J. P. Gilliver (John) wrote:
In message , Paul
writes:
J. P. Gilliver (John) wrote:
In message , Paul
writes:
[]
so the keywords seem to be RACAgent and RACTask. And some
folders that it keeps. It probably does that, so a user can
erase Event Viewer, without damaging the RAC collection.

Paul
RACAgent not on my system; RacTask exists (as a 4,502 byte file -
with no extension - as the only file in
C:\Windows\System32\Tasks\Microsoft\Windows\RAC).

This shows the size and file types of the two data folders it uses.
It keeps information in SQL Compact databases (doesn't use Microsoft
ESE Jet Blue).

https://s17.postimg.org/m1ravgwvz/RAC_Data_Folders.gif

My C:\ProgramData\Microsoft\RAC\PublishedData contains one file,
RacWmiDatabase.sdf, size 148 KB; my
C:\ProgramData\Microsoft\RAC\StateData contains two, RacDatabase.sdf 543
KB and RacMetaData.dat 1 KB, actually 8 bytes (AB BF FA 00 AD DB BA 00).
Still getting just the grey pillars with no overgraph.

And I see evidence here, that this thing ties into CEIP and Telemetry.
So if a program fails, it's probably reported to the software developer.
And RAC is keeping statistics.

The machine I was looking at was "polluted" by a Visual Studio
installation, so I have to be careful to not jump to too many
conclusions. But the stuff looks "complicated at the edges".

There is a RAC Engine DLL that does some math or something, but
I can't figure out much else.

Paul

If _you_ can't, I have _no_ chance (-:!

Well, we're working at this a bit at a time, and hoping
it's something simple, right ?

What I notice in your description, is you're missing the two WMI
files. My folder had four files. Your folder has two files.
Both your WMI are missing. Does this imply a WMI thing is broken ?

And that gives us another keyword to work with :-)

For example, in this short thread, it almost suggests a "policy"
might be available to switch WMI off. We'll ignore this for
the moment, as this is likely a red herring.

https://social.technet.microsoft.com...m=winservergen

HKLM\SOFTWARE\Policies\Microsoft\Windows\Reliabili ty Analysis\WMI
WMIEnable

*******

In this article, the only thing I'm initially interested in, is the
first line.

https://answers.microsoft.com/en-us/...1-b52971bda91e

reg add "HKLM\SOFTWARE\Microsoft\Reliability Analysis\WMI" /v WMIEnable /T REG_DWORD /D 1 /F

The script likely came from here, and you can change the extension
on the .bat file to .txt and look at this in Notepad if you want.
*Don't* be in a rush to run this. This cleans out the entire
Event Viewer, as well as the two folders used by RAC. Sure it
works, but now you'll have to wait for a day to get enough
data to test the Reliability Monitor. I prefer to turn on WMI
as a first step.

http://www.thewindowsclub.com/downloads/RRM.zip

Here is a picture of me verifying my key is correct in Windows 7.
Make sure yours looks like this.

https://s17.postimg.org/akoq930f3/Re...n7_WMI_key.gif

Because your WMI is missing, that's my guess as to why.

While it could be GPEDIT related, like the "policy" key above
we're ignoring, how exactly would that have happened ? I'm more
willing to buy a story, where WMI doesn't start the first time
on its own, and something "bootstraps" it, and turns on that
registry key. But you can have a look and see what is what.

Paul