Jump to content

Netcfg log files in System32


Tripredacus

Recommended Posts

Go take a look in C:\Windows\System32. I bet you'll find some text files called (example) netcfg-17040843. Everytime the NIC connects or disconnects (even on reboots), another one of these files are created! What is creating them? Contents of each as the same:

Command line arguments: C: \ Windows \ system32 \ svchost.exe-k netsvcs
CSteelhead :: CSteelhead
CSteelhead :: ~ CSteelhead

Found some postings from earlier this year on a Russian and Chinese website about this behaviour in the CP/RP version, but no fix. Do you think these types of log files can be disabled? It would add a bit (well they are only 1KB files each) of bloat after a while of using the OS I would think. :unsure:

If you want, you can see the creation of these files. Just sort your System32 folder by Date Modified (Descending) and unplug and replug in your ethernet cable. :sneaky:

Link to comment
Share on other sites


(well they are only 1KB files each)

They should be far less than 1 Kb, which poses another question, such small files don't normally go into the (NTFS) filesystem (they should be written directly into the $MFT).

Having thousands of small files is not IMHO as much an issue with actual size occupied (besides making browsing the filesystem with Explorer or other file manager a nightmare) but rather with size (and number of entries) in the $MFT :unsure: .

jaclaz

Link to comment
Share on other sites

Of course less than 1KB... but Explorer (details) doesn't show any size lower than 1KB. I checked mine here and file size is 117 bytes with Size On Disk of 4,096 bytes.

its good that it will be fixed. While the file size isn't a concern, I immediately thought of SSD life.

Link to comment
Share on other sites

Try getting the file extents for those files.... :whistle:

http://www.wd-3.com/archive/luserland.htm

Have you used this program before? It doesn't seem to work for me... :}

C:\Drivers>GetFileExtents c:\windows\system32\netcfg-86477109.txt
initFileTranslation: The handle is invalid.

Maybe it doesn't work on Windows 8? :unsure:

Try it with some other (bigger in size) file, first :yes: .

jaclaz

Link to comment
Share on other sites

The program certainly does work in Windows 8. However I think it might be due to the file being in System32...

netcfg-file-properties.jpg

C:\Drivers>dir vcredist_x64.exe
Volume in drive C is Windows
Volume Serial Number is 0490-8AE9

Directory of C:\Drivers

08/29/2012 11:07 AM 2,373,640 vcredist_x64.exe
1 File(s) 2,373,640 bytes
0 Dir(s) 290,716,385,280 bytes free

C:\Drivers>GetFileExtents c:\drivers\vcredist_x64.exe
File offset 0 LBA: 31c550 Sectors: 1220

C:\Drivers>copy c:\windows\system32\netcfg-86477109.txt c:\drivers\
1 file(s) copied.

C:\Drivers>GetFileExtents c:\drivers\netcfg-86477109.txt

C:\Drivers>GetFileExtents c:\windows\sysnative\netcfg-86477109.txt

C:\Drivers>

The original failure is something I've encountered on a 64bit OS, where if you specify "system32" Windows can't actually find that path, even though it actually exists. So if I use "sysnative" instead, the file can be found. In the above code you can see that it is able to get some data from the vcredist file, but it returns nothing from the text file, regardless if checking the original location or after a file copy.

Link to comment
Share on other sites

So if I use "sysnative" instead, the file can be found. In the above code you can see that it is able to get some data from the vcredist file, but it returns nothing from the text file, regardless if checking the original location or after a file copy.

Yes, this latter is the "expected" result.

The "vcredist_x64.exe" file has actually a (single - meaning that it is NOT fragmented) extent on disk, (though the 1220 sectors do not sound "right" :w00t: ), whilst the netcfg-86477109.txt has NONE (because it is self-contained in the $MFT entry).

It was only to show you how and why the "4.00 KB (4,096 bytes) is a "lie" (or if you prefer "a glitch in the matrix"). ;)

If you have (say) 10,000,000 :ph34r: of such files, the capacity of the disk won't be reduced by 10,000,000*4,096 bytes = ~38 Gb but the $MFT will have some 10,000,000 more entries and probably will be larger by around 10,000,000*1,024 bytes, i.e. your available space will be reduced by about 1/4th of the above, but the $MFT will be HUGE.

jaclaz

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...