Further investigation has shown that recent updates to MS Office 2016 has re-enabled the area-debug-<PID>.log
files, even if you do not have OneDrive installed and enabled (as suggested elsewhere). The process who own the log file is (in my case) Excel. In addition to the already stated logfile, there is now also a log file in the form <USERNAME>-<DATE>-<TIME>.log
in that same directory. That last logfile is owned and created by the OfficeClickToRun process in: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
.
You can see this for yourself by downloading OpenedFilesView from Nirsoft. And search for the most recent log file.
What this is used for exactly is not clear at the moment. But it is very likely that these files are used by the ClickToRun Client called OfficeC2RClient.exe
in the C:\Program Files\Common Files\microsoft shared\ClickToRun\
directory and uploaded automatically by the client, as specified by the various *.xml
(settings) files in that same directory.
There are no settings for this in the OS, AFAICT! This obviously constitute both a security/privacy concern and a performance hit when operating with low bandwidth connections and/or on battery power.
UPDATE:
Every time any MSO application is updated, all the ClickToRun
is reset and updated. To stop the automatic uploads of all your secret log info, edit this file:
C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml
In addition the MSO is intrusively adding unwanted plugins in the Firefox plugin directories and uploading "logs" to MS servers. To disable these plugins, remove these files:
C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL
C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll
You can check what browser plugins are enabled with: about:plugins
in the URL bar.
It's not a random number, it is the (Windows) PID of the process that created the file. However, if the file is already closed, it is very likely that the process has terminated as well. See my answer below. – not2qubit – 2018-08-13T11:01:47.483