Bitlocker MBAM: Why svclog file is filling server hard drive?

[Hridayeshu]

well recently I have installed Bitlocker MBAM installed on my 2 of server configuration. The application/web server are supposed to keep filing up with RecoveryAndHardwareService.svclog at regular interval of the time. In case I stop the software service the log is getting roll over and I can delete previous log. But I could not find out the reason why data might be getting purged before it is getting writing into the database. Is rolling over and purging happening automatically? Or what should be the expected behavior? Let me know if you are having any idea to fix the matter.

[Kakashi Hatake]

In order to fix the matter of yours I recommend following steps which you can try.

• You should connect to MBAM server in which you have installed MBAM Admin as well as Monitoring Server role.
• You have to launch IIS Manager on MBAM Server and simply open IIS and MBAM Websites.
• You should simply delete the svclog files from the folder.

1. C:\inetpub\Malta BitLocker Management Solution\Logs\Recovery And Hardware Service
2. C:\inetpub\Malta BitLocker Management Solution\Logs\Compliance Status Service
3. C:\inetpub\Malta BitLocker Management Solution\Logs\Administration Service

• You have to change switchValue from Warning,ActivityTracing to Warning and Information,ActivityTracing to Warning in the below mentioned codes.

• You should browse and modify following lines.

C:\inetpub\Malta BitLocker Management Solution\MBAM Administration Service\web.config 

<sources>
  <source name="System.ServiceModel" switchValue="Warning,ActivityTracingWarning" propagateActivity="true">
      <listeners>
          <add name="ServiceModelTraceListener">
               </add>
       </listeners>
</source>
 <source name="Microsoft.Mbam.ApplicationSupportService" switchValue="Information,ActivityTracingWarning"propagateActivity="true">
      <listeners>
        <add name="ServiceModelTraceListener">
            </add>
       </listeners>
 </source>
</sources>

Now you have to go for following lines.

C:\inetpub\Malta BitLocker Management Solution\MBAM Compliance Status Service\web.config

<sources>
  <source name="System.ServiceModel" switchValue="Warning,ActivityTracingWarning" propagateActivity="true">
        <listeners>
          <add name="ServiceModelTraceListener">
          </add>
        </listeners>
      </source>
  <source name="Microsoft.Mbam.ReportingService" switchValue="Information,ActivityTracingWarning" propagateActivity="true">
        <listeners>
          <add name="ServiceModelTraceListener">
          </add>
        </listeners>
      </source>
    </sources>

Finally you have to go for following lines.

C:\inetpub\Malta BitLocker Management Solution\MBAM Recovery And Hardware Service\web.config

<sources>
  <source name="System.ServiceModel" switchValue="Warning,ActivityTracingWarning" propagateActivity="true">
        <listeners>
          <add name="ServiceModelTraceListener">
          </add>
        </listeners>
      </source>
  <source name="Microsoft.Mbam.CoreService" switchValue="Information,ActivityTracingWarning" propagateActivity="true">
        <listeners>
          <add name="ServiceModelTraceListener">
          </add>
        </listeners>
      </source>
    </sources>

Now you should save the web.config file. After that start IIS and MBAM web services on your system.

[shetty]

I wanted to tell you that Microsoft BitLocker Administration and Monitoring is supposed to gather information and activity tracing information for the WCF and MBAM services and that is the reason svc log file is supposed to increase quickly.