0

This is a bit of a strange issue - the usual troubleshooting steps don't seem to apply.

On a XenServer 6.2 host (with SP1), I have a guest VM that is running Windows Server 2012 R2 that functions as a file/print server. The VM is about a year old. It has a system drive that is 45gb and a data drive that holds a few hundred gigs of shared files.

This morning, the system drive slowly started marching towards full. Not slow, but not fast either. Anyway, it hit full and print jobs stopped working. Weird. I ran windirstat and cleaned up some old log files. Things were fine, but then it filled that space too.

So, at that point, I'm out of things to clear off the C drive. I ran Windirstat again and noticed that the total disk usage was actually only 16gb. Huh? Windows explorer still reports that the disk is fully full at this point.

I rebooted.

Windows explorer now shows the correct amount of free space. Awesome! Until I refreshed... and noticed there was less free space. And refresh again... and less free space.

It's not a fast leak, but still will "fill" the remaining space within about 2.5 hours. I say "fill" because re-running Windirstat on C: shows that only 16 gigs of data still exist.

Interesting things:

  • This doesn't happen on the data disk.
  • vssadmin list writers lists no snapshots
  • I uninstalled our backup software client (Unitrends 8)
  • We aren't using file shadow copies/previous versions
  • fsutil volume diskfree C: agrees with Windows Explorer
  • We have a different VM also running S2012R2 on this host that is not experiencing the same issue.
  • We're up to date on Windows Update

Thanks for any help or pointers you can give! I'd be happy to try and report just about anything. I phoned this in to Citrix support, and they have a small patch they want me to apply, but they also admitted that it doesn't fix the issue. They're pointing the finger and Windows itself right now.

To sum all this up in a question - what else could cause Windows Explorer to think a disk is growing, but wouldn't show up with WinDirStat?

Update: The diskspace mismatch is fixed. Aparently WinDirStat (ran as Admin) still doesn't see the C:\Windows\System32\Spool folder. Weird, right? Anyway, there was a 16gb file jammed in there. It's gone now. I'll update tomorrow with whether or not we see disk size creeping like we did before (just now with more free disk space for it to creep into)

4
  • What you find under the "disk" column of task manager -> process? There is some process heavily using the disk?
    – shodanshok
    Mar 30, 2015 at 22:49
  • Take a look at the WinSxS folder and then increase the size of the virtual hard disk and OS volume so that you don't have to deal with this again. I've found 60GB to be a pretty stable size. - technet.microsoft.com/en-us/library/dn251566.aspx
    – joeqwerty
    Mar 30, 2015 at 22:50
  • @shodanshok - Nothing crazy. A few MB/second for writes. Like, 2-4.
    – SteadH
    Mar 30, 2015 at 23:27
  • @joeqwerty Thanks! Unfortunately, this isn't a WinSxS issue since the total files on the disk don't seem to be increasing. The disk only shows 16gb of contents, but for some reason Windows explorer is reporting much more (and more, and more).
    – SteadH
    Mar 30, 2015 at 23:28

3 Answers 3

0

Any updates or new applications been installed?

I'd also look at C:\Windows\System32\LogFiles which is where some IIS and Windows Error Reporting logs go. I typically disable Windows Error Reporting because it's filled some of my drives before.

I'd check event logs for any hints and continue to run whatever folder/file sizing utility you can to inspect C:\ to see what directories are taking up the most space and growing.

3
  • No updates or applications. Last round of Windows Updates was the set earlier this month. This server holds one application - PaperCut, for print accounting, but it's last update was about 3 months ago. Using WinDirStat reveals that C:\ ONLY has 16gb of files on it (Windows + PaperCut). That's the weirdness. I wish it were just some growing directory!
    – SteadH
    Mar 30, 2015 at 23:29
  • Try showing hidden files and system hidden files. Then see what is showing on C:\. See if hibernation file is there. That could be removed. See if your windows paging file is large or changing. Or if any other files are showing up that are large. Also, try another sizing application too to see if you get the same results. I really like using WizTree.
    – Mark
    Mar 31, 2015 at 15:31
  • I'm going to mark this as the answer. My Mysterious growing file? Print spool. For some reason, Windirstat, even as admin, doesn't detect that this folder exists. Weird! Thanks Mark! I found the culprit folder not by using windirstat (or any tool), but just right click & properties folder after folder (or by group of folders). Uggh!
    – SteadH
    Apr 1, 2015 at 23:11
0

Check out "Shadow copies" tab in disk properties. My production system was eating 180GB of 250GB drive for shadow copy of backup disk e: (which is quite insane IMHO).

Default shadow copy setting was 'unlimited' so it eats nearly whole disk on prod machine!

Check out the C:\System Volume Information\ directory, there was the {ee93380c-a671-11ea-8105-1e00200079bc}{3808876b-c176-4e48-b7ae-04046e6cc752} file which was HUGE. Setting the shadow copy to limited size (320MB) it cleans the data and the disk is reasonably free again.

-2

Whenever my drives filled up without the obvious updates or installations, I found out malware was replicating. Check your processes for strange third parties and scan. Also SQL logs tend to bloat quickly without truncating them in a timely manner.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .