WRData folder in WSA Complete

[Dermot7]

-{ Quote: "It will decrease - there is a maximum of 16 logs stored and they are overwritten each time another scan takes place. We're changing this to a maximum of 3 logs in the next update to prevent concern over disk size :)" }-

Still becoming rather too large here for a 1 month timespan, and should it be retaining as many as 119 files? This with 8.0.40 Complete. Thanks :)

[PrevxHelp]

With the Complete version, some additional components are downloaded (for Backup & Sync, as well as Password management) which will make up the majority of the size you're seeing. If you'd like, feel free to send in a scan log and I'll take a look although I suspect it's functioning as expected,

Thanks!

[Dermot7]

-{ Quote: "With the Complete version, some additional components are downloaded (for Backup & Sync, as well as Password management) which will make up the majority of the size you're seeing. If you'd like, feel free to send in a scan log and I'll take a look although I suspect it's functioning as expected,

Thanks!" }-

That explains all Joe, thank you :thumb: :)
I should have taken into account additional features now added. Not that 62MB is such a huge amount anyway, nowadays.

[JCRUYFF]

can someone tell me the exact location of the WRData(in Windows XP) , Because my Used Disk suddenly grown from 6.19GB to 6.70GB . i don`t have downloaded anything more than 100MB and i want to chech if is WSA Issue Plz.


Thanks!!

[Clive T]

-{ Quote: "Still becoming rather too large here for a 1 month timespan, and should it be retaining as many as 119 files? This with 8.0.40 Complete. Thanks :)" }-

Just checked my data and the WRData folder contains 131 files totaling 178Mb going back to 17 August (now on 8.0.0.60).

[PrevxHelp]

On XP it is C:\Documents and Settings\All Users\Application Data\WRData\

[Techfox1976]

The WRData folder also contains all the quarantined data and all the monitoring data. Advanced users who use utilities and programs that are less-likely to be already marked as Known Good (and thus not monitored) are more likely to have bigger WRData contents. Some settings such as verbose logging will also increase the size more swiftly. When files are marked as good, either in the cloud or locally, they stop generating monitoring data, so it won't grow as fast.

[Dermot7]

Now, after couple of hours fresh install of WSAC (8.0.0.66) I'm looking light again.

[Techfox1976]

-{ Quote: "Now, after couple of hours fresh install of WSAC (8.0.0.66) I'm looking light again." }-

The WRData directory contains all of your local determinations cache, all monitoring data, quarantined files, and the PKG directory inside it contains the Extra Stuff that comes with Complete (Like the password toolbar and Sync). The PKG directory alone should be a number of tens of megabytes.

When you consider that it's the local cache and quarantine, which exists on top of all security products' footprints, even 50MB in the folder directly is not that bad by comparison.

[Triple Helix]

Joe mine is getting large for some reason? Clean install of OS and installing 20 programs with WSA on!

TH

231164

[Techfox1976]

AV-Only, or Essentials/Complete? It looks like one of the latter.

Things that are stored in that directory:
All monitored-process data.
All quarantine (It gets bigger from quarantining a file).
All main WSA data.
All Sync and Password management secondary data (The actual modules).

So if you have E or C, you should see a bunch of stuff under pkg.

[Triple Helix]

-{ Quote: "AV-Only, or Essentials/Complete? It looks like one of the latter.

Things that are stored in that directory:
All monitored-process data.
All quarantine (It gets bigger from quarantining a file).
All main WSA data.
All Sync and Password management secondary data (The actual modules).

So if you have E or C, you should see a bunch of stuff under pkg." }-

Close Beta of E without Back Up an Sync and it's a clean install of the OS so there are no infected files but I did install WSA before installing all other programs so it was Monitoring all programs I installed then today! So the point I was getting at is that Joe said they would minimize how many files was to be in that folder!

TH

231165

[Techfox1976]

I thought he said he was going to auto-cleanup stuff better to minimize what goes in there. But if it's monitoring installs, that's some serious data quantity. Sounds like the best bet would be to contact support and see about getting the installers or the installed programs themselves whitelisted so they no longer monitor.

After all, if all of the data was generated by monitoring unknown files for a few minutes/hours, how is the agent supposed to know what is safe to throw out and when? What if the installer is later deemed to be bad and everything it did needs to be undone?

Edit: The ddb#### should be a monitoring set. So whatever was monitored to create that 42-MB file should be whitelisted. :)

[Triple Helix]

I will leave it for Joe as I know if I do a clean reinstall of WSA and that will disappear! I just wanted him to see it as I said I did a clean install of the Win 7 32bit OS and then installed WSA then installed all updates from MS and then installed MS Office Pro 2010 and then MS updates again so it was an all day thing today with all other programs that I had on it before! ;)

TH

[Dermot7]

Think I need a clean install also, seeing this :o

[PatG]

I sure need something. Mine's reading 308mb and 230mb respectively. Kinda reminds me of the old Carl Smith song, "Hey, Joe". We're all a-waiting....

[Techfox1976]

I guess I "win" then. XD

Mine's at 543 MB (Half a gig! Woots!) on WSAC. Only 30MB of that is the Complete stuff.

Tons of monitoring of all the Dell driver installations and some locally developed code in WRLog.log, and one of the DB files is over 300MB. :)

[Ibrad]

Just curious is a clean install the only way to get the client size back down? If the WSA cloud changes a file to trusted would it still need those files or could the client delete the automatically to get more space?

[Triple Helix]

-{ Quote: "Just curious is a clean install the only way to get the client size back down? If the WSA cloud changes a file to trusted would it still need those files or could the client delete the automatically to get more space?" }-
No it can mess it up only a clean reinstall is the best way for now!

TH

[Corepcx]

I will chime in..

WSA - only after a few days and only have a few apps in detection list to allow, monitor, etc..have run a couple of full scan has well..

WRDATA folder for me

Size 104mb - some of the files in WRDATA folder are compressed once again, the blue ones and this reading is total of all files uncompressed..

Size on Disk reads 45mb - this is total with compression taken into account

If I am reading that right..

[Tarnak]

As I said in another thread a few days ago,
http://www.wilderssecurity.com/showpost.php?p=1995502&postcount=7 , I just got my computer back from the workshop after a checkup, and removal of a drive that was acting up.

Mine is looking lean...;)

231192

[PatG]

Uninstall and re-install got mine cleaned up! ;-)

[PrevxHelp]

Any size increase is just from the local journaling engine to ensure WSA can clean up threats properly. You can use the System Tools - System Control - Control Active Processes list to manually whitelist files (by changing them to "Allow") or you can write into our support inbox where they can whitelist files for you without a problem :)

[Tarnak]

Just looked where you pointed to...and noticed this.;)

231212

...looks a bit untidy.

[PrevxHelp]

-{ Quote: "Just looked where you pointed to...and noticed this.;)

231212

...looks a bit untidy." }-

True - it looks like that process has a few more child processes than we anticipated ;) I'll have that fixed shortly - thanks!

[Tarnak]

-{ Quote: "True - it looks like that process has a few more child processes than we anticipated ;) I'll have that fixed shortly - thanks!" }-

YW :) ...I'll look out for it.

[Tarnak]

-{ Quote: "True - it looks like that process has a few more child processes than we anticipated ;) I'll have that fixed shortly - thanks!" }-

Just checked the new v8.1.0.92, and not fixed, yet. ;)

[PrevxHelp]

-{ Quote: "Just checked the new v8.1.0.92, and not fixed, yet. ;)" }-

:ouch: I'll make sure it's in the next one! :)

[Tarnak]

:thumb: ;D

[Baldrick]

Hi All

Have received some feedback, from a Webroot source, via the Webroot Community re. the wrdata folder 'issue', and which I reproduce here after asking permission to do so as I think that it will help clarify what is going on here. Please note that I have been asked to make sure that it is understood that this is an initial view and so it's subject to change.

"The WRData folder (Located under the appropriate System App Data location for the OS) contains the operational parameters of the software as well as all working sets. For AV, it contains all quarantined files as well as all journalling information from unknown/monitored processes, configuration, logs, etc. With WSAE and WSAC it also contains the Sync/Backup and Password components repsectively.

Quarantined data is obviously kept until deleted from Quarantine. All Logs and Journalling data is kept for a time period and then automatically cleaned up. This cleanup can be triggered by age and also by the unknown items being registered as Good. Upgrade installs will never clean this up, since the Journalling data is critical to the ability to roll back infection actions in the case of an unknown being determined to be bad.

If you pkg directory is Big, that is the Extra Stuff (Password and Sync). It should normally start at about 70-80 MB for a WSAC installation and is primarily affected by sync data.

If your dbl.db file is getting Very Big, that is quarantine.

If your dbp.db file is Really Big, much stuff is being monitored. You can ask Support for assistance with cloud determinations specifically for your PC. This data is cleaned up automatically as well.

Huge ace files mean that really-complicated threat actions were rolled back"

I hope that this helps/is of use.

Regards


Balders

Mods: If I have transgressed the rules re. doing the above then please delete & advise. :)

[Triple Helix]

It's great Balders and from an official source! ;)

TH

[Dermot7]

Had to do a clean install again earlier (of WSA-E ,on W8 CP) since saw WRData had "swollen" again, and after only a month (but must bear in mind the info Baldrick kindly provided), and today's increase in size seemed surprising. Now back to a couple of MB again. This growth in size needs to be controlled/addressed, perhaps?

edit:spelling

[PrevxHelp]

-{ Quote: "Had to do a clean install again earlier (of WSA-E ,on W8 CP) since saw WRData had "swollen" again, and after only a month (but must bear in mind the info Baldrick kindly provided), and today's increase in size seemed surprising. Now back to a couple of MB again. This growth in size needs to be controlled/addressed, perhaps?

edit:spelling" }-

This is normal and part of the change journaling within WSA which stores previous copies of files in case an untrusted process is eventually found as malicious. If you write into our support team, they should be able to whitelist your software to prevent these from growing :)

[Dermot7]

-{ Quote: "This is normal and part of the change journaling within WSA which stores previous copies of files in case an untrusted process is eventually found as malicious. If you write into our support team, they should be able to whitelist your software to prevent these from growing :)" }-
Ok thanks, have been experimenting a bit with heuristics settings etc lately, to get it more the way I want.
Could try your advice about whitelisting software also, as often trying some perhaps less-common apps, thanks :)

[szaki2]

I have 1.8G Wrdata. If im sure i not have infection can i purge it somehow?

[Triple Helix]

-{ Quote: "I have 1.8G Wrdata. If im sure i not have infection can i purge it somehow?" }-

Do a clean reinstall! Uninstall reboot download a fresh copy from here http://anywhere.webrootcloudav.com/zerol/wsainstall.exe and install and also make sure you have a copy of your license key before doing so!

TH

[szaki2]

I send wsalog then reinstall i think. I help maybe found something in logs to help fix this. Thanks for link :)

[Triple Helix]

-{ Quote: "I send wsalog then reinstall i think. I help maybe found something in logs to help fix this. Thanks for link :)" }-

So you are in contact with WSA support inbox? They will fix you up! ;)

Cheers,

TH

[Tarnak]

I just realised that this is still not fixed in v8.0.1.165 ...as per my post in January - https://www.wilderssecurity.com/showpost.php?p=1999635&postcount=24

and follow-up posts by Joe - https://www.wilderssecurity.com/showpost.php?p=2005330&postcount=25 , https://www.wilderssecurity.com/showpost.php?p=2008277&postcount=28

;)

[szaki2]

Support fix wrdata folder with uninstall-reinstall but i get serious backup and sync problems. That database problem too serious for them. :(
Maybe sb know what is this?
https://skydrive.live.com/redir.aspx?cid=7be95248e6612283&resid=7BE95248E6612283!150&parid=7BE95248E6612283!104&authkey=!AMIB1zKtWk1uqf0