 2012 - 08:13 AM

View PostTripredacus, on 29 August 2012 - 01:32 PM, said:

(well they are only 1KB files each)

They should be far less than 1 Kb, which poses another question, such small files don't normally go into the (NTFS) filesystem (they should be written directly into the $MFT).
Having thousands of small files is not IMHO as much an issue with actual size occupied (besides making browsing the filesystem with Explorer or other file manager a nightmare) but rather with size (and number of entries) in the $MFT :unsure: .

jaclaz

#5 User is offline   Tripredacus 

  • K-Mart-ian Legend
  • Group: Super Moderator
  • Posts: 8,665
  • Joined: 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Posted 30 August 2012 - 08:33 AM

Of course less than 1KB... but Explorer (details) doesn't show any size lower than 1KB. I checked mine here and file size is 117 bytes with Size On Disk of 4,096 bytes.

its good that it will be fixed. While the file size isn't a concern, I immediately thought of SSD life.

#6 User is offline   jaclaz 

  • The Finder
  • Group: Developers
  • Posts: 11,420
  • Joined: 23-July 04
  • OS:none specified
  • Country: Country Flag

Posted 30 August 2012 - 08:36 AM

View PostTripredacus, on 30 August 2012 - 08:33 AM, said:

Of course less than 1KB... but Explorer (details) doesn't show any size lower than 1KB.

Try with "Properties" :whistle:

jaclaz

#7 User is offline   Tripredacus 

  • K-Mart-ian Legend
  • Group: Super Moderator
  • Posts: 8,665
  • Joined: 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Posted 30 August 2012 - 08:41 AM

I did, read the rest of that post to see the actual sizes. :rolleyes:

#8 User is offline   jaclaz 

  • The Finder
  • Group: Developers
  • Posts: 11,420
  • Joined: 23-July 04
  • OS:none specified
  • Country: Country Flag

Posted 30 August 2012 - 09:11 AM

View PostTripredacus, on 30 August 2012 - 08:41 AM, said:

I did, read the rest of that post to see the actual sizes. :rolleyes:

Good, BUT, still, the 4096 bytes is most probably a lie..... :w00t: :ph34r:

Try getting the file extents for those files.... :whistle:
http://www.wd-3.com/...e/luserland.htm

jaclaz

#9 User is offline   Tripredacus 

  • K-Mart-ian Legend
  • Group: Super Moderator
  • Posts: 8,665
  • Joined: 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Posted 30 August 2012 - 09:41 AM

View Postjaclaz, on 30 August 2012 - 09:11 AM, said:

Try getting the file extents for those files.... :whistle:
http://www.wd-3.com/...e/luserland.htm


Have you used this program before? It doesn't seem to work for me... :}

C:\Drivers>GetFileExtents c:\windows\system32\netcfg-86477109.txt
initFileTranslation: The handle is invalid.


#10 User is offline   jaclaz 

  • The Finder
  • Group: Developers
  • Posts: 11,420
  • Joined: 23-July 04
  • OS:none specified
  • Country: Country Flag

Posted 30 August 2012 - 09:59 AM

View PostTripredacus, on 30 August 2012 - 09:41 AM, said:

View Postjaclaz, on 30 August 2012 - 09:11 AM, said:

Try getting the file extents for those files.... :whistle:
http://www.wd-3.com/...e/luserland.htm


Have you used this program before? It doesn't seem to work for me... :}

C:\Drivers>GetFileExtents c:\windows\system32\netcfg-86477109.txt
initFileTranslation: The handle is invalid.


Maybe it doesn't work on Windows 8? :unsure:
Try it with some other (bigger in size) file, first :yes: .

jaclaz

#11 User is offline   MagicAndre1981 

  • after Windows 7 GA still Vista lover :)
  • Group: Patrons
  • Posts: 4,963
  • Joined: 28-August 05
  • OS:Vista Ultimate x86
  • Country: Country Flag

Posted 30 August 2012 - 10:45 AM

here is an unofficial Announcement that we get a fix soon:

http://blogs.technet...-directory.aspx

#12 User is offline   Tripredacus 

  • K-Mart-ian Legend
  • Group: Super Moderator
  • Posts: 8,665
  • Joined: 28-April 06
  • OS:Server 2012
  • Country: Country Flag

Posted 30 August 2012 - 11:24 AM

The program certainly does work in Windows 8. However I think it might be due to the file being in System32...

Posted Image

C:\Drivers>dir vcredist_x64.exe
 Volume in drive C is Windows
 Volume Serial Number is 0490-8AE9

 Directory of C:\Drivers

08/29/2012  11:07 AM         2,373,640 vcredist_x64.exe
               1 File(s)      2,373,640 bytes
               0 Dir(s)  290,716,385,280 bytes free

C:\Drivers>GetFileExtents c:\drivers\vcredist_x64.exe
File offset 0 LBA: 31c550 Sectors: 1220

C:\Drivers>copy c:\windows\system32\netcfg-86477109.txt c:\drivers\
        1 file(s) copied.

C:\Drivers>GetFileExtents c:\drivers\netcfg-86477109.txt

C:\Drivers>GetFileExtents c:\windows\sysnative\netcfg-86477109.txt

C:\Drivers>


The original failure is something I've encountered on a 64bit OS, where if you specify "system32" Windows can't actually find that path, even though it actually exists. So if I use "sysnative" instead, the file can be found. In the above code you can see that it is able to get some data from the vcredist file, but it returns nothing from the text file, regardless if checking the original location or after a file copy.

#13 User is offline   jaclaz 

  • The Finder
  • Group: Developers
  • Posts: 11,420
  • Joined: 23-July 04
  • OS:none specified
  • Country: Country Flag

Posted 30 August 2012 - 11:53 AM

View PostTripredacus, on 30 August 2012 - 11:24 AM, said:

So if I use "sysnative" instead, the file can be found. In the above code you can see that it is able to get some data from the vcredist file, but it returns nothing from the text file, regardless if checking the original location or after a file copy.

Yes, this latter is the "expected" result.
The "vcredist_x64.exe" file has actually a (single - meaning that it is NOT fragmented) extent on disk, (though the 1220 sectors do not sound "right" :w00t: ), whilst the netcfg-86477109.txt has NONE (because it is self-contained in the $MFT entry).
It was only to show you how and why the "4.00 KB (4,096 bytes) is a "lie" (or if you prefer "a glitch in the matrix"). ;)
If you have (say) 10,000,000 :ph34r: of such files, the capacity of the disk won't be reduced by 10,000,000*4,096 bytes = ~38 Gb but the $MFT will have some 10,000,000 more entries and probably will be larger by around 10,000,000*1,024 bytes, i.e. your available space will be reduced by about 1/4th of the above, but the $MFT will be HUGE.


jaclaz

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users



All trademarks mentioned on this page are the property of their respective owners
Copyright © 2001 - 2013 msfn.org
Privacy Policy