2008 R2 Domain Controller - large log files filling up system32\LogFiles

I'm noticing some large log files are filling up C:\Windows\System32 on one of my domain controllers (a 2008 R2 DC).
Any easy way I can figure out what's spitting the log file there?

I can't open it because it's so large, unless there's another viewer I should try and use...?

There's no IIS running locally.

One of the log file names is "IN1602.log"
garryshapeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Joseph UndisNetwork and Systems AdministratorCommented:
Garry,

If you open up Resource Monitor and look under Disk > Disk Activity, you may be able to find the application that is writing specifically to this log file. You can also use a program such as Process Explorer to search handles on what is accessing the file.

Let me know if you find out what the program is.
garryshapeAuthor Commented:
Wasn't sure how to find tied processes to Resource Monitor or Proc Explorer, disk activity didn't point to the log file when I checked, but I ran Unlocked on it and the process appears to be svchost.exe.
garryshapeAuthor Commented:
I used Unlocker to kill the process and I was able to delete the last .log file. Going to monitor a bit more. I don't see anything like performance monitor running any scheduled stuff.
I'm wondering if another server is writing to this path
Joseph UndisNetwork and Systems AdministratorCommented:
Garry,

That makes it a bit trickier as SVCHost.exe is just the managing process for services.

Download Process Explorer from the link below

https://download.sysinternals.com/files/processexplorer.zip

Once this is open, go to the Find menu at the top and open "Find Handle or DLL"

Enter "IN1602.log" in there and it should populate with the processes that are using this file.

Double click whatever comes up and it should highlight a process in the main top window area.

If it still shows svchost.exe, right click it and go to Properties, then the Services tab. This should show you what service is using the file. If multiple are shown, let me know which ones they are or take a screenshot.

I've attached a services tab on one of my svchost.exe's for reference

Thanks!
svchost.PNG
Joseph UndisNetwork and Systems AdministratorCommented:
Garry,

Sounds good. Should the log file come back, I suggest using the post above to find what exactly was accessing it.

I doubt another server is writing to this servers system32\logfiles directory, as that would be a huge blunder by whoever wrote the software thats causing the log files to exist.

Thanks!

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.