|
it
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
Weird file that grows non-stop (mondump.txt)I have a handful of Win2003 SP1 servers that have a file that grows non-stop (like 1MB in a 2-3 hours). The full path of the file is C:\WINDOWS\system32\mondump.txt. Notice that one of my Win2003 servers doesn't have this file but the rest do. Here is a sample of its contents: GetDataByte(0x01, 0x2e, 0x5c, 0xc3fa0a) GetDataByte:2e 5c 12 GetDataByte(0x01, 0x2e, 0x5d, 0xc3fa0a) GetDataByte:2e 5d 0 GetDataByte(0x01, 0x2e, 0x5e, 0xc3fa0a) GetDataByte:2e 5e 12 .... etc ... etc ... Does anyone know what it is? How can I stop it from growing? thanks christos
Show quote
Hide quote
"Christos Kritikos" <ChristosKriti***@discussions.microsoft.com> wrote in Run oh.exe (Windows Resource Kit) to determine which processmessage news:308655BC-63FE-4003-B63F-634D030A0A5E@microsoft.com... > > Hello > > I have a handful of Win2003 SP1 servers that have a file that grows non-stop > (like 1MB in a 2-3 hours). The full path of the file is > C:\WINDOWS\system32\mondump.txt. Notice that one of my Win2003 servers > doesn't have this file but the rest do. Here is a sample of its contents: > > GetDataByte(0x01, 0x2e, 0x5c, 0xc3fa0a) > GetDataByte:2e 5c 12 > GetDataByte(0x01, 0x2e, 0x5d, 0xc3fa0a) > GetDataByte:2e 5d 0 > GetDataByte(0x01, 0x2e, 0x5e, 0xc3fa0a) > GetDataByte:2e 5e 12 > ... etc ... etc ... > > Does anyone know what it is? How can I stop it from growing? > > thanks > christos > has the file open. Hello again. I ran oh.exe as instructed but the file doesn't pop up in any
of the outputs so I cannot associate it with a process. Any other ideas? -christos Show quoteHide quote "Pegasus (MVP)" wrote: > > "Christos Kritikos" <ChristosKriti***@discussions.microsoft.com> wrote in > message news:308655BC-63FE-4003-B63F-634D030A0A5E@microsoft.com... > > > > Hello > > > > I have a handful of Win2003 SP1 servers that have a file that grows > non-stop > > (like 1MB in a 2-3 hours). The full path of the file is > > C:\WINDOWS\system32\mondump.txt. Notice that one of my Win2003 servers > > doesn't have this file but the rest do. Here is a sample of its contents: > > > > GetDataByte(0x01, 0x2e, 0x5c, 0xc3fa0a) > > GetDataByte:2e 5c 12 > > GetDataByte(0x01, 0x2e, 0x5d, 0xc3fa0a) > > GetDataByte:2e 5d 0 > > GetDataByte(0x01, 0x2e, 0x5e, 0xc3fa0a) > > GetDataByte:2e 5e 12 > > ... etc ... etc ... > > > > Does anyone know what it is? How can I stop it from growing? > > > > thanks > > christos > > > > Run oh.exe (Windows Resource Kit) to determine which process > has the file open. > > > If this was my machine then I would plug this hole like so:
1. Delete the file. 2. Create a folder of exactly the same name. This will prevent the rogue process from writing anything into this file. If it is a legal process then it will write error messages to the Event Logger. Show quoteHide quote "Christos Kritikos" <ChristosKriti***@discussions.microsoft.com> wrote in message news:8DB96D79-9B40-4909-B8A6-2A4AE8AE3D92@microsoft.com... > > Hello again. I ran oh.exe as instructed but the file doesn't pop up in any > of the outputs so I cannot associate it with a process. Any other ideas? > > -christos > > "Pegasus (MVP)" wrote: > > > > > "Christos Kritikos" <ChristosKriti***@discussions.microsoft.com> wrote in > > message news:308655BC-63FE-4003-B63F-634D030A0A5E@microsoft.com... > > > > > > Hello > > > > > > I have a handful of Win2003 SP1 servers that have a file that grows > > non-stop > > > (like 1MB in a 2-3 hours). The full path of the file is > > > C:\WINDOWS\system32\mondump.txt. Notice that one of my Win2003 servers > > > doesn't have this file but the rest do. Here is a sample of its contents: > > > > > > GetDataByte(0x01, 0x2e, 0x5c, 0xc3fa0a) > > > GetDataByte:2e 5c 12 > > > GetDataByte(0x01, 0x2e, 0x5d, 0xc3fa0a) > > > GetDataByte:2e 5d 0 > > > GetDataByte(0x01, 0x2e, 0x5e, 0xc3fa0a) > > > GetDataByte:2e 5e 12 > > > ... etc ... etc ... > > > > > > Does anyone know what it is? How can I stop it from growing? > > > > > > thanks > > > christos > > > > > > > Run oh.exe (Windows Resource Kit) to determine which process > > has the file open. > > > > > > Well that didn't work (the text file would be recreated too quickly for me
to create the folder) but another trick did: I made the file read-only! :-) The culprit turned out to be the server's proprietary monitoring application. Clearly it has a bug in reading the default value of "don't dump the data in a log file". I reconfigured the settings and everything seems fine. thaks for all the help. christos Show quoteHide quote "Pegasus (MVP)" wrote: > If this was my machine then I would plug this hole like so: > 1. Delete the file. > 2. Create a folder of exactly the same name. > > This will prevent the rogue process from writing anything into > this file. If it is a legal process then it will write error messages > to the Event Logger. > > > "Christos Kritikos" <ChristosKriti***@discussions.microsoft.com> wrote in > message news:8DB96D79-9B40-4909-B8A6-2A4AE8AE3D92@microsoft.com... > > > > Hello again. I ran oh.exe as instructed but the file doesn't pop up in any > > of the outputs so I cannot associate it with a process. Any other ideas? > > > > -christos > > > > "Pegasus (MVP)" wrote: > > > > > > > > "Christos Kritikos" <ChristosKriti***@discussions.microsoft.com> wrote > in > > > message news:308655BC-63FE-4003-B63F-634D030A0A5E@microsoft.com... > > > > > > > > Hello > > > > > > > > I have a handful of Win2003 SP1 servers that have a file that grows > > > non-stop > > > > (like 1MB in a 2-3 hours). The full path of the file is > > > > C:\WINDOWS\system32\mondump.txt. Notice that one of my Win2003 servers > > > > doesn't have this file but the rest do. Here is a sample of its > contents: > > > > > > > > GetDataByte(0x01, 0x2e, 0x5c, 0xc3fa0a) > > > > GetDataByte:2e 5c 12 > > > > GetDataByte(0x01, 0x2e, 0x5d, 0xc3fa0a) > > > > GetDataByte:2e 5d 0 > > > > GetDataByte(0x01, 0x2e, 0x5e, 0xc3fa0a) > > > > GetDataByte:2e 5e 12 > > > > ... etc ... etc ... > > > > > > > > Does anyone know what it is? How can I stop it from growing? > > > > > > > > thanks > > > > christos > > > > > > > > > > Run oh.exe (Windows Resource Kit) to determine which process > > > has the file open. > > > > > > > > > > > >  
Other interesting topics
|
|||||||||||||||||||||||
