Disk Space Disappearing Overnight

[eespiedrop]

Dear Anyone Who Can Help,

I have a DELL PowerEdge Server 2500. The disks are partitioned into
various drives with the C: drive being the main problem. Every night we
are losing approx. 15Mb of disk space on the C: drive for no apparent
reason. I have searched the drive by date to see files recently added
and checked their size and the same files appear again and again as the
largest ones but with no difference in their size. I recently found
that it may have been Exchange 2000 which was not being backed up
properly and was building up a backlog of log files. Ater investigation
it was found that these are held on a seperate drive entirely. The
largest program in terms of disk space on C: is Antigen AntiVirus. Any
thoughts? Any help would be greatly appreciated. Any other information
I can put into this thread.

Tom.

 

[Pegasus \(MVP\)]

Dear Anyone Who Can Help,

I have a DELL PowerEdge Server 2500. The disks are partitioned into
various drives with the C: drive being the main problem. Every night we
are losing approx. 15Mb of disk space on the C: drive for no apparent
reason. I have searched the drive by date to see files recently added
and checked their size and the same files appear again and again as the
largest ones but with no difference in their size. I recently found
that it may have been Exchange 2000 which was not being backed up
properly and was building up a backlog of log files. Ater investigation
it was found that these are held on a seperate drive entirely. The
largest program in terms of disk space on C: is Antigen AntiVirus. Any
thoughts? Any help would be greatly appreciated. Any other information
I can put into this thread.

Tom.

These tools may help you:
DriveUse:
http://members.ozemail.com.au/~nulifetv/freezip/freeware/index.html
Bullet Proof Folder sizes: http://www.foldersizes.com/

 

[Lord Bharath Bhushan Lohray]

Sounds more like a log file in action...

Have you tried searching by file size? Look for files in the victim
drive for files lager than say 5000Kb... Many of the log type of files
reside in the Application Data folders.

To see a list of newly added files, do this...

dir /b /s c:\ >dir1.txt

This shall make a list of all files in your c drive.

Do the same next day dir /b /s c:\ >dir2.txt

Use a difference utility to see the difference...

A complex way...Sorry... But might help if nothing else helps.

Bharath Bhushan Lohray.

 

[Tom McMaster]

Thanks very much for your helpy guys. I will try the utility you
recommended Pegasus and I will perform the cmd stuff too Bharath. In
reply to your question, I've already run the search on files over a
certain size but the only ones I find either don't grow at all or grow
in very small amounts, nothing like the amount of disk space that we
are losing.

In a bizarre twist, I was removing last nights AV Scans from the server
(they stay on the monitor and clog it up) when I noticed that, upon
deleting all the scans, the disk space on drive C: went all the way
down to 10Mb if I kept hitting the refresh button. Once at 10Mb it
popped right back up to 700Mb, which is roughly what we have left. When
I do this tommorrow, it will do the same thing but leave us with say
680MB. I ran three manual scans and each one used up 1MB of space on
the C: drive without returning it once I cancelled the scan.

Thoughts?

I'm going to disable the AV scans for one night to see if this is the
problem.
Thanks again
Tom.

 

[Lord Bharath Bhushan Lohray]

If you have zeroed in on the AV, and are sure that it is the culprit,
it's fine...

Just an after thought... You might have seen this already though... Are
you watching the Hidden System Files? Hybernate and Page Files? or
something similar? Have you got NTFS? NTFS requires a lot of overhead
you know... Could that be the culprit?

Bharath.

 

[Tom McMaster]

If you have zeroed in on the AV, and are sure that it is the culprit,
it's fine...

Just an after thought... You might have seen this already though... Are
you watching the Hidden System Files? Hybernate and Page Files? or
something similar? Have you got NTFS? NTFS requires a lot of overhead
you know... Could that be the culprit?

Bharath.

I'm pretty sure it isn't anything to do with any hidden system files.
The other day I was making an ERD and some startup disks and had to
enable system files for viewing to get a copy of boot.ini. I assume I
left this setting as it was but I'll check when I go in in the morning.
I'll post my results from the AV check. We also have Antigen for
Exchange. This runs five checks for updates during the night. I've
traced the code that these leave on the screen in the morning and it
points to one of the other drives... Hmmmmmmmm,
Thanks agian for your help on this one.

Tom.

 

[Tom McMaster]

Well, I came in this morning to find that the disk space is down again,
despite disabling the AV. There are scheduled tasks which were created
by the system and these are for Antigen updates. I'm going to try and
disable these to see what happens. I checked all hidden system files
and the only one which raises issues is page.sys. Alas, the last time
this was modified was 31st of May. Hmmmm...

 

[Lord Bharath Bhushan Lohray]

Are you sure It has nothing to do with NTFS?

Could defragmenting the drive help?

 

[Tom McMaster]

I thought that defragmenting didn't give you an actual extra space. I
thought that it just concatenated all the empty space from across the
drive together and made read and write access easier - to talk like a
layman.

I turned off the Antigen scheduled tasks before I left tonight and
there was 736 Mb left on the drive. That's after I deleted the 9MB of
log files that NT Backup had created.

Tom.

 

[Lord Bharath Bhushan Lohray]

Yes, Defrag does exactly that...

I do not know the nity gritty of NTFS, but A few years ago, I had a 4GB
HDD and I tried setting up NTFS on a 2GB partition and the overgead
accounted for ~700MB. I do not know if the over head varies with the
drive size or so...

And at the same time comparing file systems, I discovered that FAT-16
is the fastest but maximum prone to slowing down on frgamentation and
does not support drives beyond a certain size with the default cluster
size(Allocation Units). FAT-32 supports larger dives and can withstand
some fragmentation. NTFS is the slowest of all but, it's performance
does not drop out drastically on fragmentation. So, I thought NTFS
overhead and fragmentation had something to do with each other....

Also if your cluster size(Allocation Unit) is large, even a single byte
stored in that cluster would mean 512bytes gone (Assuming the cluster
size to be 512 bytes). So If your drive's cluster size is very large,
It could possibley eat up a lot of hardisk space even for small
increments in file size...But a rare phenominon...

I seems to have reached the end of my wits here... Since you are
running a server, You have a lot to deal with... Had such a problem
occured on my home PC, I would back up data, and format it and
reinstall everything... :-( Crude but effective.

Bharath.

 

[Tom McMaster]

Lord,
I will try running the defrag tonight and see. At this point I think
that anything is worth a try. I tried the difference utility idea that
you suggested but there was nothing new of any significance. Anywho,
thanks very much for your help and your time. It's really apreciated.
Will post back if anything exciting happens
Tom.

 

[Tom McMaster]

Hi Lord,
A quick update. I went to the server this morning to run the
defrag and found that the C: drive had upped itself from 668Mb to
2.1Gb. Yesterday we installed a new piece of AV. I wonder of there is a
link between the two.

Hmmm

Thanks for all your help anyway. It's greatly appreciated.

Tom.