Why are temp files deleted after EseDiskFlushConsistency event?

Question

We have a program that creates temporary files. Today one of our users had the problem that the temporary files disappeared. The temporary files we create are deleted only when the program terminates, but the program was still running.

I checked the windows event log and found the following entry at 9:46:24

svchost (6140,G,98) The beta feature EseDiskFlushConsistency is enabled in ESENT due to the beta site mode settings 0x800000.

Immediately after the event I found log statements in setupact.log stating that cleanmgr.exe has been executed.

2020-11-09 09:46:25, Info SetupClnLogInitializationInfo - Getting plugin name
2020-11-09 09:46:25, Info SetupClnLogInitializationInfo - session being initialized for Plugin: Previous Installations
2020-11-09 09:46:25, Info Client Process:C:\WINDOWS\system32\cleanmgr.exe

Storage sense is turned off. And cleanmgr.exe should only delete temp files after 7 days of last access (and the temp files were created on the same day).

But as this is the only suspisious activity I found and as I found a lot of posts about crashing applications after that event, could it be that cleanmgr.exe performs a deletion of temp files ignoring the 7 day limit?

OS: Windows 10 1803 Enterprise

Update:

To be absolute certain that cleanmgr.exe deleted the file I activated auditing of deletions for entries in the temp folder. From the Security log:

Object:
    ...
    Object Name:         C:\Users\JMAYER~1\AppData\Local\Temp\efah31jq.45m
    ...

Process Information:
    ...
    Process Name:        C:\Windows\System32\cleanmgr.exe
...
    Accesses:            DELETE

And again a ~15 seconds before the EseDiskFlushConsistency event showed up in the Application log.

I also checked the registry value for LastAccess in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Files, and it shows a value of 7.

The file was created today, so cleanmgr.exe is not allowed to delete it.

So the question remains: Why does cleanmgr.exe delete this file? (And why does it run at all?)

cleanmgr.exe file version: 10.0.17134.1

Answer 1

@Hakito
Hi,

Based on my research, EseDiskFlushConsistency messages are for when different methods are being used to flush data, like moving temp files from RAM to disk etc.
That may be not related with your problem.

You can probably change the Disk Cleanup value:
Open up regedit.exe through the Start Menu search or run box, and then browse down to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Temporary Files

Once you’re there, you’ll see the LastAccess value on the right-hand side, which contains a value that specifies the number of days, which you can change to whatever you’d like.

Note: Make sure that you back up the registry you modify it.

Hope above information can help you.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Try run,type: %Temp% organize/select all/right click on data/delete all/exit.Also,in run type: CLEANMGR /SAGESET select all/exit,return to run,type: CLEANMGR /SAGERUN Notice the difference cleanmgr does rather than disk cleanup...