aria-debug-xxx.log files appearing in TEMP

Topic

New Reply

Another topic prompted a query (since removed) by @doriel about aria-debug-xxx.log files appearing in whatever folder was designated by Windows’ TEMP environment variable.

I too noticed aria-debug-xxxx.log files in my TEMP environment folder for the last 7 days, many with a file creation time of 19:24.

I could find no mention in any event log so fired up Process Monitor (ProcMon) at 19:20 and set it to filter File Activity events for 10 minutes… but to no avail. So, I set a specific filter for a filepath beginning C:\Temp\aria-debug and just left ProcMon to it for 24 hours.

(where a is Start/Stop Capture, b is File Activity only and c is the specific filter.)

IMPORTANT: ProcMon saves events by default to your device’s virtual memory, i.e. the swapfile. Given that ProcMon can capture hundreds, if not thousands, of events per minute it is important that you don’t run out of virtual memory. As a result I changed ProcMon to *drop* filtered events (using the Drop Filtered Events option from the Filter menu), i.e. to only save events to virtual memory that specifically met the filter criteria I had set. Note also: Whilst ProcMon will thus drop the filtered events, it is still capturing them first… so your system will slow, your harddisk activity light will be on constantly and keyboard/mouse responsiveness will suffer.

Anyway… 24 hours on and several aria-debug files have been created (and at least one deleted before I noticed):

It looks like there are two culprits – OneDrive (which I have never logged into or ever used) and the built-in Disk Space Clean-up Manager for Windows utility. YMMV.

I have uninstalled OneDrive… and deleted its installation folder (which wasn’t deleted by uninstallation. More shoddiness?). I’ll check back in a few days.

(PS – If you notice a build-up of cubeb-shm files in your ‘Temp’ environment folder (all 2048KB/2MB in size) then it’s ‘cos you’ve been watching videos from within Firefox. Just close and re-open Firefox.)

Hope this helps…

2 users thanked author for this post.

Norio, Alex5723

Reply | Quote

Replies

Did you open one of the log files to see if OneDrive leaked which files were upload to Microsoft’s servers?

Reply | Quote

It would be helpful if we knew whether these findings are on a VM or bare metal installation? We have Win10 pro 20H2 x64 with onedrive in use on one machine and not on the other. None of these aria-debug-xxx.log files are present on either of our two bare metal installations.

FYI 0nly configuration tweaks are via GP, no third party blockers etc
It couldn’t possibly be your configurations within a VM, could it?

Reply | Quote

anonymous wrote:

It would be helpful if we knew whether these findings are on a VM or bare metal installation?

Neither… the aria-debug files appeared on my everyday use Dell Latitude E7440 laptop running Windows 10 Pro 1809 using a 128GB SSD (with more than 33GB free) which I’m using to type this reply. It’s just a plain workhorse with Windows Updates disabled and I never carry out any maintenance on it whilst it keeps plodding along (hence why it’s still on 1809… it just works).

I had already uninstalled the built-in OneDrive ages ago (as I never use it) yet installed OneDrive again on 7th January to answer a forum query. The OneDrive install didn’t work… it appeared to install but I couldn’t get it to open. Someone else answered the forum query so I didn’t pursue the issue any further. However, it appears that OneDrive – whilst not used – was partially responsible for creating the aria-debug files. I had noticed them but didn’t pay any attention as they were zero-byte in filesize. It wasn’t until @doriel queried them that I thought to find out what was creating them, hence my post.

I have since deleted the aria-debug files (and uninstalled OneDrive again) and a quick check shows no more have been created since. I still have the OneDriveSetup.exe installer and it’s almost worth re-installing it again, just to see whether the same behaviour occurs.

However, I’m about to do a(nother) clean install of Windows 10 Pro 20H2 on an identical E7450 which I’ve just updated with a 500GB SSD so I’m more interested in that at the moment.

I’ve carried out a test default install (i.e. bog standard, no tweaking) already and have been disappointed to find that a default 20H2 install leaves multiple ‘unknown device’ entries in Device Manager even after connecting to the internet and running Windows Update until no more updates are found. (By contrast, 1809, 1903 and 1909 all only failed on the Fingerprint scanner device.) Once I’ve identified *exactly* what additional drivers are required then I’ll download them and stick them aside and do another clean install, pausing OOBE to run my favourite Windows 10 Debloater script. That will then become my day-to-day portable workhorse device and this one will become my test laptop.

I do use VMs but I remove bucketloads of scheduled tasks and services in order to make them restore and boot within ~2 minutes with none of the usual ~10 mins delay whilst normal Windows post-boot processes settle down. As a result they are great for testing software scenarios quickly but rubbish for testing Windows issues… so I use my test laptop which I can clean install within minutes.

Hope this answers your question. Feel free to ask more.

Reply | Quote

anonymous wrote:

Only configuration tweaks are via GP, no third party blockers etc

Even though I have a Pro edition of Windows 10 installed (ex-business laptop… I bought 3 identical ones at auction several years ago) I don’t use Group Policy. I prefer finding fixes that Home edition users can use as this is the most usual edition available commercially.

I do have Windows Update Blocker in use. I cannot remember any other tweaks… it’s been several years since I first provisioned this laptop.

Hope this helps…

Reply | Quote

anonymous wrote:

Did you open one of the log files to see if OneDrive leaked which files were upload to Microsoft’s servers?

The aria-debug files were all zero-byte in size so there was no data available (even when I opened two in Notepad++).

I also checked them with two NirSoft tools in case they included any data in Alternate Data Streams (ADS). Nope… no metadata that I could find.

Hope this helps…

Reply | Quote

anonymous wrote:

Did you open one of the log files to see if OneDrive leaked which files were upload to Microsoft’s servers?

I forgot to mention… whilst I didn’t find any data in any log file to show what files may have been uploaded to Microsoft, I did find that the OneDrive FileCoAuth.exe linked to 2 DLLs, one of which referred to telemetry and the other to a LoggingPlatform:

Who knows what these refer to? Certainly not me… and I don’t really care as I never use OneDrive.

(OK, that’s not strictly true… I *do* have a Microsoft Account and I do have a OneDrive presence with a few stored files to keep it active. I have them just in case I want to answer a forum query. I don’t use them except for this purpose and it has been nearly 2 years since I logged into any MS acount… hence why my knowledge of anything to do with these is somewhat flimsy. 🙂 )

Hope this helps…

Reply | Quote