I have a couple of Windows 2003 servers that regularly trigger low-disk alerts around 3 AM. The alert then resets within 15 minutes. Typically these servers have about 40% free on their C: drive, but during those 15 minutes have less than 10% free.

I set up a scheduled task to run dir /s > c:\log.txt at 3:05 AM using a domain admin account. I was able to "catch" the server with a full drive last night.

These are the last lines of the log.txt file from 3 AM:

 Total Files Listed:
       31660 File(s)  7,710,072,795 bytes
       14625 Dir(s)     406,929,408 bytes free

400 MB free! And here is the output of dir right now:

 Total Files Listed:
       31615 File(s)  7,693,175,876 bytes
       14572 Dir(s)   3,516,493,824 bytes free

But if I diff the files, I can't account for more than 17 MB worth of differences. Where is 3 GB going?

I see no events in the event log for VSS and backups run from 11-12.

I'm out of ideas here. What else should I be looking at?

  • Just a thought based on the 3am time. Are they set with the default automatic updates? Cause that's at 3am. Might look into that and see if something in the Software Distribution folder or Automatic Updates is causing the craziness. – TheCleaner Feb 5 '13 at 22:19
  • 1
    Would it be a good idea to write another script which logs recently modified files and their file size? Schedule that task. – Daniel t. Feb 5 '13 at 22:23
  • Backup? I have this problem on some of our servers when the system state backup runs (and creates a temporary ntbackup file the size of the server RAM). – HopelessN00b Feb 5 '13 at 22:30
  • @HopelessN00b - he said the backups run from 11 to 12. ;) – TheCleaner Feb 5 '13 at 22:39
  • You should be looking for a patch from microsoft. – mdpc Feb 6 '13 at 2:33

Try using Tree Size Pro. You can schedule it to run with command line options and dump the output to an xml file (during the space loss), then use the "compare with xml file" option to find exactly where the space has gone.

| improve this answer | |
  • I already did that with dir. What does Tree Size Pro get me that dir doesn't? – longneck Feb 6 '13 at 13:47
  • A much better interface to work with; it's purpose is to show you where space is being used on your hard drive. If you want to use dir, then you need to include the /a:sh otherwise you wouldn't get system and hidden files. – Chris Feb 6 '13 at 13:55
  • One thing that I discovered Tree Size Pro does do that dir does not is show every file, regardless of hidden/system. I have it scheduled to run at 3 am every night now until the problem re-occurs. – longneck Feb 7 '13 at 19:07

It would appear that the files taking up the space aren't shown in a raw DIR listing, since parsing the folders themselves show no appreciable differences.

To display system and hidden files during your scan, use DIR /S /ASH > C:\log.txt in your scheduled tasks.

| improve this answer | |
  • This shows ONLY system and hidden files. Do you know how to make it show all files, regardless of attributes? – longneck Feb 7 '13 at 19:08
  • Doesn't appear so (major design flaw in DOS DIR command, that). You might have to run both the standard DIR and the DIR /ASH and then combine the two. – George Erhard Feb 8 '13 at 20:11

Are you familiar with procmon? Configure a filter to focus on operations like WriteFile, CreateFile, etc, save that config. Make a scheduled task to launch "procmon /loadconfig writefile.pmc" a couple hours before 3 am. Take a look at the log the next day. Hopefully something will jump out at you.

| improve this answer | |

Procmon sounds like a good start to me, and keep that scheduled dir running, does the amount of used space change every night or is it roughly the same? Are there any other scheduled tasks that run at that time?

Lastly... its a pain but you could log into the server at 2:30am and keep an eye on it until you see the problem.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.