Share via


OneDrive for business keeps generate log files.

Question

Wednesday, January 24, 2018 6:24 AM | 1 vote

Recently after some office or windows updates, the OneDrive for business on my laptop keeps generating a lot log files under C:\Users\Username\AppData\Local\Microsoft\Office\Spw\logs.

The log files name looks like these:

EtwTraces-180123215354-1.etl.z

EtwTraces-180123215354-2.etl.z

EtwTraces-180123215354-3.etl.z

EtwTraces-180123215354-4.etl.z

.....

EtwTraces-180123215354-75.etl

EtwTraces-180123215354-76.etl

EtwTraces-180123215354-77.etl

EtwTraces-180123215354-78.etl

The Groove.exe will take about 20% of the CPU until I stop the process. My sharepoint folder almost empty. There's nothing to sync.

I tried to fix the issue by using the MicrosoftEasyFix20149.mini.diagcab from Microsoft. But the same issue still there after I reconnect the OneDrive for business.

Is there any way I can fix this? Thanks.

All replies (16)

Tuesday, January 30, 2018 9:39 AM âś…Answered | 1 vote

Hi Yao,

I notice there is another user with OneDrive for Business version 1712 encounter a similar issue.

After updating OneDrive for Business (Groove.exe) to new OneDrive Sync client (OneDrive.exe), there is no issue with CPU usage for OneDrive fro Business client.

If you don't want to sync files from SharePoint on-premise server, I suggest you can consider to update to new OneDrive Sync client.
Note: If we want to sync files from SharePoint server, we need to use the legacy OneDrive for Business (Groove.exe).

Best Regards,
Winnie Liang
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].


Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Thursday, January 25, 2018 3:20 AM

Hi Yao,

What's the detailed version of your OneDrive for Business client version number? How did you purchase it before? Is it included in Office 2016 application or a Standalone app you purchased?

If it is included in Office 365 ProPlus application, please update your Office 365 ProPlus app to the latest version. To do it, open Word 2016, go to File > Account > Update Options > Update Now. Then check if the latest OneDrive client will generate logs or not.

If you are using the standalone OneDrive for Business client or MSI version OneDrive client, you can refer to the following article as a workaround:
https://blogs.technet.microsoft.com/odfb/2015/01/02/onedrive-for-business-etl-logging-may-cause-hard-drive-to-fill-up-with-one-log-file/

Best Regards,
Winnie Liang
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].


Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Thursday, January 25, 2018 3:32 AM | 1 vote

Hi Winnie,

I'm using the Office 2016 that included in the Office 365 ProPlus subscription. The version of the OneDrive for Business is 16.0.8827.2148. Check the upgrade from Word 2016 says I already have the latest version.

Thanks,

Yao


Thursday, January 25, 2018 5:29 AM | 1 vote

Hi Winnie,

I found someone also have a similar issue like me. https://answers.microsoft.com/en-us/onedrive/forum/odwork-odfiles/onedrive-for-business-log-files/5b12d441-81d0-4608-881f-747adb0887aa?auth=1

I opened some log files with the SvcTraceViewer.exe. Below are some logs in the file. One etl file contains 8825 traces. Except one header, the contents of the reset traces are same, the only difference is the TimeCreated. Could you please let me know what is this trace for? Is there any way I can stop this logging? Currently the only way I can stop it is kill the Groove.exe.

<E2ETraceEvent xmlns="http://schemas.microsoft.com/2004/06/E2ETraceEvent">
 <System xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system">
  <EventID>0</EventID>
  <Type>3</Type>
  <SubType>0</SubType>
  <Level>0</Level>
  <Version>0</Version>
  <TimeCreated SystemTime="2018-01-24T20:54:37.5271234-08:00" />
  <Source Name="EventTrace_V1_Header" ID="{68fdd900-4a3e-11d1-84f4-0000f80464e3}" />
  <Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" />
  <Execution ProcessID="832" ThreadID="20688" />
  <Channel />
  <Computer />
 </System>
 <ApplicationData>
  <TraceData>
   <DataItem>
    <BufferSize>4096</BufferSize>
    <Version>83951626</Version>
    <ProviderVersion>16299</ProviderVersion>
    <NumberOfProcessors>8</NumberOfProcessors>
    <EndTime>131613310800562814</EndTime>
    <TimerResolution>156250</TimerResolution>
    <MaxFileSize>2</MaxFileSize>
    <LogFileMode>133128</LogFileMode>
    <BuffersWritten>520</BuffersWritten>
    <StartBuffers>1</StartBuffers>
    <PointerSize>4</PointerSize>
    <EventsLost>28083</EventsLost>
    <CPUSpeed>2904</CPUSpeed>
    <LoggerName>0</LoggerName>
    <LogFileName>0</LogFileName>
    <TimeZoneInformation>224</TimeZoneInformation>
    <BootTime>8791154017049772033</BootTime>
    <PerfFreq>3314775771276407296</PerfFreq>
    <StartTime>3170652886736593920</StartTime>
    <ReservedFlags>838872320</ReservedFlags>
    <BuffersLost>838873344</BuffersLost>
    <SessionNameString/>
    <LogFileNameString/>
   </DataItem>
  </TraceData>
 </ApplicationData>
</E2ETraceEvent>

<E2ETraceEvent xmlns="http://schemas.microsoft.com/2004/06/E2ETraceEvent">
 <System xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system">
  <EventID>0</EventID>
  <Type>3</Type>
  <SubType>43</SubType>
  <Level>16</Level>
  <Version>0</Version>
  <TimeCreated SystemTime="2018-01-24T21:17:48.9278284-08:00" />
  <Source Name="{52b2e06f-8b23-46c5-a9c6-37588ee3f829}" ID="{52b2e06f-8b23-46c5-a9c6-37588ee3f829}" />
  <Correlation ActivityID="{00000000-0000-0000-0000-000000000000}" />
  <Execution ProcessID="832" ThreadID="22240" />
  <Channel />
  <Computer /></System>
 <ApplicationData>
  <TraceData>
   <DataItem>
    <Length>140</Length>
   </DataItem>
  </TraceData>
 </ApplicationData>
</E2ETraceEvent>


Thursday, January 25, 2018 6:20 AM

Hi Yao,

Would you mind to share a screenshot about the OneDrive for Business build number to us? If you cannot share the picture here, you can send it to us via GBSD TN Office Information Collection [email protected]. Please involve the thread URL in the email message for easy follow-up :)

Best Regards,
Winnie Liang
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].


Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Thursday, January 25, 2018 6:24 AM

Looks like I cannot paste a screenshot here. I just sent the email.


Thursday, January 25, 2018 6:53 AM

Looks like I cannot paste a screenshot here. I just sent the email.

Yes, I have received it. In my environment, we have upgrade the OneDrive for Business client to new OneDrive sync client in Office 365 ProPlus.

In your scenario, please try to use the following setting to disable the log for OneDrive for Business:

  1. Open Registry Editor.
  2. Go to the following to manually add the key and two values:
    HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Groove\Development
    "TraceLogCompressionEnabled"=dword:00000001
    "EnableEtwTraceLogging"=dword:00000001
  3. After adding the registry key, select on the lower right side, the OneDrive for Business, and right click on the icon, and select Exit.
  4. Open Task Manager, in Details tab, end the task Msosync.exe.
  5. Go to C:\Users\Username\AppData\Local\Microsoft\Office\Spw\logs, delete or cut all log files.
  6. Start OneDrive for Business 2016, confirm if log files are generated.

Best Regards,
Winnie Liang

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].


Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Thursday, January 25, 2018 7:17 AM

Hi Winnie,

I will try this later. Would this cause any trouble if I follow the instructions to disable the logs?

Thanks,

Yao


Thursday, January 25, 2018 7:45 AM

Hi Winnie,

I will try this later. Would this cause any trouble if I follow the instructions to disable the logs?

Thanks,

Yao

The registry key is used to disable logs, no threat to use OneDrive for Business app. If you have any concern to do it, please backup your Office registry settings (HKEY_CURRENT_USER\Software\Microsoft\Office\16.0) before you do any changes.

About how to backup registry, please refer to:
https://support.microsoft.com/en-us/help/322756/how-to-back-up-and-restore-the-registry-in-windows

Best Regards,
Winnie Liang
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].


Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Thursday, January 25, 2018 4:40 PM

 

Unfortunately, it still generates the log files. Just curious, should I set the "EnableEtwTraceLogging" to be dword:00000000 instead of the dword:00000001? Set it to 1 sounds like I want to turn on the logging?

The steps you want me to do seems like this https://blogs.technet.microsoft.com/odfb/2015/01/02/onedrive-for-business-etl-logging-may-cause-hard-drive-to-fill-up-with-one-log-file/. But at the end of the post, It says "6.  After the log is removed, then select OneDrive for Business from the All Programs | Office 2013 | OneDrive for Business, and check if the logs are being created with normal size versus the 1 large ETL log.". It seems this change will just make the log file from a large one to some smaller log files.

Thanks,

Yao


Friday, January 26, 2018 10:31 AM

Hi Yao,

Maybe you are right. I have not fount any settings to directly disable it now. And there is also no group policy settings for OneDrive for Business client. 

What's the data you want to sync with Skype for Business client? If you are syncing SharePoint sites that are associated with Office 365 business, you can consider to use New OneDrive Sync client as a workaround.

Best Regards,
Winnie Liang
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].


Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Saturday, January 27, 2018 1:01 AM | 1 vote

I actually have nothing to sync. My sharepoint folder is empty. My Windows 10 and office 365 installed some updates last weekend. Since then, the OneDrive for Business started to getting busy. It will take 15~20% CPU constantly. I don't know what it is doing. It's just busy and keeps creating the log files.

Set "EnableEtwTraceLogging" to be dword:00000000 actually can stop it from generating the log files. But it still busy and take 15~20% CPU. I don't know what it is doing thought...

The only way to stop it is kill the process...

Thanks,

Yao


Tuesday, January 30, 2018 3:15 PM

Hi Winnie,

Yes, you are right, I upgraded to the OneDrive and it does not have the CPU usage and log issue.

Thanks,

Yao


Wednesday, January 31, 2018 2:33 AM

Hi Winnie,

Yes, you are right, I upgraded to the OneDrive and it does not have the CPU usage and log issue.

Thanks,

Yao

Great. Thanks for your update. If my reply is helpful, please remember to mark it as answer to close the thread. Any further help is needed, feel free to let me know. I am glad to have a discussion with you :)

Best Regards,
Winnie Liang
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].


Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.


Wednesday, January 31, 2018 4:09 AM

Thanks, that's very helpful.

Yao


Friday, February 16, 2018 12:58 PM

I have this issue too. But I use the client for sync with Sharepoint 2013 on premise. How can I fix the issue? As far as I know there is no alternative sync client for Sharepoint on premise.