Disk full with 26GB left

[Marque1968]

Who is able to help me with the following. I have a strange problem that has
been hounting me for the last couple of months.

When I switch on my computer, I have the luxery of 26GB of free space on my
C: drive. After a while (which can be a couple of hours to a day or so) the
disk is full. Not instantly. I can see the diskusage grow.

To clarify, when I reboot the computer, all lost diskspace is recoverd, and
I can restart with my 26GB.

I did write a small program to indicate in which directory there was a
significant change between the first run (just after booting) and the last
run (started when the disk-full notification was shown). However, it stated
no real difference in diskusage. After this I resorted to the basic windows
tools.

What seemed to be the case, when I check the status using C: -> Properties,
I see that all the available space is gone, and all 64,7GB is in use.
However, when selecting all files and folders in the rootdirectory
(including all hidden and systemfiles) I see that I only use the 38,2GB I
was supposed to use. The only conclusion I can make here, is that there is a
program writing files, but not flushing them until the machine is reset.

I downloaded a program that showed me each file that was written, and by
which program. I then shut down any program that was intensively writing to
disk (Oracle, Java, MySQL, HPMon5 and Outlook), but still, the disk got
full.

As last resort I used the Windows Taskmanager, which also is able to show
the I/O usage of any process, and what was the case? The SYSTEM-process is
the one that wrote 28GB of information to my disk, between startup and
disk-full. The second in the list is Oracle, that only wrote 2GB of
information in the meanwhile.

Well, that's how far I'm able to analyse this problem. Shutting down the
SYSTEM-process is no option. The Norton virusscanner and the Microsoft and
Spy Bot Spyware-scanners have all run on the computer, with the most recent
updates installed, but found nothing more then a few cookies.

So here is the point that I have to ask you all. Has any of you ever come
accross this problem, and have you managed to solve it? How?

As extra info. I run Windows XP (Dutch release) with all servicepacks
installed.

All the screenshots can be found on http://marque.aqmulate.com/bytes

Thank you for any posible assistance!


Marque1968

 

[jopa66]

Pagefile?
System Restore?

 

[Marque1968]

No, as both off them show up in windows Explorer, and should still be there
when the computer reboots. As I stated, all used space is freed again after
reboot.

 

[HillBillyBuddhist]

| Who is able to help me with the following. I have a strange problem that
has
| been hounting me for the last couple of months.
|
| When I switch on my computer, I have the luxery of 26GB of free space on
my
| C: drive. After a while (which can be a couple of hours to a day or so)
the
| disk is full. Not instantly. I can see the diskusage grow.
|


SequoiaView is an excellent free (and clean) utility helpful in tracking
down mysterious missing drive space.

It provides a one window graphical representation of which files are taking
up how much space where on a drive, often quickly and easily tracking down
files that Windows is reluctant to reveal.

http://www.win.tue.nl/sequoiaview/

(It's kinda fun too)


--
D

I'm not an MVP a VIP nor do I have ESP.
I was just trying to help.
Please use your own best judgment before implementing any suggestions or
advice herein.
No warranty is expressed or implied.
Your mileage may vary.
See store for details.

Remove shoes to E-mail.

 

[Gerry Cornell]

When the disk is full have you tried using the Search facility in
Windows Explorer to locate files over 1mb. Then click on the tab over
the size column to sort. Review the list for the unexpected.

Are you sing any Norton utilities? Norton Protected Storage?

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Marque1968]

Gerry, as mentioned before, when looking at files, may it be in Explorer or
in my own program, no aditional files, nor sizes can be found. Even with a
full disk, explorer shows I have only 38.2 GB in use (see image 3)

Marque

 

[Marque1968]

To be hounest, I don't think this program will work. Reading the info, it
tracks the files with large sizes, and I don't think that's the problem.

However, I downloaded the program, and it's running as we speak, and I'll
check it again when my disk is full at the end of the day or tomorow morning

 

[Rattleon]

Try turning off your pagefile, or adjusting it's size smaller.
I believe it is either the pagefile or the hiberfile loading oversize.

 

[Marque1968]

The pagefile stays below the 1GB mark at the time of a diskfull.

 

[HillBillyBuddhist]

| "HillBillyBuddhist" <[email protected]> schreef in bericht
| | > | > | Who is able to help me with the following. I have a strange problem
that
| > has
| > | been hounting me for the last couple of months.
| > |
| > | When I switch on my computer, I have the luxery of 26GB of free space
on
| > my
| > | C: drive. After a while (which can be a couple of hours to a day or
so)
| > the
| > | disk is full. Not instantly. I can see the diskusage grow.
| > |
| >
| >
| > SequoiaView is an excellent free (and clean) utility helpful in tracking
| > down mysterious missing drive space.
| >
| > It provides a one window graphical representation of which files are
| > taking
| > up how much space where on a drive, often quickly and easily tracking
down
| > files that Windows is reluctant to reveal.
| >
| > http://www.win.tue.nl/sequoiaview/
| >
| > (It's kinda fun too)
| >
| >
| > --
| > D
| >

| To be hounest, I don't think this program will work. Reading the info, it
| tracks the files with large sizes, and I don't think that's the problem.
|
| However, I downloaded the program, and it's running as we speak, and I'll
| check it again when my disk is full at the end of the day or tomorow
morning

I'm not sure how you got that impression. It shows every file on your drive.

When you "check it again" you'll have to refresh the view. I'd suggest
saving a screenshot of the initial view and compare it side by side with the
"after" view. The differences should be immediately apparent.

--
D

I'm not an MVP a VIP nor do I have ESP.
I was just trying to help.
Please use your own best judgment before implementing any suggestions or
advice herein.
No warranty is expressed or implied.
Your mileage may vary.
See store for details.

Remove shoes to E-mail.

 

[Gerry Cornell]

Have you unchecked the box before "Hide protected operating system
files"?

You said it wasn't System Restore! Are you seeing the contents of the
Volume Information folder? What happens if your run Disk CleanUp, More
Options, System Restore? Does the available space significantly
increase? How much space has been allocated to System Restore?

My feeling is that you suggesting that System in Task Manager is
involved may be a "red herring" as just because it writes that much does
not necessarily it has created a new file or files of that size. My Task
Manager currently has half of your recorded written bytes with no
noticeable reduction in free disk space.

Have you installed any "memory booster"?

Have you tried running chkdsk?

What happens if you disable the Indexing Service?

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Marque1968]

Hi Gerry,

Yes, I have unchecked hide protected and system files. Also unchecked hide
hidden files. All is on show to me.

The thing with System Restore and stuff, is that they create files on the
disk, and leave them there. My problem is that there are no apparent files,
and the disk is freed of all bytes used, just by a simple reboot. Therefor
disk cleanup wouldn't do me any good. I can't really run it when my disk is
100% full, and when the system is rebooted, there is no problem to detect.

You might be right in stating that the SYSTEM in the task-manager is a
red-herring. However, there is no other process using as much diskspace for
writing. So either a (program using a) System process is indeed writing al
this data and not freeing it (which I think is the case), or there is a
program that lets windows mall-detect the free space and which resets itself
upon reboot.

I have no memory boosters installed.

 

[Guest]

Disable your Indexing Service.
Open My Computer>rightclick your "C" drive>Properties>
untick "Alow Indexing Service....etc."
Click Apply and OK
If it is unticked, reset your Page File (Virtual Memory) to 1 1/2 times your
RAM.

 

[Marque1968]

Well, the whole thing is that there doesn't seem to be any files on the
disk, that fill this space (see image 3) Therefor I don't think a fileviewer
will be able to help me.

I've only lost 5GB upto now, so nothing will be apparent yet, I'll try later
today.

 

[Marque1968]

Again, Indexing (at least how I precieve it, correct me if I'm wrong) is
writing information on disk, and store it there for future use. However, my
problem is resolved by rebooting the system. Therefor it's unlikely to be
anything to do with permanent files, like indexes.

 

[Gerry Cornell]

I can't really run it when my disk is 100% full, and when the system is
rebooted, there is no problem to detect. Unless you try to run Disk
CleanUp how will you know whether it will run? It could be that System
Restore is continually creating restore points!

Are you seeing the contents of the Volume Information folder? This
folder contains copies of restore points etc. You need to take special
measures to see the contents:
How to Gain Access to the System Volume Information Folder
http://support.microsoft.com/default.aspx?scid=kb;en-us;309531&Product=winxp

What is the cluster size?
How to Locate and Correct Disk Space Problems on NTFS Volumes in Windows
XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;315688


--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Marque1968]

The SystemVolume Information folder is accessible, and has only 1
restorepoint in it, which is 56MB in size.

I will run the chkdsk later today, as my machine needs about 10-15 minutes
to boot (mainly due to oracle), I can't spend the time just yet.

Thanks for the links!

 

[Marque1968]

To Clarify:
I have ALL files visible to me, and there are NO increases in swapfiles or
recovery files.
A Virusscanner and 2 anti-spyware programs have checked the system.

This is the process log
Process list saved on 10:30:29, on 11-3-2005
Platform: WinNT 5.01.2600 SP2

[pid] [full path to filename] [file version] [company name]
872 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
988 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
1036 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation
1048 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
1208 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1324 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1744 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 2.1.3.4
Symantec Corporation
1824 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 2.1.3.4
Symantec Corporation
220 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2180 Microsoft Corporation
1012 C:\WINDOWS\Microsoft.NET\Framework\v2.0.40607\aspnet_admin.exe
2.0.-24929.42 Microsoft Corporation
1220 C:\Program Files\Sitecom\Bluetooth Software\bin\btwdins.exe 1.4.2.10
WIDCOMM, Inc.
1400 C:\WINDOWS\system32\inetsrv\inetinfo.exe 5.1.2600.2180 Microsoft
Corporation
1428 C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
1528 C:\Program Files\Norton AntiVirus\navapsvc.exe 10.0.14.2 Symantec
Corporation
1604 C:\WINDOWS\system32\nvsvc32.exe 6.14.10.5351 NVIDIA Corporation
1636 C:\oracle\product\10.1.0\Db_1\bin\isqlplussvc.exe 1.0.7.0 Oracle
2004 C:\oracle\product\10.1.0\Db_1\jdk\bin\java.exe
2016 C:\oracle\product\10.1.0\Db_1\BIN\TNSLSNR.exe
308 c:\oracle\product\10.1.0\db_1\bin\ORACLE.EXE 10.1.0.2 Oracle
Corporation
532 C:\Program Files\Norton AntiVirus\SAVScan.exe 9.2.1.14 Symantec
Corporation
612 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1100 C:\Program Files\Common Files\Symantec Shared\Security
Center\SymWSC.exe 2005.1.2.20 Symantec Corporation
2180 C:\WINDOWS\Explorer.EXE 6.0.2900.2180 Microsoft Corporation
2880 C:\WINDOWS\SOUNDMAN.EXE 5.1.0.21 Realtek Semiconductor Corp.
2904 C:\WINDOWS\AGRSMMSG.exe 2.1.33.0 Agere Systems
2976 C:\Program Files\Common Files\Symantec Shared\ccApp.exe 2.1.3.4
Symantec Corporation
3024 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe 5.0.0.0 Cyberlink
Corp.
3060 C:\Program Files\Launch Manager\QtDTAcer.EXE 1.0.0.0 Dritek System
Inc.
3072 C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe 2.0.0.0 Maxtor
3080 C:\WINDOWS\MXOALDR.EXE 6.0.1010.0 Cypress Semiconductor
3144 C:\Program Files\Synaptics\SynTP\SynTPLpr.exe 7.5.4.0 Synaptics, Inc.
3164 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe 7.5.4.0 Synaptics, Inc.
3220 C:\Program Files\Common Files\Nokia\NCLTools\NclTray.exe 5.0.0.26
Nokia
3280 C:\PROGRA~1\COMMON~1\Nokia\Services\SERVIC~1.EXE 5.0.0.18 Nokia Corp.
3356 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe 2.245.1.0 HP
3412 C:\WINDOWS\system32\hphmon04.exe 4.2.41.0 Hewlett-Packard
3480 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe 2.1.1.0 Hewlett-Packard
Company
3532 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe 2.0.37.0
Hewlett-Packard
3544 C:\WINDOWS\system32\hphmon05.exe 5.3.5.0 Hewlett-Packard
3584 C:\WINDOWS\vsnpstd.exe 1.0.1.0
3684 C:\Program Files\Java\j2re1.4.2_07\bin\jusched.exe
3708 C:\WINDOWS\system32\ctfmon.exe 5.1.2600.2180 Microsoft Corporation
3720 C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe 1.0.0.501
Microsoft Corporation
484 C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe 6.0.0.878
Adobe Systems Inc.
576 C:\Program Files\Sitecom\Bluetooth Software\BTTray.exe 1.4.2.10
WIDCOMM, Inc.
700 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 5.31.0.147
Hewlett-Packard Co.
864 C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe 6.0.8824.500
OpenOffice.org
1716 C:\PROGRA~1\Sitecom\BLUETO~1\BTSTAC~1.EXE 1.4.2.10 WIDCOMM, Inc.
2356 C:\oracle\product\10.1.0\Db_1\bin\nmesrvc.exe 10.1.0.2 Oracle
Corporation
2928 C:\WINDOWS\system32\cmd.exe 5.1.2600.2180 Microsoft Corporation
2936 C:\oracle\product\10.1.0\Db_1\perl\5.6.1\bin\MSWin32-x86\perl.exe
3088 C:\oracle\product\10.1.0\Db_1\jdk\bin\java.exe
2052 C:\oracle\product\10.1.0\Db_1\bin\emagent.exe 10.1.0.2 Oracle
Corporation
860 C:\WINDOWS\system32\wbem\wmiapsrv.exe 5.1.2600.2180 Microsoft
Corporation
2128 C:\Program Files\Outlook Express\msimn.exe 6.0.2900.2180 Microsoft
Corporation
3896 C:\Program Files\Messenger\msmsgs.exe 4.7.0.3001 Microsoft Corporation
2836 C:\downloads\system\monitors\ibprocman\IBProcMan.exe 1.2.0.0 Soeperman
Enterprises Ltd.

 

[Marque1968]

Ok, for all who tried to help, and for all who has come accross the same
problem:

In the end, it seemed that on my disk the file
C:\WINDOWS\system32\Logfiles\WMI\trace.log was to be found. This file had a
filesize of 0Kb, but this is not a correct value, as this is an open file,
to which constant adding of data is executed. In real life, this is your
massive file. You can verify this by trying to delete the file, which you
can't as the file is in use.

Where did this come from? Well, a while back I (unsuccesfully) tried Bootvis
of Microsoft, to speed up my startup sequence (now roughly 10 to 15 minutes
on a P4 2.8Mhz, due to Oracle). But meanwhile I have already deinstalled
this program. However, this didn't stop the logging, initiated by Bootvis.

The sollution was to reinstall Bootvis. Then choose the option "stop
tracing", after which you can deinstall Bootvis again, as the problem is
solved. If you now check the file
C:\WINDOWS\system32\Logfiles\WMI\trace.log, you nitice that it does show you
the gigabytes it has been tracing up to now, as tracing has stopped. You are
also able to delete this file now.

Over the last 12 hours, no kilobyte of unexplainable data is been written to
my disk. Therefor I assume, I've cracked it!

Once again, thanks to all of you who tried helping me. Advises from
newsgroups and weblogs helped me to solve this mystery for me!

 

[Gerry Cornell]

Thanks for telling us the mystery is solved.

--


Regards.

Gerry

~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~