large debug files

  • 2
  • Problem
  • Updated 3 years ago
  • Solved
Hi,
I installed Maxiimum Security 10 on a second computer yesterday and I have 5.5 GB of files in the AMSP\debug folder.
In subfolder 10005 the TMUFE_UF.log is over 1GB.
In subfolder 20004 the
09052016_NSC_TmProxy.log is over 1GB and
08052016_NSC_TmProxy.log is over 300MB.
In subfolder 10009 the LCEDebug.log is 42MB and there are five .bak files over 50MB.
in subfolder 20011 the 2016-05-07_11-36-38_EE_Tmeext7.etl file is 39MB and there are five .etl files all 51.2MB.
In my first computer non of those files exist apart from the LCEDebug.log which is 0KB.
(in subfolder 10011 there is a tmsa.log of 42MB in the first comp and 51MB in the second computer).
Is there a setting I can change (I couldn't find one) or do I just delete them and the problem won't reoccur?
Regards
Peter
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb

Posted 3 years ago

  • 2
Photo of pragmatic

pragmatic

  • 280 Points 250 badge 2x thumb
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
Thanks however it doesn't seem to be applicable and didn't solve the issue. 
I started collecting data using the tool kit and then clicked Finish Collecting Data (that wasn't successful due to the hard drive being full due to the 5.5GB of log files). 
The note at the end to Delete debug log files refers to another location, \titanium\archive, which is different to that which the files I am concerned about are.  There is a 137MB supptool_log in the archive folder generated at the time of installation.
The log files I am concerned about are being modified about every 15 minutes and keep going until the drive is full (which is a bit annoying to say the least). 
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
While in the process  of doing that, Maximum Security got turned off and I had to delete some log files to make room for it to start.
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
I found an article about downloading a HotFix to turn off AMSP log server for Titanium 2013 but after doing that I found a file under the AMSP folder called
AMSP_kill_amsp_log_server.bat so I ran that.
A 1GB dump file has been generated in AMSP\dump
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
Later I found another file called AMSP_kill_log_server.bat and ran that too.  Those changes seem to have stopped all continuously generated log files except for dre.log in 10012 and tmbep.log in 20002.
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
My first computer had the program installed from a CD and the second was downloaded from the website.
Photo of pragmatic

pragmatic

  • 280 Points 250 badge 2x thumb
apps usually generate logs from time to time and they have a predefined limit
say for example, when it reaches 25MB the oldest entry will be deleted/overwritten

but there can be exceptions like when it comes to diagnostic tools

if you'ved messed up with the diagnostic toolkit of TM before then you have to make sure that the logging gets disabled
if you can't click on finish collecting data, then you need to find a way to have an extra space first
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
Thanks.  I only installed the program on my second computer on Saturday and hadn't run the diagnostics. The AMSP log server must have been activated by default when installing from the website.
Is there an issue with what I have done turning off both the AMSP and the "ordinary" log servers using those batch files?  (I notice there are batch files to turn them back on)
Photo of pragmatic

pragmatic

  • 280 Points 250 badge 2x thumb
it's the same whether you install from the cd or website
i suggest that you don't mess with the internals of the program
if you still encounter the problem, the easiest way would be to reinstall
in that way, the settings will be reverted back to default
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
Thanks, however I hadn't changed any Maximum Security system settings on either computer (just the normal UI options) and the first one installed from the CD didn't have 5.5GB of debug files generated in 2 days (which didn't self delete) filling up the hard drive and making it unusable.  (The first one does take a very long time "Starting your protection" but I'll put that in another post).  The article I was referring to with the hotfix to overcome the issue I was having is https://esupport.trendmicro.com/en-us/home/pages/technical-support/1096316.aspx
so it has happened to other people before (note that I never used that download as I was concerned that it was for an earlier version and I found the batch files so used them instead).
Photo of pragmatic

pragmatic

  • 280 Points 250 badge 2x thumb
yes, it was created for an earlier version 
and hotfixes by nature only apply to the version they are created for
Photo of TM_Claudia

TM_Claudia

  • 10,882 Points 10k badge 2x thumb
@pragmatic  Thanks for providing some useful info.

@prgmilne62  We're checking internally to get you more information on this. Thanks!
(Edited)
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
Hi Claudia,
Any progress on this issue?
Although the rapidity and magnitude of the files that are being generated is much reduced since (I think) I "killed" the two log servers using the AMSP batch files, I am still getting significant files being generated in the debug section totalling about 1GB over the last week.
Those files include:

TMUFE_UF (109MB) and CS (11MB) files
6 x LCEDebig.log files about 51MB each
5 x tmsa.log files about 51MB each
10x tmbep.log files about 11MB each
8 x dated tmncieum.etl files (half are small but one is 43MB, one 33MB)
23 x dated _EE_Tmeext(?).etl files most 51.2MB
(Edited)
Photo of TM_Claudia

TM_Claudia

  • 10,882 Points 10k badge 2x thumb
Hi Peter, sorry for the delay. I've sent another inquiry to our backend team to follow up, and have also passed the updated info you've provided. I hope to get an answer from them and update you soon. In the meantime, it's good to hear that your situation has improved a bit. Thanks. -Claudia
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
Hi Claudia.
The situation has deteriorated again with
tmnciekm.etl of 1GB
34 x dated _EETmeext?.etl of 51.2MB each
TSCDebug_FF8_0_6B62.log of 417MB
(Edited)
Photo of TM_Claudia

TM_Claudia

  • 10,882 Points 10k badge 2x thumb
Thank you for reporting this issue and sorry for the inconvenience. We are currently investigating in our lab and will get back to you soon.
Photo of TM_Claudia

TM_Claudia

  • 10,882 Points 10k badge 2x thumb
Per our investigation, this issue may be caused by incorrect log config setting. Please follow the steps below to check the setting on your side:
1) Go to folder C:\Program Files\Trend Micro\AMSP
2) Locate the file AmspLogFilter.ini, and use a text editor to open it.
3) Confirm if the setting in your AmspLogFilter.ini is the same as below. If not, modify to match the values below.
    LOG_INFO_TYPE_ENGINE_TMPROXY=0 
    LOG_INFO_TYPE_ENGINE_TMUFE_UF=0 

Please let us if the solution resolves your issue, and we'll assist you if you still encounter problems. Thank you.

Trend Micro Home Users Community
(Edited)
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
Thanks.

Unfortunately those settings were already at 0 as were all settings except for LOG_INFO_TYPE_FRAMEWORK=2
; LOG_INFO_TYPE_ENGINE=2     [ is the ";" meant to be there? It was after a blank line]
LOG_INFO_TYPE_ENGINE_IAU=3

debug file generation isn't as active today.
Largest are
ssapi.log   42MB
LCEDebug.log  37MB
LCEDebug.log_1.bak    51.6MB
2016-05-19_18-49-41_EE_Tmee1.etl  47MB

I notice in the ssapi.log that

05/20/2016 11:20:41 [548] CSSScanner::GetParams() ENTER
05/20/2016 11:20:41 [548] CSSScanner::GetParams() EXIT

was repeated 56,072 times in 42 seconds.  That seems a bit unusual (unless it's sequentially loading data from a file or something).

after the final repeat the next lines were

05/20/2016 11:21:23 [548] db rec not found
05/20/2016 11:21:23 [548] SSGetNextRow() EXIT
05/20/2016 11:21:23 [548] SSCloseHandle() ENTER ssc=1, lHandle=0
05/20/2016 11:21:23 [548] CSSScanner::GetParams() ENTER
05/20/2016 11:21:23 [548] CSSScanner::GetParams() EXIT
05/20/2016 11:21:23 [548] SSCloseHandle() EXIT
05/20/2016 11:21:23 [548] SSQuit() ENTER ssc=1
05/20/2016 11:21:23 [548] CSSScanner::DeInit() ENTER bLastInstance=1
05/20/2016 11:21:23 [548] CSSScanner::DeInit() EXIT
05/20/2016 11:21:23 [548] DeInitTmTAPIDriver() ENTER
05/20/2016 11:21:23 [548] DeInitTmTAPIDriver() EXIT ret=1
05/20/2016 11:21:23 [548] DeInitLSPFuncs() ENTER
05/20/2016 11:21:23 [548] DeInitLSPFuncs() EXIT
05/20/2016 11:21:23 [548] SSQuit() EXIT
05/20/2016 11:21:23 [548] SSSetRCMTable() ENTER ssc=0, lpBuffer=0x00000000, dwSize=0
05/20/2016 11:21:23 [548] SetRCMTable() ENTER
05/20/2016 11:21:23 [548] SetRCMTable() EXIT g_pRCMTable = 0x00000000, lRet = 0
05/20/2016 11:21:23 [548] SSSetRCMTable() EXIT SetRCMTable() return 0

------------------------------------ SSAPI Session Ended ---------------------------------



I think I will do a reinstall if you can't find a solution in the next 24 hours.
Last installation was done downloading from the website.
I have copied files from the CD to my computer but couldn't find a file to install it (and I don't have the CD with me) hence the web install.  The CD version is ANZ TTi10 HE.  Where and what is the installation file?
(Edited)
Photo of TM_Claudia

TM_Claudia

  • 10,882 Points 10k badge 2x thumb
OK your log file ini settings look fine. Given the situation you're encountering, a reinstall is a good way to make sure everything is reset.

Do you see a Setup.exe file in the CD image you copied? If so, that's the file you want to execute to start the installation. Here's a help doc reference for installing from CD:
Installing Maximum Security using the CD

If not, the downloaded installer should work fine as well. Please see this doc to download and install from the web:
Reinstalling the latest version of Trend Micro Security program

Thanks and please keep us posted on how the reinstall goes. If the issue still occurs, then we'll try to get someone from product development to look into it.

Trend Micro Home Users Community
Photo of prgmilne62

prgmilne62

  • 260 Points 250 badge 2x thumb
The re-install took a couple of varied attempts but eventually worked well.  Thanks.
Photo of TM_Claudia

TM_Claudia

  • 10,882 Points 10k badge 2x thumb
Thanks for notifying us! We're happy to know your Maximum Security works well on your computer now! Please feel free to contact us in the community at any time if debug log issues occur again.

Trend Micro Home Users Community

This conversation is no longer open for comments or replies.