Disc Useage - NOT 50 MBytes as claimed, but 63 MBytes + up to another 847 MBytes

[Guest]

[Alan Borer]

Ewen

Thank you. I accept the advice and will retain the Repair folder.

I remain tempted to remove the files, and possible to copy them to my external hard-drive, which I can copy back should I need a diagnostic rebuild.  They will not be subject to my usual weekly/monthly back-up, but I will be un-luky if I actually need to do a diagnostic rebuild, and if at that time my external drive copy is lost I am unlucky squared - not very likely - and where is the loss if can can once more download from Comodo free of charge !!!

Just one question - I find under Miscellaneous the option Diagnostics.  And I assume that this gives me manual control of when I start a diagnostic rebuild, so I can copy the repair files into the repair folder before I  start the rebuild.  Is this safe, or is it possible that for any reason the Firewall might decide to automatically start a diagnostic rebuild without me having chance to copy these files ?

Regards
Alan

[panic]

Alan,

Good idea to store the repair files offline.

The diagnostics option is automatic. you click it and it runs. I'd ensure the repair files are there before clicking.

If a file needed to be rebuilt during a diagnostics check and the file wasn't there, the diagnostics would halt (I'm almost 100% certain a check is done for the repair file BEFORE anything destructive like attempting to replace a file is done, but don't hold me to this until I can test it over the weekend). At this point you should be able to manually restore the repair files to the REPAIR folder and rerun the diagnostics.

As I said, I'll try and get this tested over the weekend and post back here.

Cheers,
Ewen :-)

[Alan Borer]

Thanks Ewen

Alan

[Soyabeaner]

Good idea to store the repair files offline.

The diagnostics option is automatic. you click it and it runs. I'd ensure the repair files are there before clicking.

If a file needed to be rebuilt during a diagnostics check and the file wasn't there, the diagnostics would halt (I'm almost 100% certain a check is done for the repair file BEFORE anything destructive like attempting to replace a file is done, but don't hold me to this until I can test it over the weekend). At this point you should be able to manually restore the repair files to the REPAIR folder and rerun the diagnostics.

I have already done this before: deleted all files in the Repair directory and ran the diagnostics still ran without any problems reported or quirks encountered.  Related topic:
http://forums.comodo.com/bug_reports/diagnostics_tool_incorrectly_doesnt_find_any_problems_3022349_xp_sp3_x86-t22664.0.html

[panic]

I'm pretty sure the reopair files only come into play IF diagnostics finds a problem.

Ewen :-)

[Soyabeaner]

May I should try removing cmdagent.exe or cpf.exe and confirm for you

Well, I'm not a gambler so I only removed cfpsbmit.exe and cfplogvw.exe and the repair files again, and voila the Diagnostics could not fix my problems.  You were right .

[panic]

Oh ye of little faith. 

[LeoniAquila]

I have already done this before: deleted all files in the Repair directory and ran the diagnostics still ran without any problems reported or quirks encountered.  Related topic:
http://forums.comodo.com/bug_reports/diagnostics_tool_incorrectly_doesnt_find_any_problems_3022349_xp_sp3_x86-t22664.0.html

I notice that the topic now has become a bug report again, I thought it was a feature that the Repair directory was not included in the diagnostics wizard?

Well, I'm not a gambler so I only removed cfpsbmit.exe and cfplogvw.exe and the repair files again, and voila the Diagnostics could not fix my problems.

Well done!

LA

[Alan Borer]

Anyway developer are able to set those timestamps to a fixed value so future version of CFP can remove this issue.
I guess the same goes for those ResFiles clones in each user profile.

Hi Gibran

Warning - perhaps it is not the date and time stamp changes that triggers Restore Point, in which case keeping it fixed would not fix the problem.

I used Notepad to create "alan_test.ini". After a minute I clicked File -> Save and the time stamp changed, but System Restore ignored it.  I suspect the Firewall does something to the file additional to changing the time stamp, and it is this additional thing that kicks System Restore into action.

I have done extensive testing for a couple of weeks whilst exploring how to disable monitoring of chosen folders by System Restore, and found a very convenient way of observing success or failure within one second, i.e. no need to actually create a Restore Point and then do the file change and then Restore back to the point just made.

W A R N I N G  T O  F O R U M  R E A D E R S - T H I S  C A N  D A M A G E  Y O U R  C O M P U T E R.
This ventures into system files that should be o.k. so long as you dont accidentally delete.

With Windows Explorer, select "System Volume Information".
This holds one folder "_restore{...."  select this and observe many folders called RPnnn, where nnn is a 3 digit number.
Select the latest one, and click on "Name" column until rp.log is at the bottom
Select rp.log - BUT DO NOT OPEN OR READ OR ANYTHING
Now you should see change.log  two items higher - if it is not there then this is not the latest current Restore Point;
Now just watch the size and date of change.log, and a numbered sequence of A0nnnnnn.xxx files immediately above it.
When the Firewall does its thing you will immediately see the change.log time stamp alter and its size increase as it records information upon original name and location, and simultaneously 141 of A0nnnnnn.ico plus 2 off a0nnnnnn.ini files will appear immediately above change.log.  If you see no change you may have fixed the problem.
When you think it is fixed, try it another dozen times to be sure.  My experience has been that some days Restore Point activated every 1801 Seconds when the Firewall did whatever, but other days it might fail to operate for several periods in a row - I do not know if the Firewall is variable in what it actually does, or if my 4 year old P.C. has any race hazards or other Operating System features which allow System Restore to occasionally fall down on the job.

Regards
Alan

[gibran]

Hi Gibran

Warning - perhaps it is not the date and time stamp changes that triggers Restore Point, in which case keeping it fixed would not fix the problem.

...snip...

I attempted to find more infos about system restore.

System and Application File Change Monitoring

In addition to collecting restore points that are associated with specific events and times, System Restore also constantly monitors other key system and application file changes. Tracking these file changes is necessary to fully restore the system to a particular state. This aspect of the feature works to record and, if necessary, preserve a previous file state, which enables the user to restore to a previous system state. This change tracking will not interfere with the user's performance experience.

To track and copy files before changes, System Restore uses a file system filter driver that is at the kernel level (called Kernel Mode). This kernel level filter driver monitors file system operations, and, for select file types and operations, quickly interrupts an operation (for example, DELETE FILE) and copies or moves the original file before the operation is complete. The file changes are entered into a log, and the file copies and logs are stored in an archive on the drive or partition where the original file resided. Change-based file copying happens once per specific file per system session or for any given restore point.

SR Monitored File Extensions

As for a workaround MS explicitly states this:

Or have you specified the registry keys where this information is stored in the registry under hklm->system->currentcontrolset->control->backuprestore->KeysNotToRestore? If the information also resides in files, have you ensured System Restore will not restore these files by calling out hklm->system->currentcontrolset->control->backuprestore->filesnottobackup?

which correspond to the topic you linked.

Using Allusers profile and that filesnottobackup key this issue could be avoided.

On a sidenote I don't know how Resfiles are used. They could be only read once when CFP is run (this mean they could be placed in a temp dir and deleted afterwards) or they could be read every now and then when CFP is running (this means that they should not be deleted when cfp is running and they should be out of the reach of users).

I deleted Resfiles dir and CFP GUI still retains its images after few minutes...

[Alan Borer]

Thanks Gibran,

I clicked on your Microsoft links to get the context, and immediately saw I was in a 12 page document.  My normal reaction is to immediately go back to the search results and click on the next link. (I just Googled "system restore xp" and got over 4 million hits - life is too short !!!)

Gibran, you are a hero, and out of my league.  You found information in 12 pages of data !!!  Amongst this information is
"Change-based file copying happens once per specific file per system session or for any given restore point."
I had wondered why System Restore sometimes failed to catch some of the 30 minute twitches - I now wonder why it sometimes seems to catch every one throughout the day.  My brain hurts - I will stop asking questions and accept that System Restore does whatever it does, and will leave it to the Comodo developers identify and fix whatever can be fixed.

nb  One extra piece of information I observed on http://msdn.microsoft.com/en-us/library/ms997627.aspx
"Are user-editable files, or intended personal data files (for example, .pdf, .xls, .htm) named in such a way that they will not be monitored as included extension types? For example, have you named a file extension .ini that a user can modify as a personal data file? If so, this will impede the perception of your product's performance, as well as cause the user to lose work as a result of a restore. (See the Monitored File Extensions list in the System Restore section of the Platform SDK.)"
They quote "file extension .ini" as an example.  This would also apply to ".ico".  And it has resulted in the consequence they warned of, i.e. "impede the perception of your product's performance".

Regards
Alan

[gibran]

Alan you are welcome.
Your tests and comment will help devs to improve CFP & system restore interaction.

As you are going to take part in this community, your post count will increase and you'll get your status updated to Comodo Hero in no time.

Please as soon as you find a cfp release that fix this issue update this topic so we'll mark this as a resolved issue and lock the topic.

[Alan Borer]

Thanks Gibran

I generally ignore any sort of BETA or Release Candidate, and wait for a final public offering, and wait another week to see if any issues are reported, and then I will consider download and install.

I have taken quite a personal interest in this particular issue, and will ignore my life long principles and eagerly download and test and provide feedback on any BETA issue that has a prospect of fixing this "feature".

When it is available, if you could give me a link to download from, it would help me get into action quicker, either   P.M. or a public note appended to this topic in case others are also interested.

I will be back !!!

Regards
Alan

[Tags:]