ISSUE 17.17.F • 2020-05-04
Logo
The AskWoody Newsletter
FREE EDITION

In this issue

LANGALIST: 750MB of undeletable log files!

BEST OF THE LOUNGE: Device Manager’s endless search for new hardware

Additional articles in the PLUS issue

PATCH WATCH: Is it safe yet?

SAFETY: Simple ways to receive severe-weather alerts

WINDOWS 10: Controlling Windows update downloads

ADVERTISEMENT
ToDo Backup

Get EaseUS for complete data recovery and backup

EaseUS Todo Backup Home is your complete go-to solution for data protection: backups, cloning, and data-transfer. It’s simple, smart, and automatic. AskWoody Plus Newsletters get 50% off a one-year subscription with this link

Lost data? EaseUS Data Recovery Wizard Free is your all-in-one solution for quick and complete file recovery on Windows-based desktops, laptops, and other devices. Recover up to 2GB of data for free! Get 50% off a one-month subscription for Data Recovery Wizard Pro with this link

INTRODUCTION

Welcome back to the free AskWoody/Windows Secrets newsletter

It’s been an absolute delight to hear from all of you — over a thousand! — who lost track of the old Windows Secrets team. It’s been a real lift to receive the many kind words about the old gang. Yes, we’re here, we’re sitll kickin’, and we’re doin’ all we can to make your locked down life a little easier.

I’d like to set down a challenge: If you haven’t been to the AskWoody Lounge lately, please give it a shot. Register for a new username if you don’t already have one (click Register in the upper right corner), then take a look around for topics that interest you. We have very active forums on Windows 10, of course, but we’re also deeply involved in Win7 and Office, along with competing platforms such as Android, Chromebook, iOS, macOS, and (gulp) even Linux.

When it comes to tech questions and answers, we have lots of volunteers ready to help Join us!

Woody


LANGALIST

750MB of undeletable log files!

Fred Langa

By Fred Langa

Sometimes, Windows can’t or won’t delete old and/or no-longer-relevant log files.

Worse, these files can be locked or still marked as “in use,” preventing you from manually deleting them.

But you can use Safe Mode to rid your PC of hard-to-scrub log files — and reclaim potentially large swaths of disk space.

Here’s how — along with a quick refresher on launching Safe Mode in Win8/10.

Sweeping out ‘undeletable’ logs

After reading “Unrelenting flood of EVTX files chokes 1TB drive” (AskWoody Plus Newsletter 2020-04-27), subscriber Eric Belmont got an unhappy surprise when he checked his PC’s log-file areas.

  • “Hi Fred. I read your recent article about .evtx log files. I would like to know how to delete these and similar files.

    “On my system, it appears that Windows automatically deletes some files daily. But there are close to 750MB of various OS-generated logs. I’m guessing that the total log-file assemblage could grow indefinitely. It just seems like a waste of a useful resource. I can see no purpose in retaining this stuff.

    “What do you think? If you agree, can you advise me as to how to dispose of them? When I’ve tried that task, I keep getting a nagging pop-up demanding administrator privileges. When I elevate my privilege level, the complaint becomes ‘can’t delete as file is in use.'”

Under normal circumstances, Windows should overwrite or otherwise periodically delete old log files. But as we all know, stuff happens in Windows; it’s justly infamous for its (ahem) non-rigorous trash-collection practices.

Fortunately, there’s always a way to manually delete unneeded logs.

First, follow the steps outlined in the previously cited “Unrelenting flood of EVTX files …” article to make sure no ongoing PC trouble is adding to your unwanted log files.

When that task is done, you can begin the process of cleaning out leftover, orphaned, or no-longer-relevant logs.

Often, the best place to start is with Safe Mode, which boots a PC using only the most minimal and critical components needed to run Windows. All nonessential apps and drivers are left inert. This simplified environment helps with many forms of troubleshooting, but in the case of log-file deletion, Safe Mode ensures that there’ll be only a small level of system-logging activity — and that any logs associated with the rest of your PC’s apps and drivers will be dormant.

As a reminder, Win10’s Safe Mode is part of its Startup Settings, and it takes just a few clicks to get there. Make a just-in-case backup (always a good idea before any system changes) and then dig in as follows:

  • Click Settings/Update & Security/Recovery and, under the Advanced startup heading, press the Restart now button, as shown in Figure 1. (Windows 8 users needing help with Safe Mode should head over to Microsoft’s “How to easily enter safe mode in Windows 8?” post.)

    Advanced starup option
    Figure 1. In Win10 (all versions/editions), the road to Safe Mode starts in Settings.

  • When your PC restarts, you’ll now see the Choose an option menu. Each option opens a new page or set of pages. Select Troubleshoot, then Advanced options, then Startup Settings. In that window, click the Restart button. (Figure 2)

    Startup Settings
    Figure 2. Review the summary of startup-settings options and then click Restart.

  • After this second restart, you’ll see another menu detailing the various startup options to choose from (see Figure 3). Select Enable Safe Mode, usually #4 on the list.

    Select Safe Mode
    Figure 3. Startup Settings offers a long list of options; select 4) Enable Safe Mode.

Windows will restart yet again, but this time to a distinctive Safe Mode desktop. Its black background and the small “Safe Mode” labels in all four corners ensure you’ll never confuse it with the regular desktop. (See Figure 4.)

Safe Mode desktop
Figure 4. Safe Mode‘s stark and minimalist look

Most utilities will run in Safe Mode. You should be able to use any normal tool or method (i.e., File Explorer or any of the classic file-deletion tools/techniques referenced below) to navigate to and delete old, inert files from the C:/Windows/System32/Winevt/Logs/ folder — or anywhere else on your PC.

And that’s usually the end of the log file–deletion story. If the PC is working properly and the old logs are gone, what more is there?

Well … there’s this: Windows can be told to deliberately retain (“archive”) old logs up to a user-defined size limit. If this setting is mistriggered by the user, or by software, or by error or accident, Windows will dutifully collect log files until the set space fills up — or until the cows come home. This obviously isn’t a common scenario, but it’s something to remember if nothing else seems to stanch a flood of new log files — or when Windows won’t release old log files for deletion.

Log-file retention can be managed through the Group Policy editor (gpedit.msc) in Win10 Pro and Enterprise. (Win10 Home doesn’t have the editor.) If you think a bad archive-retention setting is at work on your PC, see the references below for more information. But again, this is not a common issue.

Bottom line: Once your PC is healthy and the space-wasting old logs have been removed, your PC’s event-logging system should revert to its normal, unobtrusive, small-footprint self!

More Safe Mode info:

  • “Start your PC in safe mode in Windows 10” – Microsoft support page
  • “Find safe mode and other startup settings in Windows 10” – MS support page

More log file–deletion info:

  • “How to delete event logs automatically from C:\Windows\System32\winevt\Logs folder” – TechNet page
  • “Low disk space after filling up C:\Windows\Temp with .evtx and .txt files” – superuser.com article

Classic tools and techniques for deleting recalcitrant files:

  • “300GB of files now unreadable and undeletable” – Windows Secrets Newsletter 2016-05-03
  • “Deleting ‘undeletable’ files and folders” – Windows Secrets Newsletter 2015-10-08 (scroll down)
  • “Delete files that Windows labels ‘undeletable'” – Windows Secrets Newsletter 2009-08-20

More on Group Policies and Event Logging:

  • “Event Log Policy Settings” – MS support page
  • “Event Logs — archive log when full” – TechNet discussion
  • “Adjusting Event Log Size and Retention Settings” – netwrix.com article
Send your questions and topic suggestions to Fred at fred@askwoody.com. Feedback on this article is always welcome in the AskWoody Lounge!

Fred Langa has been writing about tech — and, specifically, about personal computing — for as long as there have been PCs. And he is one of the founding members of the original Windows Secrets newsletter. Check out Langa.com for all of Fred’s current projects.


Best of the Lounge

Device Manager’s endless search for new hardware

Have you ever booted your PC and noticed a notification that the machine was “installing new hardware?” But there wasn’t any new hardware to install.

Plus member GLingner ran across this on his Win7 Ultimate system. Making matters more puzzling, this was no one-and-done event; Device Manager was spawning dozens of new “Base System Device” entries. Disabling some of the entries only temporarily stanched the flood of new device entries — it wasn’t a permanent solution.

Fortunately, GLingner‘s shout-out to AskWoody members quickly provided the answer — reinstalling the Intel Chipset Software.


BROWSERS

While perusing Task Manager, Plus member alphacharlie noticed lots of running Firefox processes. Why so many when there’s only one instance of Firefox open? Is that normal? Savvy Loungers responded with some enlightening details on the browser’s inner workings. Have you wondered about that phenomenon, too?


HARD DRIVES

When someone asks others in the forums for the “best way” to do something on a computer, they soon find out there isn’t one — there’s only what’s best for a specific setup and circumstance. Plus member southieguy opens that can of worms with a question about partitioning a refurbished Dell with Win8.1. Was it possible to set it up with two partitions instead of the five it came with? Fellow Loungers offered their solutions and experiences — including thoughts on the age-old question: whether to separate the OS and data.


HARDWARE

Disabling a hardware “option” should be as simple as switching it off. But as Plus member Mike was reminded, things are rarely that simple in Windows. The question at hand was how to permanently disable Turbo Boost. When Mike uninstalled its drivers, Windows automatically reinstalled them. Possible solutions are still forthcoming.


Networking

Plus member petermat had three systems with relatively consistent Internet upload/download speeds. Then one system suddenly developed far more leisurely network connections. Puzzled, petermat asked Loungers for possible methods for measuring local-network and Web speeds separately. The first step? Check the networking cables.


Windows 10

Plus member berniec was looking for an easy way to send a text message to a colleague’s phone — from a Win10 computer. But berniec didn’t know the type of phone. Readers made short work of this quandary by offering several solutions.


USING THE FORUM

Plus member Perq wanted to make a change to a post but couldn’t find the way to do it. The need to modify a post arises from time to time — perhaps to correct a spelling error or to add/fix entered information. It’s not hard to do, but there is a catch. For 15 minutes after you first submit a post, you’ll see an “Edit” option above the post. After that, the option disappears. Perq simply waited too long to make a change.


If you’re not already a Lounge member, use the quick registration form to sign up for free.

Stories in this week’s PAID AskWoody Plus Newsletter
Become an ASKWOODY PLUS member today!

 

Susan Bradley

PATCH WATCH

Is it safe yet?

By Susan Bradley

Every month, Windows users have to ask the same question: “Is it safe to patch yet?”

As is all too common, the issues and concerns I had at the beginning of this month are not the ones I have a few weeks later. Case in point: I thought for sure we’d have more screams of frustration when the recent Office updates started blocking Web information requested by Visual Basic apps.

But no: I’m mostly tracking possible issues with the Windows 10 1909 update. It’s sort of similar to how we’re feeling these days about staying in or going out; I don’t think you’ll see any issues, but I also can’t guarantee you won’t. It’s confusing, I know.


Nathan Parker

SAFETY

Simple ways to receive severe-weather alerts

By Nathan Parker

Over this recent Easter weekend, major storms and tornadoes raged across the United States.

The southern regions were hit especially hard, incurring massive damage and more than 30 deaths. It was tragic — but not at all rare, and not completely unexpected. Early severe-weather warnings might not reduce the destruction but can reduce fatalities.


TB Capen

WINDOWS 10

Controlling Windows update downloads

By TB Capen

Have you had a video stream suddenly start stuttering for no obvious reason — but you suspected it might be because Windows is downloading an update on one of your PCs?

That’s relatively easy to test by simply shutting down all Windows devices. But it doesn’t automatically solve the problem: Windows update sucking up limited bandwidth.


Publisher: AskWoody LLC (woody@askwoody.com); editor: Tracey Capen (editor@askwoody.com).

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. AskWoody, Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Security Baseline, Perimeter Scan, Wacky Web Week, the Windows Secrets Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of AskWoody LLC. All other marks are the trademarks or service marks of their respective owners.

Your email subscription:


Copyright © 2020 AskWoody LLC, All rights reserved.