Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Citrix XenApp 6.0 server on Windows 2008 R2 Enterprise as a VM in ESX 4.1 environment. This one particular system, the C:\Windows\System32\Spool directory is seeing CAB files constantly being created and deleted in the directory. So for example, if I have an explorer window open to that directory, I will see the typical \drivers, \Printers, \prtprocs, \Servers & \tools folders. But in addition, I will see sometimes half a dozen, a dozen or more folders and CAB files being created and deleted constantly with the UID of HP drivers such as {5DB6D9A6-DD36-47DE-8BF7-C23366291563}. These files and folders are literally being created and deleted within seconds, USUALLY. But I have started noticing that some aren't, and this is leading to disk full situation as well. If I look in Print Management, I can see 41 print drivers listed, and that list doesn't change. If I look in control.exe printers I can see only 10 printers and faxes listed (there may be others that I can't see, they are assigned by GPO and I haven't bothered to put myself in all the groups necessary to see all printers) Print spooler seems to be working fine, Citrix Print Manager Service same (as fine as can be expected in a Citrix environment anyhow)

I'm very new to Citrix administration, just now learning about it, and it has been forever and a day since I've done any kind of printer administration, so this is confounding me some. And it is understandably creating a small bit of a performance hit, in an environment that is already fairly over stressed (the SAN is an old CX4 that is being heavily stressed right now) so solving this would help lighten a load that isn't needed.

I ran a ProcMon on the C:\windows\system32\spool directory with a filter, looking at the File System Activity and can see the writes and deletes, but I'm still not sure what is causing this. Below is some sample output from the ProcMon filter:

  1. *Date & Time: 8/12/2013 2:46:22 PM Event Class: File System Operation: IRP_MJ_CREATE Result: NAME COLLISION Path: C:\Windows\System32\spool TID: 7932 Duration: 0.0000229 Desired Access: Read Data/List Directory, Synchronize Disposition: Create Options: Directory, Synchronous IO Non-Alert, Open Reparse Point Attributes: N ShareMode: Read, Write AllocationSize: 0*

  2. *Date & Time: 8/12/2013 2:46:22 PM Event Class: File System Operation: IRP_MJ_WRITE Result: SUCCESS Path: C:\Windows\System32\spool TID: 112 Duration: 0.0039137 Offset: 0 Length: 8,192 I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O Priority: Normal*

  3. *Date & Time: 8/12/2013 2:46:24 PM Event Class: File System Operation: IRP_MJ_CREATE Result: NAME COLLISION Path: C:\Windows\System32\spool TID: 17284 Duration: 0.0001126 Desired Access: Read Data/List Directory, Synchronize Disposition: Create Options: Directory, Synchronous IO Non-Alert, Open Reparse Point Attributes: N ShareMode: Read, Write AllocationSize: 0*

I see those entries constantly popping up in the capture, but I am not sure what to do with them. Any assistance would be much appreciated. If more information is needed please feel free to ask.

Thanks and have a great day.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.