System-Windows-Logdateien

[delphinbtf]

hallo !

ich habe folgendes problem ;

mein laptop arbeitet teilweise tierisch im hintergrund obwohl kein programm offen ist und der Mozilla Firefox 3.6 hängt teils tierisch (es kommt auch teils die meldung "keine rückmeldung).
als ich den CCleaner laufen liess , ist mir aufgefallen das die system-windows-logdateien innerhalb von ca. 10 min. auf fast 500 kb schnellen.
woran kann das liegen ?

hier einige logdateien ;

(Thu Mar 11 15:54:11 2010.1423453) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:11 2010.1423453) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:16 2010.1428296) : Failed to log an event: 5DE
(Thu Mar 11 15:54:16 2010.1428296) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:16 2010.1428296) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:16 2010.1428296) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:16 2010.1428296) : Failed to log an event: 5DE
(Thu Mar 11 15:54:16 2010.1428296) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:16 2010.1428296) : Failed to log an event: 5DE
(Thu Mar 11 15:54:16 2010.1428296) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:16 2010.1428296) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:16 2010.1428296) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:21 2010.1433328) : Failed to log an event: 5DE
(Thu Mar 11 15:54:21 2010.1433328) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:21 2010.1433328) : Failed to log an event: 5DE
(Thu Mar 11 15:54:21 2010.1433343) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:21 2010.1433343) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:21 2010.1433343) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:21 2010.1433640) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:21 2010.1433640) : Failed to log an event: 5DE
(Thu Mar 11 15:54:21 2010.1433640) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:21 2010.1433640) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:26 2010.1438484) : Failed to log an event: 5DE
(Thu Mar 11 15:54:26 2010.1438484) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:26 2010.1438484) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:26 2010.1438484) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:26 2010.1438484) : Failed to log an event: 5DE
(Thu Mar 11 15:54:26 2010.1438484) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:26 2010.1438484) : Failed to log an event: 5DE
(Thu Mar 11 15:54:26 2010.1438500) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:26 2010.1438500) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:26 2010.1438500) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:31 2010.1443546) : Failed to log an event: 5DE
(Thu Mar 11 15:54:31 2010.1443546) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:31 2010.1443546) : Failed to log an event: 5DE
(Thu Mar 11 15:54:31 2010.1443546) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:31 2010.1443546) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:31 2010.1443546) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:32 2010.1443859) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:32 2010.1443859) : Failed to log an event: 5DE
(Thu Mar 11 15:54:32 2010.1443859) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:32 2010.1443859) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:37 2010.1448703) : Failed to log an event: 5DE
(Thu Mar 11 15:54:37 2010.1448703) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:37 2010.1448703) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:37 2010.1448703) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:37 2010.1448718) : Failed to log an event: 5DE
(Thu Mar 11 15:54:37 2010.1448718) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:37 2010.1448718) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:37 2010.1449031) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:37 2010.1449031) : Failed to log an event: 5DE
(Thu Mar 11 15:54:37 2010.1449031) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:37 2010.1449031) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:42 2010.1453875) : Failed to log an event: 5DE
(Thu Mar 11 15:54:42 2010.1453875) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:42 2010.1453875) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:42 2010.1453875) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:42 2010.1453875) : Failed to log an event: 5DE
(Thu Mar 11 15:54:42 2010.1453875) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:42 2010.1453890) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:42 2010.1454187) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:42 2010.1454187) : Failed to log an event: 5DE
(Thu Mar 11 15:54:42 2010.1454187) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:42 2010.1454187) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:47 2010.1459031) : Failed to log an event: 5DE
(Thu Mar 11 15:54:47 2010.1459031) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:47 2010.1459031) : Failed to log an event: 5DE
(Thu Mar 11 15:54:47 2010.1459031) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:47 2010.1459031) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:47 2010.1459031) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.
(Thu Mar 11 15:54:47 2010.1459359) : NT Event Log Consumer: could not retrieve sid, 0x80041002
(Thu Mar 11 15:54:47 2010.1459359) : Failed to log an event: 5DE
(Thu Mar 11 15:54:47 2010.1459359) : Dropping event destined for event consumer NTEventLogEventConsumer="SCM Event Log Consumer" in namespace //./root/subscription
(Thu Mar 11 15:54:47 2010.1459359) : Failed to deliver an event to event consumer NTEventLogEventConsumer="SCM Event Log Consumer" with error code 0x80041001. Dropping event.



ich hoffe mir kann jemand weiterhelfen !

vielen dank im voraus !

[cuckoo]

Herzlich Willkommen im Forum "delphinbtf"

Für spätere Analysen (wie z.B. bei Fehlern) zeichnet Windows gewisse Aktionen auf. Darunter zählen Abstürze, Hardware- und Softwareinstallationen sowie Änderungen an der Systemkonfiguration. Diese Protokollierung benötigt relativ viel Systemressourcen und sollte für die meisten sowieso nicht nötig sein. Die Funktion schreibt nämlich permanent auf die Festplatte und fragmentiert diese nach einer Zeit. Um die gesamte Protokollierung still zu legen geht man folgendermaßen vor:

1. Klicke nacheinander auf Start > Ausführen und tippe regedit ein.
2. Navigiere nun durch die Schlüssel HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\WBEM\CIMOM und doppelklicke im rechten Teilfenster zunächst auf EnableEvents. Tausche die dort vorhandene 1 durch eine 0 aus.
3. Nun klicke zweimal auf den nächsten Wert genannt Logging und ändere diesen wie oben auf 0.

4. Der nächste Wert, den es auszutauschen gilt, heisst Backup Intervall Threshold, welchen am besten auf 1 00. Dies ist der Zeitabstand in Minuten bei dem automatisch mitgeschrieben wird.

Nachdem wir nun neu Starten sind wir die Protokollierung los. Schaue aber bitte noch in dem Ordner X:\WINDOWS\system32\WBEM\Logs\ löschen dessen Inhalt.

[delphinbtf]

hallo , vielen dank für deine antwort !

den ordner "Backup Intervall Threshold" hab ich nicht.

diese logdateien hab ich immer noch ;

USERENV(474.c5c) 22:28:10:906 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:10:921 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:10:921 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:15:968 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:15:968 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:15:984 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:21:125 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:21:125 ProcessAutoexec: Cannot process autoexec.bat.
USERENV(474.c5c) 22:28:21:140 ProcessAutoexec: Cannot process autoexec.bat.

[cuckoo]

Hast Du "EnableEvents" und " Logging " auf 0 gesetzt ??? wenn ja müssen wir " Backup Intervall Threshold " erstellen, normalerweise sollte "EnableEvents" schon ausreichen. Oder schicke mir mal von CIMON einen Screenshoot.

[delphinbtf]

guten morgen !

ja die 2 ordner hab ich auf null gestellt .

leider hab ich immer noch hohe logdateien.
im anhang der screenshot.
lg

[cuckoo]

Jetzt brauchen wir einen neuen Schlüsse, und das geht so:
Öffne die Registry und gehe auf CIMON klicke diese Datei an und wähle neue Zeichenfolge hier geht ein neuer Schlüssel auf. Trage hier den Namen ein Backup Intervall Threshold, nach diesen Eintrag klicke diesen an und schreibe 100 hinein FERTIG ( NEUER START)

[delphinbtf]

hallo !

ich habe den neuen schlüssel angelegt und auf 100 eingestellt.
den neustart hab ich auch gemacht.
der pc war grad mal 2 min. an und es waren immer noch 94 logdateien.
im anhang ist der bericht von ccleaner .
lg

[cuckoo]

Noch einen Unterschlüssel Erstellen :
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Eintrag: UserEnvDebugLevel

Sollte der Eintrag "UserEnvDebugLevel" nicht vorhanden sein mus ein neuer DWORD-Wert
erstellt werden .
Suche den oben genannten Schlüssel gehe auf Winlogon
Neu DWORD-Wert trage den Namen ein UserEnvDebugLevel
der Wert steht jetzt bei 0x00000000 (0), so stehen lassen.

Für "UserEnvDebugLevel" sind die folgenden Werte möglich:
NONE 0x00000000
NORMAL 0x00000001
VERBOSE 0x00000002
LOGFILE 0x00010000
DEBUGGER 0x00020000
Der Standardwert ist NORMAL | LOGFILE (0x00010001).

Hinweis Zum Deaktivieren der Protokollierung wähle NONE (0x00000000) aus.

Ich hoffe, dass es jetzt in Ordnung ist.

[delphinbtf]

juhuuuuuuuuuu ! es läuft wieder so wie´s soll !
vielen vielen lieben dank !!!