2008 R2 Domain Controller - large log files filling up system32\LogFiles

garryshape
garryshape used Ask the Experts™
on
I'm noticing some large log files are filling up C:\Windows\System32 on one of my domain controllers (a 2008 R2 DC).
Any easy way I can figure out what's spitting the log file there?

I can't open it because it's so large, unless there's another viewer I should try and use...?

There's no IIS running locally.

One of the log file names is "IN1602.log"
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Joseph UndisNetwork and Systems Administrator
Commented:
Garry,

If you open up Resource Monitor and look under Disk > Disk Activity, you may be able to find the application that is writing specifically to this log file. You can also use a program such as Process Explorer to search handles on what is accessing the file.

Let me know if you find out what the program is.

Author

Commented:
Wasn't sure how to find tied processes to Resource Monitor or Proc Explorer, disk activity didn't point to the log file when I checked, but I ran Unlocked on it and the process appears to be svchost.exe.

Author

Commented:
I used Unlocker to kill the process and I was able to delete the last .log file. Going to monitor a bit more. I don't see anything like performance monitor running any scheduled stuff.
I'm wondering if another server is writing to this path
Joseph UndisNetwork and Systems Administrator
Commented:
Garry,

That makes it a bit trickier as SVCHost.exe is just the managing process for services.

Download Process Explorer from the link below

https://download.sysinternals.com/files/processexplorer.zip

Once this is open, go to the Find menu at the top and open "Find Handle or DLL"

Enter "IN1602.log" in there and it should populate with the processes that are using this file.

Double click whatever comes up and it should highlight a process in the main top window area.

If it still shows svchost.exe, right click it and go to Properties, then the Services tab. This should show you what service is using the file. If multiple are shown, let me know which ones they are or take a screenshot.

I've attached a services tab on one of my svchost.exe's for reference

Thanks!
svchost.PNG
Network and Systems Administrator
Commented:
Garry,

Sounds good. Should the log file come back, I suggest using the post above to find what exactly was accessing it.

I doubt another server is writing to this servers system32\logfiles directory, as that would be a huge blunder by whoever wrote the software thats causing the log files to exist.

Thanks!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial