- May
- 13,117
- 180
This is correct.
Below, FFIND does not process that file.
What's up with that?
And ... off-topic, but a real mystery to me ...
None of my (UNIX) text utils work with the file C:\Windows\System32\w32tm.log. They all seem to be seeing a different file. All TCC commands see the correct file. For example, if TCC opens the file, I get a correct result; when WC.EXE opens the file I get an incorrect result.
I manually removed all entries earlier than 2018 from that file, and have restarted the computer a few times since. Below, TCC gets it right and GREP gets it wrong.
If the text utils (GREP, WC) are elevated, they get it right. Is Windows 7 keeping another (older) copy of that file someshere (I can't find it) and doing some sort of file system redirection?
Code:
v:\> ffind /t"Unknown" /v C:\Windows\System32\*.log
---- C:\Windows\System32\w32tm.log
2018-03-13 Tue 03:18:04 Unknown receive error
2018-04-12 Thu 22:59:48 Unknown receive error
2018-04-13 Fri 12:52:27 Unknown receive error
3 lines in 1 file
Below, FFIND does not process that file.
Code:
v:\> ffind /t"nknown" /s c:\*.log
---- C:\Windows\debug\WIA\wiatrace.log
WIA: 1036.2272 110 0 0 [wiaservc.dll] ERROR: CEventNotifier::AddEventGUID, Trying to register applicatio
n for a unknown global event
---- C:\Windows\inf\setupapi.app.log
>>> [Build Driver List - unknown device]
---- C:\Windows\inf\setupapi.dev.log
dvi: No class installer for 'Unknown driver software package'
3 lines in 3 files
What's up with that?
And ... off-topic, but a real mystery to me ...
None of my (UNIX) text utils work with the file C:\Windows\System32\w32tm.log. They all seem to be seeing a different file. All TCC commands see the correct file. For example, if TCC opens the file, I get a correct result; when WC.EXE opens the file I get an incorrect result.
Code:
v:\> type s:\w32tm.log | g:\gnu\wc
113 1114 8598
v:\> g:\gnu\wc s:\w32tm.log
169 1608 12197 s:\w32tm.log
I manually removed all entries earlier than 2018 from that file, and have restarted the computer a few times since. Below, TCC gets it right and GREP gets it wrong.
Code:
v:\> ffind /t"nknown" /v /k /m C:\Windows\System32\w32tm.log
2018-03-13 Tue 03:18:04 Unknown receive error
2018-04-12 Thu 22:59:48 Unknown receive error
2018-04-13 Fri 12:52:27 Unknown receive error
v:\> g:\gnu\grep nknown C:\Windows\System32\w32tm.log
2012-03-11 Sun 03:17:03 Unknown receive error
2012-03-23 Fri 11:19:09 Unknown receive error
2012-04-12 Thu 03:17:04 Unknown receive error
2012-04-13 Fri 03:17:04 Unknown receive error
2012-04-14 Sat 03:17:04 Unknown receive error
2012-04-15 Sun 03:17:04 Unknown receive error
2012-04-16 Mon 03:17:04 Unknown receive error
2012-06-15 Fri 03:17:04 Unknown receive error
2012-06-16 Sat 03:17:04 Unknown receive error
2012-06-17 Sun 03:17:04 Unknown receive error
2012-06-18 Mon 03:17:04 Unknown receive error
2012-06-19 Tue 03:17:04 Unknown receive error
2012-06-20 Wed 03:17:04 Unknown receive error
If the text utils (GREP, WC) are elevated, they get it right. Is Windows 7 keeping another (older) copy of that file someshere (I can't find it) and doing some sort of file system redirection?