msrdc in WSL generates huge logs, how can I stop it?

[GZTimeWalker]

My platform:

WSL Version:  0.58.3.0
Kernel Version:  5.10.102.1
WSLg Version:  1.0.33
MSRDC Version:  1.2.2924
Direct3D Version:  1.601.0
Windows Version:  10.0.22621.1

I found huge logs (about 20GiB in total, 8MiB per file) in my %LocalAppData%\Temp\DiagOutputDir\RdClientAutoTrace folder, like RdClientAutoTrace-WppAutoTrace-20220607-185125-307.etl. I found something about rdclientax.dll in the binary, so I searched my disk but only found it in WSL folder. It is generating logs very frequently, and takes up lot of disk space, how can I stop it?

Most of the log is byte FF, the content as below...

Current I am using an empty file %LocalAppData%\Temp\DiagOutputDir\RdClientAutoTrace to prevent more logs from being written to my disk...

Track this issue on #10216

[rainmanwy]

same problem here.

Lots of "RdClientAutoTrace-WppAutoTrace-20220629-015518-417.etl" kind of files created, and eat my system disk space.

it is ok before, and this problem happened for one week.

[definitiontv]

Same here

[mnjames]

I uninstalled WSL and the logging stopped. When I re-installed it, it began again. So I can confirm that it is being caused by WSL.

[cdonnellytx]

This started happening for me as well in the past week and kicked into high gear starting yesterday morning (~9 AM US/Central).

My platform:

WSL version: 1.1.3.0
Kernel version: 5.15.90.1
WSLg version: 1.0.49
MSRDC version: 1.2.3770
Direct3D version: 1.608.2-61064218
DXCore version: 10.0.25131.1002-220531-1700.rs-onecore-base2-hyp
Windows version: 10.0.22621.1265

Installed WSL list:

Windows Subsystem for Linux Distributions:
Ubuntu (Default)
docker-desktop
docker-desktop-data

Docker Desktop: 4.17.0

Ubuntu:

uname -a

Linux [REDACTED] 5.15.90.1-microsoft-standard-WSL2 #1 SMP Fri Jan 27 02:56:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Files (currently around 47 GB):

cd ~\AppData\Local\Temp\DiagOutputDir\RdClientAutoTrace
ls | group { $_.basename.substring(31, 11) } | select count, name, @{ Name = 'Size'; Expression = { [long] ($_.group | measure -Sum length).sum } }

Count Name              Size
----- ----              ----
    1 20230308-05    8912896
   17 20230308-15  137887744
  305 20230308-16 2494038016
  306 20230308-17 2538602496
  310 20230308-18 2552758272
  309 20230308-19 2462056448
  320 20230308-20 2529689600
  293 20230308-21 2414346240
  322 20230308-22 2641362944
  317 20230308-23 2528641024
  336 20230309-00 2739929088
  352 20230309-01 2823815168
  321 20230309-02 2595225600
  332 20230309-03 2624585728
  327 20230309-04 2595225600
  332 20230309-05 2628255744
  326 20230309-06 2617769984
  290 20230309-07 2266497024
  321 20230309-08 2508718080
  333 20230309-09 2616197120
   52 20230309-10  407371776
    3 20230309-12   23068672
  104 20230309-15  866123776
  319 20230309-16 2637168640
   27 20230309-17  220725248

Deleting them for now but it's still generating them.

[bszonye]

I've just noticed this same behavior today. While debugging another problem, I noticed many RdClientAutoTrace errors in Windows Event Viewer like this:

Session "RdClientAutoTrace" failed to start with the following error: 0xC0000022

I investigated further because unexpected log messages related to Remote Desktop Client sounded like a potential security problem. That eventually led me to look in the log directory, where I found over 300 of these RdClientAutoTrace logs totalling about 3GB.

I happened to notice that it was generating a new log every time I open File Explorer to the Home location. As Explorer scans for drives, RdClientAutoTrace creates a new 9-10 MB log. While troubleshooting this, I also noticed that the total number of logs decreases sometimes, and the oldest log is consistently one week old. (Took me a while to notice the pattern because the recent Daylight Savings change has offset our clocks by an hour.) The process appears to clean up any logs older than one week when it writes the new one.

I also just noticed that File Explorer will automatically refresh its view periodically, which will trigger another log entry if there's a tab on the Home location. This could potentially trigger a lot of log entries depending on what you have running in the background. I imagine that applications other than File Explorer could also cause this by scanning the drive list.

Looking at Event Viewer again, I can see that there's a "failed to start / 0xC0000022" entry for each time Explorer triggered the problem.

Hope this helps with troubleshooting.

[0x6f677548]

That may happen because Explorer tries to scan wsl mounts.
I just checked that a trace is created every time wsl starts (see below) . Maybe the integration of Explorer with WSL also triggers the trace.

[chizou]

I'm seeing a similar problem. I left my computer on for a week without touching it and during this week, it generated 39k files and ate up 223 GB.

[Amit-A2Z]

I got 156GB and system started hanging up. Cleaned it using MS PC Manager.

[PaintOnBrush]

I cleaned it with del %LOCALAPPDATA%\Temp\DiagOutputDir\RdClientAutoTrace\*.etl

[0x6f677548]

While this doesn't get fixed, I have deployed a scheduled task that looks for this type of file and deletes it based on LastAccessTime. It is not the perfect solution, but unfortunately, I was already using it to delete office tracing and logging files that also get lost in the TEMP folder, eating disk space.
It's a simple script. Take a look at https://github.com/0x6f677548/shell-utils/tree/main/file
(use at your own risk - please read the script carefully before executing it.)

[Amit-A2Z]

I rather go to the services and close the wsl, windows subsystem etc. services. I cannot make to manual start though. It remains in automatic start phase.
I have to do it every time I boot-up or afterwards of starting the wsl. But it stops creating logs.

[mnjames]

I blocked the problem for a long time by setting the filesystem permissions on the RdClientAutoTrace folder so that nothing could write to it.

However, I recently discovered another solution which I think might also solve the related problem of msrdc.exe using large amount of ram while I wasn't using wsl at all. The solution was to create a file called .wslconfig in my %USERPROFILE% with the following lines of code in it:

[wsl2]
guiApplications=false

After creating and saving that file, I ran the command wsl --shutdown and the logging stopped.

Obviously, this is going to almost certainly break the wslg functionality of having gui applications running in Windows, and so is still a workaround and not a true solution.

[baoanhng]

I give up on WSLg, X.org server bridge is just far superior right now.

[sarim]

This should be make into a issue

[KDAM71]

You can limit the space the logs take or stop logging alltogether using event viewer. In event viewer go to applications and services > microsoft > windows > kernel-eventtracing. Doubleclick it and admin will appear underneath. Rightclick on admin and click properties. Here you can limit the space to use or turn of logging alltogether.

[jorismak]

the problem with me is not only the logs.
My whole system stalls everytime a log like this is created. Mouse stops, typing stutters. Every 20 seconds or so.
The same with EventViewer logs about no session for RdclientAutoTrace possible (same error as above).

Responsiveness of whole system is skewed now.

I can do wsl --shutdown and it stops, but after a few seconds it auto starts my default distribution again!

Yes, I have an explorer window open but c'mon...

Disabling gui support doesn't seem to help (or I need to try to reboot first).

[KDAM71]

I had a somewhat similar problem caused by vmmemwsl. As long as you're not using wsl you can disable a couple of related processes by setting the starttype of wslservice to disabled in the registry. The registry path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WslService. Here you change the value of Start to 4 (disabled). You have to restart windows for it to take effect. When you want to use wsl you change the Start value back and restart windows. I hope this is a solution for your problem. When you export Start with both values, it's easiest to change it in the future with a few mouseclicks.

[ariaieboy]

311 GB of storage occupied by these logs in my computer, and my 512GB SSD is full now.

[jorismak]

Yes, it fills logs we know that now. Disable GUI support for the time being.

I'm still baffled by wsl starting out of nowhere automatically, even without an explorer open and no shares mounted , no recent files, nothing in quick access....

[GZTimeWalker]

After one year, I think we should have this discussion as an issue #10216

[sabrinawen]

how can i fixed it 😭

[jorismak]

By looking in the issue linked above. Disabling WSL2 gui support fixed it for (requiring a reboot after making the change). I think this will stop it for now, and the people reporting 'does not work for me' did not restart their system yet I think. (Restarting just WSL2 might not be enough, because it has to do with the 'invisible' system-VM that is bridging graphics support between WSL distros and Windows).

Somebody else mentioned that installing a certain Remote Desktop package from Microsoft might fix it (something that is not present on every Win11 machine by default but the latest WSL2 store version apparently expects it to be?).

[hez2010]

I came up with a simple solution:

1. Delete the folder %temp%\DiagOutputDir\RdClientAutoTrace
2. Create a txt file under %temp%\DiagOutputDir and rename it to RdClientAutoTrace, make sure you have delete the extension name .txt of the file
3. No RdClientAutoTrace files will be created any more

[KDAM71]

Works for me too. You have to be quick making the file after you've deleted the directory, otherwise a new one has already been made. (I'm not very quick, it took me 5 times :) )

[smitharc]

You can run wsl --shutdown first this will stop logging then create the file.

[jorismak]

As already been set , for most of setting graphics support off for wsl stopped the logging and you can happily use wsl.just remember to restart the entire system. If graphics mode is wanted , preventing the logging seems like an option , but I think it's still a performance issues then. Preventing the logging by creating a file with the name of the directory is a nice trick :) . If your wsl keeps starting up , you have a shortcut or reference to it somewhere. Maybe a mapped drive , a shortcut to it on the sidebar of explorer , an item in your recent items , or in my case Asus tools that are accessing recent downloads and one was in wsl. Lots of options really. Disabling kind of services shouldn't benl needed (and is harder on win11 vs win10 for wsl) but may help in temporary keeping it shut down so you can manage the log directory. As is stated in the real issue (not this discussion if i think I'm replying on the correct thread ), the entire thing seems to be fixable by installing a Ms rdc package.

…

On Sat, Jul 22, 2023, 03:15 KDAM71 ***@***.***> wrote: I had a somewhat similar problem caused by vmmemwsl. As long as you're not using wsl you can disable a couple of related processes by setting the starttype of wslservice to disabled in the registry. The registry path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WslService. Here you change the value of Start to 4 (disabled). You have to restart windows for it to take effect. When you want to use wsl you change the Start value back and restart windows. I hope this is a solution for your problem. When you export Start with both values, it's easiest to change it in the future with a few mouseclicks. — Reply to this email directly, view it on GitHub <#8486 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ALMD2DSBPKWHP44CTCTBZHTXRMSS7ANCNFSM5YEA4CLA> . You are receiving this because you commented.Message ID: ***@***.***>

[KDAM71]

My suggestion for disabling wslservice in the registry works for windows 11.
Can you give me a link to the real issue? I haven't been able to find it.

[jorismak]

#8486 (comment)

[KDAM71]

Thanks for the link.
I installed the remote desktop package but the log files were still being produced.

[unclemusclez]

I use WSL2 for development...

is this a concern? can i delete these?

[jorismak]

I removed these when they were being created. Had no issues with it.
Also, seeing from the 'temp' folder and the 'diag' in DiagOutputDir, they don't seem to be important whatsoever for normal operation.

That being said, I didn't encounter the issue for almost a year now. Are you sure everything is updated at your end?

[unclemusclez]

@jorismak these are all logs from this week, and it seems to cap out at 1GB so i'm guessing this is a managed process

[elsaco]

Possible fix at microsoft/wslg#978 (comment)

[elsaco]

Another option is to use guiApplications=false and turn off support for GUI apps (WSLg) in WSL.

No GUI, not ETL spamming. Its a good tradeoff for me!