Lengthy Disk activity after using the BSOD Processing App

philc43

philc43

BSOD Forum Moderator, BSOD Academy Instructor, BSOD Kernel Dump Expert
Staff member
Joined
Jul 7, 2017
Posts
1,963
Location
Cambridge, UK
@writhziden I have noticed that there is a very large amount of disk activity that continues long after I have closed the BSOD Processing app. I think it has something to do with the Results folder that is created. In my case, this folder had stored all the results from when I started using it and has grown to nearly 20GB. Although many of the sub folders within SysnativeResults were created months ago they all have today's date as if something is continually being added or updated with them.

What is going on and why?
 
(I use it as portable in d:\downloads\SysnativeBSODApps)

I too had problems with that folder.
I set it to d:\Downloads\SysnativeBSODApps\outputDmps\SysnativeResults.
But in that folder it replied itself at least 10 times.
Given that I get the same results in D:\Downloads\SysnativeBSODApps\outputdumps, I disabled it.
I.e., options - untick "output sysnative directory".
 
Consider an easily viewable website link to report problems running the Sysnative log collector.
 
zbook said:
Consider an easily viewable website link to report problems running the Sysnative log collector.
Click to expand...
They can just raise the issue in their thread and a majority of the issues with the Sysnative log collector are due to either the user or their AV program.
 
xilolee said:
(I use it as portable in d:\downloads\SysnativeBSODApps)

I too had problems with that folder.
I set it to d:\Downloads\SysnativeBSODApps\outputDmps\SysnativeResults.
But in that folder it replied itself at least 10 times.
Given that I get the same results in D:\Downloads\SysnativeBSODApps\outputdumps, I disabled it.
I.e., options - untick "output sysnative directory".
Click to expand...

Thanks @xilolee that seems to have sorted out all my issues.
 
The culprit for that behavior is the "application data" junction, located in "c:\users\%username%\appdata\local".
Users, like you and me, tend to get the ownership of folders (and then forget).
We need to restore its permissions and its owner (indeed, it seems now its working correctly).

Default permissions:
Everyone:(DENY)(S,RD)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
YourPCName\YourUserName:(I)(OI)(CI)(F)

Default owner: SYSTEM


Seeing the c:\Users\Default\AppData\Local folder, I have an older "application data" (November 2017).
Its permissions:
Everyone:(DENY)(S,RD)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
Everyone:(I)(RX)
Everyone:(I)(OI)(CI)(IO)(GR,GE)
 
Last edited:
philc43 said:
@writhziden I have noticed that there is a very large amount of disk activity that continues long after I have closed the BSOD Processing app. I think it has something to do with the Results folder that is created. In my case, this folder had stored all the results from when I started using it and has grown to nearly 20GB. Although many of the sub folders within SysnativeResults were created months ago they all have today's date as if something is continually being added or updated with them.

What is going on and why?
Click to expand...
xilolee said:
(I use it as portable in d:\downloads\SysnativeBSODApps)

I too had problems with that folder.
I set it to d:\Downloads\SysnativeBSODApps\outputDmps\SysnativeResults.
But in that folder it replied itself at least 10 times.
Given that I get the same results in D:\Downloads\SysnativeBSODApps\outputdumps, I disabled it.
I.e., options - untick "output sysnative directory".
Click to expand...
@philc43 @xilolee I will try to take a look at this over the next week and see if I can determine what is happening. Thank you for reporting it.
 
Alright, I found the culprit. If outputdumps accumulates a lot of outputs from previous analyses over days, weeks, months, or years, SysnativeResults will keep copying those output subdirectories when the program exits. I am going to release an update later today that only copies output subdirectories that do not already exist.
 
xilolee said:
You could also move and rename the outputdmps folder instead of creating a new SysnativeResults folder...
Click to expand...
I believe this was a request to maintain all past results as well as the most recent results, so I would not want to lose the files that already exist. We just need to prevent copying of output directories that already exist. There should be no reason to keep overwriting existing files.
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top