WinRing0x64.sys trashing my System Event log

After I installing the Corsair Link 2 software the following service C:\Program Files (x86)\Corsair\CorsairLink 2\WinRing0x64.sys is trashing my System Event log with a new information event every 3 -4 seconds. This is what I call bad logging or perhaps you could create your own Event Log bok to write this in, PLEASE.

The messages is following:

A service was installed in the system.

Service Name: WinRing0_1_2_0

Service File Name: C:\Program Files (x86)\Corsair\CorsairLink 2\WinRing0x64.sys

Service Type: kernel mode driver

Service Start Type: demand start

Service Account:

Any one else have this bad behavior?

Hi RAM Guy

Here is the screenshot you asked for and a one over the whole setup.

Another thing that I have discover is that the Service wrapper SierraService.exe is eating memory over time and not releasing it back. Not much but 3 000 k over 5 hour period.

And when I login as my standard user with just plain user rights the Sierra2.GPU.exe won't start at all. Have to run it manully with run as Administrator command, that's anoying me. If the Sierra2.GPU is not running I will not get any readings from my grahpics card at all.

Here is tthe screnshot's:

http://lazysoft.homeserver.com/CorsairLink/Devices.jpg

http://lazysoft.homeserver.com/CorsairLink/System.jpg

Hi again RAM Guy

I found what the problem why the Sierra2.GPU.exe was't starting.

I had to change the Sierra2.GPU schedul task to run with the bultin Users group instead of the the account that installed the Corsair Link 2 software, which was my local admin account. Now the Sierra2.GPU.exe starts for all my local accounts.

Hi RAM Guy

About the problem that WinRing0x64 is trashing my System Event log has been norrowed down to how SierraService.exe is handling this inner kernel ring sensor.

If I start RealTemGT that use the same inner kernel ring sensor there will only one entry in the System event log about it has been started on demand. If I start RealTempGT when SierraService is running the entrys stop's comming every 3-4 sec from WinRing0x64 and as soon I exit RealTempGT the enterys are comming again.

It seems to me that SierraService is restarting the WinRing0x64 every 3-4 sec and that's way all thoose entries are there. I think you should talk to the software team that I think it's better to start this inner kernel ring sensor once when the service wrapper SierraService starts and not restarting it every 3-4 seconds.

I hope this will be changed in a futurerelease of this software that has been much better since I started to use the Corsair Link in the beging of this year.

holy mother of GPUs!!! :eyebuldge I'am jealous and me thinks you have way too much power and should ship the other half this way. :D:

Nope, they stay with me :p:...

Need moOOore poOower :roll:

Hi RAM Guy

 

About the problem that WinRing0x64 is trashing my System Event log has been norrowed down to how SierraService.exe is handling this inner kernel ring sensor.

 

If I start RealTemGT that use the same inner kernel ring sensor there will only one entry in the System event log about it has been started on demand. If I start RealTempGT when SierraService is running the entrys stop's comming every 3-4 sec from WinRing0x64 and as soon I exit RealTempGT the enterys are comming again.

 

It seems to me that SierraService is restarting the WinRing0x64 every 3-4 sec and that's way all thoose entries are there. I think you should talk to the software team that I think it's better to start this inner kernel ring sensor once when the service wrapper SierraService starts and not restarting it every 3-4 seconds.

 

I hope this will be changed in a futurerelease of this software that has been much better since I started to use the Corsair Link in the beging of this year.

I noticed the same symptoms with the log and to add, it is writing to my SSD every time a log entry occurs. That can accumulate to quite a few log entries in a day, not to mention a week or month. I prefer not to have repeated writes to any storage device, especially an ssd, unless the information is valid and useful.

I will post a resource monitor shot when I restart a clean log.

I have attached some screen shots showing how my system behaves without Link software running and running after installation.

Interesting items to note:

Perfmon without corsairLink shows 1% cpu usage and apx. 0kb of disk activity.

With corsairLink installed and running shows 3% cpu usage and apx. 828kb of disk activity. Keep in mind these are just "snapshots", but represent what the administrative event log statistics show and confirm the WinRing0_1_2_0 service (WinRing0x64.sys) is starting 3 or four times a minutes. The size of the system log grew from 84kb to 2.07mb in 15 minutes.

Four files attached:

perfmon without Sierra2Service or Link sw running and not installed

perfmon with Sierra2Service running and Corsair Link sw running

Admin events -log after idle overnight and prior to loading and running link sw

Admin events after 13 minutes of system running with Sierra2Service and corsair link sw running.

Just some observations that may assist improving the software.

Just found this thread. Same problem for me - here's my thread posted before I found this one: http://forum.corsair.com/v3/showthread.php?p=606373#post606373

I also have SSDs and this is hammering my C: drive with writes.

Can't even turn off link/sierra2 since as confirmed in http://forum.corsair.com/v3/showthread.php?t=111112 OCP (multi-rail) on the AX1200i resets at boot and the service has to be started to reinitialise it.

Another SSD thrash discovered in the software. Take a look in C:\Appdata\Users\<USERNAME>\Roaming\Corsair - I have a 2MB log file being filled (and subsequently rotated, with 10 of them being kept) every minute to two minutes.

This file seems to be written about every 10ms !!!! No wonder we are seeing high CPU utilisation with the link software updating the log file 100 times every second.

The write amplification being caused by these tiny writes to an SSD is going to be absolutely brutal. I'd recommend anyone else seeing this to move the corsair folder in appdata onto a spinning HDD and create a symbolic link to it from the C: drive so that the writes end up on a platter drive and not the SSD.

Below is ONE SECOND worth of log writes.

Corsair - please can we have an update on the other logging issue. I notice new software was released the other day but I asked in the thread and the Winring0x64.sys issue has not been fixed yet.

Errror codes put on file so the thread is not longggg.

Thanks, they are not the biggest issue ever now I have workarounds for both of them, but for someone who hasn't noticed them, they are going to be pretty bad for an SSD.

I'll keep an eye out for new releases.

I want to confirm this bug as well I just did a clean install of windows ultimate 7 about 2 weeks ago and have 46,657 logs which 97% are winring0 1.2.0 Logs are in one min intervals.

Edit: about 99% after looking at last 300 logs I found only one other besides event id 7045, so yes its terrible.

I'm another one getting hit by this. (And H100 doesn't seem to show right, but that is for its own thread)

Look Corsair, I really love your stuff but this can't go on like this. Maybe you think this is not bad, but it really is, specially if you happen to have a ssd. As it stands now it is constantly righting to the ssd and generating huge amounts of log files. This will reduce the life of any ssd quite significantly if it is allowed to continue non stop.

Of course I have stopped it by killing the sierra2service, but we shouldn't have to. I waited this long since I thought that you would have worked out most of the bugs out of link by now, but I can't help but be a little annoyed at the state of the link software. The idea is great, the software looks slick, you just have to get it to work right. I do look forward to the next release but you really need to get a fix for this pushed out as soon as possible as this is doing degenerative damage.

OK, now it's been a few days since I discovered the second log-thrash in this software (the writes 100 times every second to the front-end UI log files in c:\users\username\appdata\roaming\corsair), I thought I'd update.

I'd been tracking my total writes to my C: drive ever since I first discovered the excessive writes (before I tracked down what was causing them), so every couple of days or whatever, I've been firing up Crystal Disk Info and noting the total writes into a text file so I could discover what would reduce them.

It turns out that nearly 80% of the writes to my C: drive were coming from Corsair Link alone.

Below is my notes:

09/10/12 - 743GB

11/10/12 - 783GB

12/10/12 - 821GB

14/10/12 - 849GB

18/10/12 - 1.01TB in 302 power on hours = 3.4GB/hr = 58MB/min, 1MB/sec

<HERE THE FILES WERE MOVED OUT OF APPDATA>

21/10/12 - 1.03TB in 329 hours = 20GB in last 27 hours since moving corsair

link front-end logs out of appdata, = 758MB/hr = 12.6MB/min

As you can see, as soon as I moved the Corsair Link logs out of appdata on C:, my writes reduced by 80%, or 45MB per minute. Nothing else has been moved off C:, and nothing else changed to reduce writes in that time.

Given that 45MB per minute is 63GB every day, or 22.5TB per year if running 24/7, this is not only a big problem for SSD life, but will also gimp the performance on a lot of drives I imagine.

If we assume that the 80% of writes proportion has held since I installed my new SSD 3 weeks ago, this means Corsair Link has written the entire drive 3 times in 3 weeks. That may not quite be the case, since maybe 50GB to 100GB of the 1TB of total writes will be me installing software, but still, it comes out very close to it overwriting an entire 240GB SSD every 90 power-on hours.

Hi BorisTheSpider

Try following. Find Sierra2.exe.config file in the folder where you installed Corsair Link software.

On line 40 change the level value from ALL to OFF and that should help. You turn off all logging for the GUI application that way. This is bad done to have it set to ALL from the beging. I for my self think that log4net logger sucks and it's better to create a unic event log book for the software, which is fully supported in .Net programming. A Corsair Link event book =). Then we have the possibilty to move the logg book file else where.

Thanks - I hadn't discovered that file before. Good to know since it will also stop the high CPU utilisation caused by all that logging.

Doesn't make any difference for me right now though, since I can't run corsair link or sierra2service at the moment because of this: http://forum.corsair.com/v3/showthread.php?p=608540

Corsair - please can the default behaviour be changed in future releases to loglevel error or warning so this log thrashing stops.

Hi BorisTheSpider

 

Try following. Find Sierra2.exe.config file in the folder where you installed Corsair Link software.

On line 40 change the level value from ALL to OFF and that should help. You turn off all logging for the GUI application that way. This is bad done to have it set to ALL from the beging. I for my self think that log4net logger sucks and it's better to create a unic event log book for the software, which is fully supported in .Net programming. A Corsair Link event book =). Then we have the possibilty to move the logg book file else where.

It looks like that does stop the writing of the log files in the username\appdata\roaming\corsair but it still generates the event logs. I get a new information event about the service WinRing0_1_2_0 being installed about once every 3 seconds. I got it to stop last night by just killing all the Sierra2 services but that is not really what I want to be doing. Hopefully they can address this in an update soon.

Thanks - I hadn't discovered that file before. Good to know since it will also stop the high CPU utilisation caused by all that logging.

Well it still runs the cpu non stop, sure it is not much but it is more than anything else I have running in the background. It bounces from 2-4% cpu usage with an average of 2.75. I should clarify, SierraService.exe has the average of 2.75, while Sierra2.exe has an average CPU usage of 1.4% So we are looking at 4-5% CPU usage from the link software at all times.

It looks like that does stop the writing of the log files in the username\appdata\roaming\corsair but it still generates the event logs. I get a new information event about the service WinRing0_1_2_0 being installed about once every 3 seconds. I got it to stop last night by just killing all the Sierra2 services but that is not really what I want to be doing. Hopefully they can address this in an update soon.

Not a solution, but there is a workaround - someone else posted about running RealTempGT which uses WinRing0x64.sys. I run it at boot and it stops the system event log thrashing - I think RTGT having loaded the driver (and keeping it loaded) stops Corsair Link from endlessly reloading it.

Well it still runs the cpu non stop, sure it is not much but it is more than anything else I have running in the background. It bounces from 2-4% cpu usage with an average of 2.75. I should clarify, SierraService.exe has the average of 2.75, while Sierra2.exe has an average CPU usage of 1.4% So we are looking at 4-5% CPU usage from the link software at all times.

I think quite a lot of that is the reloading of the Winring driver. Since I prevented that happening, the CPU usage went down quite a bit. I am seeing over 140MB of RAM used between SierraService, Sierra2 and Sierra2.gpu though. I don't even know what the hell sierra2.gpu does, presumably collect GPU monitoring data, but I don't want or need that, I just don't know how to disable it, I guess I could try renaming the executable but I don't know if it would break anything.

Hello, just a question since i'm looking to buy a link cooling kit, is this a problem that come with PSU management or this writing problem is common ?

Thanks, Alex.

I think quite a lot of that is the reloading of the Winring driver. Since I prevented that happening, the CPU usage went down quite a bit. I am seeing over 140MB of RAM used between SierraService, Sierra2 and Sierra2.gpu though. I don't even know what the hell sierra2.gpu does, presumably collect GPU monitoring data, but I don't want or need that, I just don't know how to disable it, I guess I could try renaming the executable but I don't know if it would break anything.

You will find that Sierra2.GPU is starting as schedule task. See earlier post in this thread about this. So head over to the Task Scheduler and find the Sierra2.GPU task and just disabled it by right clicking and choose Disable. And it is only for the GPU reading.

Hello, just a question since i'm looking to buy a link cooling kit, is this a problem that come with PSU management or this writing problem is common ?

 

Thanks, Alex.

Yes, the problem is common to everything, since 2.1.1 is the new software for all link products. Development of 1.2.7 has stopped. See:

http://forum.corsair.com/forums/showthread.php?t=111405&p=608065