Best answer by Kit
View originalwrdata folder
Anyone know if the wrdata folder can be cleaned out or deleted? It grows to an enormous size over time.
Page 2 / 4
Userlevel 7
I'm going to add an Official Voice here.
The WRData folder (Located under the appropriate System App Data location for the OS) contains the operational parameters of the software as well as all working sets. For AV, it contains all quarantined files as well as all journalling information from unknown/monitored processes, configuration, logs, etc. With WSAE and WSAC it also contains the Sync/Backup and Password components repsectively.
Quarantined data is obviously kept until deleted from Quarantine. All Logs and Journalling data is kept for a time period and then automatically cleaned up. This cleanup can be triggered by age and also by the unknown items being registered as Good. Upgrade installs will never clean this up, since the Journalling data is critical to the ability to roll back infection actions in the case of an unknown being determined to be bad.
If you pkg directory is Big, that is the Extra Stuff (Password and Sync). It should normally start at about 70-80 MB for a WSAC installation and is primarily affected by sync data.
If your dbl.db file is getting Very Big™, that is quarantine. Stop finding threats. ;)
If your dbp.db file is Really Big, much stuff is being monitored. You can ask Support for assistance with cloud determinations specifically for your PC. This data is cleaned up automatically as well.
Huge ace files mean that really-complicated threat actions were rolled back.
So the location of the size offenders gives the key to what caused them. Have specific files that are Really Big? Let me know.
The WRData folder (Located under the appropriate System App Data location for the OS) contains the operational parameters of the software as well as all working sets. For AV, it contains all quarantined files as well as all journalling information from unknown/monitored processes, configuration, logs, etc. With WSAE and WSAC it also contains the Sync/Backup and Password components repsectively.
Quarantined data is obviously kept until deleted from Quarantine. All Logs and Journalling data is kept for a time period and then automatically cleaned up. This cleanup can be triggered by age and also by the unknown items being registered as Good. Upgrade installs will never clean this up, since the Journalling data is critical to the ability to roll back infection actions in the case of an unknown being determined to be bad.
If you pkg directory is Big, that is the Extra Stuff (Password and Sync). It should normally start at about 70-80 MB for a WSAC installation and is primarily affected by sync data.
If your dbl.db file is getting Very Big™, that is quarantine. Stop finding threats. ;)
If your dbp.db file is Really Big, much stuff is being monitored. You can ask Support for assistance with cloud determinations specifically for your PC. This data is cleaned up automatically as well.
Huge ace files mean that really-complicated threat actions were rolled back.
So the location of the size offenders gives the key to what caused them. Have specific files that are Really Big? Let me know.
Userlevel 7
Balders - We Webroot folks are sticking to the Community here for the most part. Though I have lurked at Wilders for months (I was previously the person handling all of the Beta testing tickets), we're trying to avoid spreading ourselves too thin. Plus, think of the reaction there would have been at Wilders if some "silly Webroot person" invaded Joe and TH's stomping grounds. ;)
Please do feel free to forward the information over there though, with the understanding that it's subject to change (for example, I haven't seen res####.db files in weeks).
Snake - While it is true that it's not "normal", it's not impossible and not abnormal. (I'd hope I have some idea what I'm talking about, since prior to QA, I was an Escalation Engineer. ^.^ ) For example, an unknown toolbar DLL injected into a browser will cause the WRData folder to grow to several hundred MB in short order from normal browsing. A brand new, unknown copy of a torrent client will have an even more dramatic growth effect. Also noteworthy that "should be sent to the cloud and then deleted" is halfway accurate. As long as the item is marked as Unknown, your computer will keep a local journal for rollback purposes. It only gets cleaned up once the item in question is determined to be good, and that process is not instant. We'd have to find out from dev what the precise rules are for cleanup and database compacting, however I do know that it can take up to a month. In general, the correction involves determining what the cause is and addressing that cause (Determintaions on unknowns, Quarantine, sync bloat, etc).
Normally I'd just pull up your ticket, but this new community system doesn't allow me to see email addresses, so I have no good way to locate ticket or logs (assuming they exist). As such I will simply need to hope it's addressed well. 🙂
Please do feel free to forward the information over there though, with the understanding that it's subject to change (for example, I haven't seen res####.db files in weeks).
Snake - While it is true that it's not "normal", it's not impossible and not abnormal. (I'd hope I have some idea what I'm talking about, since prior to QA, I was an Escalation Engineer. ^.^ ) For example, an unknown toolbar DLL injected into a browser will cause the WRData folder to grow to several hundred MB in short order from normal browsing. A brand new, unknown copy of a torrent client will have an even more dramatic growth effect. Also noteworthy that "should be sent to the cloud and then deleted" is halfway accurate. As long as the item is marked as Unknown, your computer will keep a local journal for rollback purposes. It only gets cleaned up once the item in question is determined to be good, and that process is not instant. We'd have to find out from dev what the precise rules are for cleanup and database compacting, however I do know that it can take up to a month. In general, the correction involves determining what the cause is and addressing that cause (Determintaions on unknowns, Quarantine, sync bloat, etc).
Normally I'd just pull up your ticket, but this new community system doesn't allow me to see email addresses, so I have no good way to locate ticket or logs (assuming they exist). As such I will simply need to hope it's addressed well. 🙂
Userlevel 2
Well after much coding and finger crossing, I have a utility:
And more importantly, I have 185 GB of unwanted dbNNN.db files in my Recycle bin :)
...and WebRoot came back up without any errors.
I need to put a few finishing touches on the util (along with a short write-up); if anybody is intereseted, I'll put it up for download in a day or so.
And more importantly, I have 185 GB of unwanted dbNNN.db files in my Recycle bin :)
...and WebRoot came back up without any errors.
I need to put a few finishing touches on the util (along with a short write-up); if anybody is intereseted, I'll put it up for download in a day or so.
Userlevel 2
I'd be happy to let you check it out in a couple of days; however, I just ran it on my Windows 7 test machine and found a couple of bugs:
- It didn't handle a network file path correctly (i.e. "\WIN8BOXShareScadaPhoneInstall.exe"); When the exclude list contained a network path, my app would not delete anything; when I removed the \WIN8BOX items from the list of excluded folders, it worked.
- After running this on my Windows 7 test computer and finishing a long sequence of db file recycling, my app coughed-up an "out of memory" error and subsequently saved the WRLog.log as a file of zero bytes (oops).
Userlevel 7
+3
You make some valid and relevant points there Daniel, and it's difficult to envisage how Webroot could do other than advise against its usage.@ wrote:
Sorry but I have no interest with his cleanup tool and you know me I'm a realist and Brad could be breaking Webroot's EULA in some way and would not recommend anyone to use his tool if it ever comes to be and@ wrote:
Hi Brad
I am looking forward to it.
Regards, Baldrick
@ should check with the internal staff on this@ @ . Also we know it's on the Webroot's Developers list to make WSA clean it's own old files.
Just my opinion,
Daniel
Userlevel 2
P.S. This utility is really targeted for programmers who have massive amounts of data accumulating in the WRData folder due to repetitive creation of EXE files (every time we compile a new version of our software). General-purpose users will not really need this, but on my system, the dbNNNN.db files were taking up nearly 20% of my 1TB drive.
I intend to continue using WSA, so this will be an ongoing issue for me. That's why I'm doing this.
I intend to continue using WSA, so this will be an ongoing issue for me. That's why I'm doing this.
Userlevel 7
+56
Brad has reached out to me, and I will take his utility and run it by the folks here. We actually have lots of folks on our support team who do similar workaround utilities to fix issues, and they sometimes get incorporated in the product. So who knows - maybe we'll end up doing the same with your utility Brad!
Userlevel 7
+56
Hi snake,
Sorry ProTruckDriver that will not decrease the info in that folder the only thing that you can do is uninstall WSA reboot and install again because if you just delete the files it could cause issues with WSA!
HTH,
TH
Sorry ProTruckDriver that will not decrease the info in that folder the only thing that you can do is uninstall WSA reboot and install again because if you just delete the files it could cause issues with WSA!
HTH,
TH
Userlevel 7
Misunderstood the question. I thought snake was talking about just clearing the logs of WSA. Sorry. :$@ wrote:
Hi snake,
Sorry ProTruckDriver that will not decrease the info in that folder the only thing that you can do is uninstall WSA reboot and install again because if you just delete the files it could cause issues with WSA!
HTH,
TH
Userlevel 7
+56
Not a problem buddy! :D I know as my WRData Folder is 89MB ATM and I don't have that many U related files in my scan log!
TH
TH
Userlevel 7
+56
Hi snake please let us know how it goes!
Thanks,
TH
Thanks,
TH
Userlevel 7
+56
Again the best thing to do is Unistall WSA reboot and install again to clean up WRData Folder! Make sure you have a copy of your license before doing so!
Cheers,
TH
Cheers,
TH
Userlevel 7
+56
There's been a discussion about it here: http://www.wilderssecurity.com/showthread.php?t=305319 just to let you know your not alone!
TH
TH
Ok ,,last post on this subject,,,
I asked support about uninstalling and reinstalling the software to get rid of the bloat,,,,This is the last answer I got from webroot tech.
Yes if you reintsall the software the folder gets replaced, but do not do anything to the actual folder unless we tell you to as you will break the Webroot software. Please reinstall and let me know if that helps.
Thanks,
Webroot Support Team
Snake
I asked support about uninstalling and reinstalling the software to get rid of the bloat,,,,This is the last answer I got from webroot tech.
Yes if you reintsall the software the folder gets replaced, but do not do anything to the actual folder unless we tell you to as you will break the Webroot software. Please reinstall and let me know if that helps.
Thanks,
Webroot Support Team
Snake
Userlevel 7
Have scanned my machine and can find no trace of a folder called "wrdata". Is this normal? Should I be concerned? WRSAE is working perfectly...as far as I can see.
:S
EDIT: FOUND IT...it was lurking but I couldn't see! :$
:S
EDIT: FOUND IT...it was lurking but I couldn't see! :$
Userlevel 7
Uninstalled & then reinstalled WRSAE and that seems to have sorted out the issue as has been advised both here & at Wilders. :D
Small tip, if not already mentioned elsewhere; export settings BEFORE uninstall and then import them back AFTER reinstall. Has no effect on wrdata folder size and saves you a lot of time trying to remember & returning the settings to as they were (and how you liked them). ;)
Balders
Small tip, if not already mentioned elsewhere; export settings BEFORE uninstall and then import them back AFTER reinstall. Has no effect on wrdata folder size and saves you a lot of time trying to remember & returning the settings to as they were (and how you liked them). ;)
Balders
Userlevel 7
Hi snake
No problem. We must trust in Joe (PrevxHelp) & his team to resolve the issue. They always have and I am sure that if there is a way for them to do so without compromising WRSA's effectiveness, etc., then they will. :D
Balders
No problem. We must trust in Joe (PrevxHelp) & his team to resolve the issue. They always have and I am sure that if there is a way for them to do so without compromising WRSA's effectiveness, etc., then they will. :D
Balders
Userlevel 7
+56
The best thing for now is to do a clean reinstall! Uninstall reboot and reinstall and make sure you have a copy of your license key! Here is the link to download a copy of WSA http://anywhere.webrootcloudav.com/zerol/wsainstall.exe If you find it getting big again then it would be best to contact the WSA support inbox and they will be happy to help you: Submit a Support Ticket@ wrote:
My WRData folder is now over 3GB!!
Almost all of the bulk is in "dbxxxx.db" files.
The largest is 1.5GB
If it helps, ALL these dbxxxx.db files are "blue" in windows explorer (compressed?)
All the other files are "black"
This is on SecureAnywhere Antivirus but this topic looks active here so I posted here.
Is a re-install the only way to solve this issue?
vango44
HTH,
TH
EDIT: And welcome to the Webroot Community Forums!
Hi,,
Its been awhile since I posted, but I have learned not to reinstall or install over the top of a beta program,,,simply check for updates and let the program update itself. This will not increase the siae of the wrdata foldeer contents.
snake
Its been awhile since I posted, but I have learned not to reinstall or install over the top of a beta program,,,simply check for updates and let the program update itself. This will not increase the siae of the wrdata foldeer contents.
snake
Userlevel 2
I think the observation about new apps causing the extreme growth of the WRData folder is correct... I'm a (really busy) programmer, and my WRData folder contains 189 GB... Oddly, the Size On Disk is 177 GB (I guess that's the compression).
I'm going to try that uninstall/reinstall suggestion, but it sure would be nice to be able to clear this in a more civilized manner.
I'm going to try that uninstall/reinstall suggestion, but it sure would be nice to be able to clear this in a more civilized manner.
Userlevel 2
I had a look in the WRLog.log and saw that the bulk of the activity is centered around the repeatedly changing EXE files in my working folders (every time I compile a new EXE, more activity).
The perfect solution to this problem would be to allow me to specify my working folder tree to be off-limits to WSA scans; I never install 3rd party software into my working folder tree and some days I recompile my apps dozens of times.
Is there a way to specify an off-limits folder?
Thanks
The perfect solution to this problem would be to allow me to specify my working folder tree to be off-limits to WSA scans; I never install 3rd party software into my working folder tree and some days I recompile my apps dozens of times.
Is there a way to specify an off-limits folder?
Thanks
Userlevel 2
I think I see what I need to do; I'm going to write a clean-up app to automate this process.
Let me know if you think the following steps sound OK:
Let me know if you think the following steps sound OK:
- Load the WRLog.log file
- Scan for all of the 'Monitoring process' lines
- Extract the EXE path and (NNNN) information into a data table
- Compare EXE path info to Off-Limits-Folder list (to build list of NNNNs to delete)
- Delete all dbNNNN.db files in deletion list.
Userlevel 2
P.S. After accidentally wiping out the WRLog.log file on my Win7 machine; WSA did not display any errors when it was restarted and the file is once again being populated with information.
Userlevel 2
P.P.S. My util is written in Delphi and it relies heavily on my company's library code; I can share some of the source (the parts specifically used by the WebRootLogCleaner app) but not all of the source necessary to compile the whole enchilada (29,340 lines):
Userlevel 2
FYI, I already private messaged Nic on this subject to let him know that I will be sending him the link for approval before posing the link on this public forum.
Page 2 / 4
Reply
Login to the community
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.