0

I have an AWS EC2 Windows host in a very strange situation, and I'm unable to actually determine how this is even possible.

Unfortunately, when I try to google or search this topic, all I get are hits about resizing / properly sizing your swap file, but nothing about swap file overallocation on a full disk.

Root device in AWS: 30GiB (29.6GB in windows) Drive Space used (size on disk):

  • Windows folder: 21.7GB (23,349,198,848 bytes)
  • Program Files (x86) folder: 4.00GB (4,298,366,976 bytes)
  • pagefile.sys: 8.00GB (8,589,934,592 bytes)
  • along with other smaller directories (users, inetpub, python27 etc)

It doesn't take very long to realize that 22 + 4 + 8 > 30GB.

How is this possible? I have guesses (swap space isn't actually allocated until it's used?), but I'm unable to actually find any documentation that actually explains how this is happening? If I were to use more RAM in this machine to the point of requiring swap space, would this machine suddenly crash because there is technically no available swap?

Additional info: - Swap is configured as a "Custom size", with both "Initial Size (MB)" and "Maximum Size (MB)" set to 8192. This is not a system managed size.

0

This anomaly is not related to the paging file. The Windows folder is not really 21.7GB. Many items within various subdirectories of C:\Windows are hard links to C:\Windows\WinSXS. The hard link copy in System32 consists only of an entry in the MFT, it does not consume disk space like the copy in WinSXS does. Each user profile also has junctions (One example: Application Data -> AppData). Unless the sizing tool accounts for this, the total size of those files is being counted twice (or more) for file content that only exists in one place. Unfortunately most tools still don't do this correctly, even explorer when you right click a folder, select properties, wait for it to sum the size.

Link here describes other methods for more accurate sizing like Sysinternals DU, and Powershell where you can look for attributes -match "reparsePoint" or linkType property (linkType requires at least PS V5). https://superuser.com/questions/217773/how-can-i-check-the-actual-size-used-in-an-ntfs-directory-with-many-hardlinks

What is WinSxs you ask?

The WinSxS folder is the only location that the component is found on the system, all other instances of the files that you see on the system are "projected" by hard linking from the component store.

.\du.exe -u "C:\Windows"
DU v1.6 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
Files:        161104
Directories:  35647
Size:         25,850,665,571 bytes
Size on disk: 26,113,503,232 bytes

.\du.exe "C:\Windows"
DU v1.6 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
Files:        120914
Directories:  35647
Size:         20,464,951,291 bytes
Size on disk: 20,759,183,360 bytes

This size does not equal that size

  • sometimes you think the actual answer is going to be odd or ridiculous, and then that expectation is blown out of the water when it ends up being something like this. Once you said hard links my head just started hitting the desk. Thanks for the thorough explanation though! – Ryan May 26 '17 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.