Link to home
Start Free TrialLog in
Avatar of paragkshah
paragkshah

asked on

C drive (OS drive) becomes almost full

Hi,

I have windows 2000 server running on Active Directory environment, with Exchange server and SQL server installed on domain controller. My OS, E2K and SQL server installed on C drive( 10 GB) and my user data is on shared D drive. No print server installed.
Now everyday my C drive fills up almost 7-9 MB of space in C drive and now I am left with less than 1 GB of space. Right now I don't have any plan to install anything major but I am worried about future. If this thing continues, my C drive will be filled up very soon.
I know for sure that my E2k database is using 1.5 GB of space ( actual user mailboxes are using about 40 MB of space only). And my Sql server database is on D drive .
Now my questions are :
1. Why this C drive fills up so fast and what fills up and in that amount ?no heavy use of mails, sql server is in heavy use. but as I said database is on D drive.
2. Does the E2K database occupies 1.5GB of space for 40 MB of mailboxes normally? I heard defragmentation is little bit risky.
3. Should I use anykind of software like partition magic(PM) to enhance the C drive ? ( I have RAID 5 hard disks. Does PM work for RAID harddisks? )
Any other ideas will also be highly appreciated,

PS
Avatar of RevelationCS
RevelationCS
Flag of United States of America image

logs files could be the likely culprit.... check to see wehre all the log files are created for w2k, exchange, and sql... if those are on the C drive, try moving them to point at the D drive and see if that helps...
Hi,

I think that these files are transaction logs, they reside in this folder.

c:\program files\exchsrvs\mdbdata\*.*

Here you will find files that are called like E00*.log. First of all, DON'T DELETE THEM. You can delete them by enabling circular logging. Here's a link to see how to enable circular logging.

http://support.microsoft.com/default.aspx?scid=kb;en-us;314605&sd=tech

Here are transaction logs explained..
http://www.winnetmag.com/Windows/Article/ArticleID/4785/4785.html
one band-aid that might help is moving your pagefile from c: to d: that may give you another GB or so....

Its hard to say why your drive fills up and with what....how much does your drive fluctuate each day? Can you tell by analyzing the drive what is taking up all the space?

actually rhandels, he should be find deleting the tranlog files unless if it is the most recent one. There are probably a series of log files that are running on the server for all of the apps running on it that are filling up with Exchange/SQL being the largest culprits...

You can go in and change where the tranlog files backup by going into SQL enterprise manager, right clicking on the database and selecting properties. Once there, click on the tab that reads "Transaction Log" and change the location. Also, you can set up a maintenance task to regularly backup the transaction log file so your drive does not fill up as fast. This should also be placed on the larger drive as it can take up a bit of space depending on how active the drive is. If you have any questions to more specific details, refer to the Books Online (a very good resource for SQL Server).

Hope this helps!
Hi Revelation,

I was talking about Excahnge. Microsoft recommends to never delete the transaction log files, and i agree with them. It's easy to delete the wrong files if you don't know what exchange is doing... ;)


okay.. that was my misunderstanding... I thought you were referring to the SQL files ;)
I don't know anything about SQL. Just let me talk about Exchange, and i kind a know what i'm doing... ;)
Don't think anyone touched on expanding the space, so I will throw this into the mix..  For a server, you will need VolumeManager, instead of Partition Magic, which is primarily for stand alone systems (No Raid)

Symantec VolumeManager

http://enterprisesecurity.symantec.com/products/products.cfm?ProductID=345&EID=0

Other than that, it looks like you have your answers above..

FE

Avatar of paragkshah
paragkshah

ASKER

Hi,

Thank you all of you guys for your very quick response. As you told me I have checked E2k and SQLs logs' and the result are as under :

E2K: There is just one tras. log E00*.* because it has circular logging. and i have been checking my mdbdata folder and that is constant 1.38 GB since last so many days. Is there any other place other tras. logs are filled up ?

SQL : Here the tras. logs are also on D drive and not on C drive. its about 50 MB.

About changing the pagefile location I am not sure. Since this is a production server I have to be very carefull and I have no idea what can be the consequences after changing the pagefile location. any other idea.

I have seen one file tha is added daily and that is c:\winnt\system32\W3svc\ folder and everyday one new file is created and that takes about 50-200 KB of space. Other than this I am not sure which are the other log files stored for Windows 2000 server itself. Let me know which other locations I should check for the logfiles of DHCP, DNS , HTTP(Though, these are installed on my server, are not in heavy use. DHCP to the users is provided by my firewall...). I think event viewer has just fix 512KB file for each section log. right? let me know.

PS
Hi,

Is proxy installed on this server??? Looks like these are the IIS loggings (w3svc). Can you please post how the filenames are named???
the w3svc folders are typically your log files for IIS services (FTP, WWW, SMTP, ETC). You should have a folder for each "site" that is running. If they are not of heavy use, they wouldnt be the issue. Changing the pagefile location shouldnt be a problem provided you create the pagefile on the d drive first before you remove the second one. I cant remember off hand but you might need to reboot in order for it to take effects (someone help me on this one, my brain is shot after a long week last week with DR). I would take a look at any maintenance jobs you have running for SQL just to make sure they arnt creating logs or backing up ont he C drive... Also, you could detach and move the database over to the D drive if you have plenty of room over there, that depends on how comfortable you would be with the process and if you have room. Typically, whenever I am working with servers, I try to keep the data on a seperate drive from the C drive (OS/programs only, no data). The option FE passed along would work, provided you have the ability to add on another HD. Does this server use IDE drives or SCSI drives? Also, is it a RAID setup or basic standard drives?
ASKER CERTIFIED SOLUTION
Avatar of rhandels
rhandels
Flag of Netherlands image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Revelation..  he is running a RAID 5 array here..  assume it is SCSI...

Are you using Auditing on the server..?   If so, it may not be necessary....

FE
thanks FE, missed that when I was rereading the whole string. If you are using raids, you could just add in another drive to your RAID 5 array and then add the space on via the WINDOWS 2000 Disk Manager if the C drive was set up as a dynamic disk. Once the drive is added to the array and rebuilt, it should show up as extra unpartitioned space in the Disk Manager. Once it appears here, you should be able to add it to any of the dynamic disks. We have done this several times on several of our servers without any issues.
I am using SCSI RAID 5. I don't have any slot to add another harddrive ( 5 disk and one extra disc in case one of them fails)  on my server but I do have plenty of space on my D drive.

The exact location,filename and size of W3svc folder are  c:\winnt\system32\logfiles\w3svc1\ folder. file name format is "ex040425.log" , that means ex followed by year,month and date and the size starts from 6 kb to 293 kb. the very first file was 6 kb and after that it has been increasing everyday and the last file created was 293 kb ( yesterday's) . and the whole folder was about 2 MB maximum.

I will check other folders and audit policies( I guess its not configured but I will see agian) and let you know within 2-3 hours.

PS
Do you have Veritas or another backup program running on this server? They can create large lo files...
also that EX log is an IIS log
You can setup paramters to clean it as well as how much should be saved as well...

here is the link

http://support.microsoft.com/default.aspx?scid=kb;en-us;300390

Another thing to look at is your event viewer logs....this is often overlooked and these have a habit of growing rapidly especially when you have that many services running on one box...

:)

dawne
Hi everyone,

I have found some of the other logfiles which are definitely filling up my harddrive space drastically. As rhandels suggested me I have checked c:\winnt\temp folder and I have found some of the files and folders which are taking lot of spaces and I have no idea what those log file are and what for. Here is the list :

I have several folders named "wfv*"( where * is the hexadecimal number.starts from wfv2 and the latest is wfv35) and they fill 8-10 MB of space. I have almost 35-40 folders of that name and they create once every 3-4 days. the have below files :

IIS_3tier  - GIF image ( several GIF images)
IIS_401-1 - HTML coument  -- about 4 KB and almost (1200 files)

Besides these folders I have several other files which are described below :

LB*.tmp  - 256 KB ( 3-4 a day) (LB1 - LB4DF latest )
eng*.tm - 0 KB ( once every 3-4 day)
~DF*.tmp
~RM*.TMP
SCS*.tmp
mso*.tmp

Here, * is hexadecimal number... and they are in bunch.

Besides above files there were some logfiles for the setup of softwares(for instance sqlsetup). What are these log file for? If anyone needs more detail info just let me know...

sorry for the wired description of files but I don't know about those files and I want to let you know in detail..

PS
Are you running  and using OWA?
Yeah I am running OWA also but the usage is rare. almost .1%  but I have to run it.

I am also running backup program but I have checked the log files of that program and those are not very big.

Someone has suggested me to delete unused profile on server. I have one user's profile that is unused and its about 5 MB. Can I directly delete the user's folder from the Doc. & settings folder? Moreover All Users profile is also very big about 55 MB. Is it advisable to delete some of the files from that profile. if yes then which files?


Rhandle, Internet's temp files were also deleted( Actually when I deleted those files it gave me 30 MB of free disk  was used by the recent Windows update program). Moreover proxy is not installed on my server.

PS
Is your SQL server agent running?  If it isn't, SQL server will run fine but all of your automated jobs like backups won't run and things like your transaction log files will continue to grow until its backed up and gets truncated.  By default when you stop the SQL server service, SQL server agent is not set to restart when you restart the service.
Hi Paragkskah,

Nice to know i still know where Microsoft keeps it's rubbish ;)
About the user profiles you have. 55 Mb per profile is a lot. You can use GPO and set the maximum amount of the user profile. We set up the profile to be max 12,5 Mb. The problem with Mickeysoft profiles is that the keep the temp internet files in them. There is also a GPO option where you can set which folders shouldn't be set in the profile. If the profiles are roaming, you also have the problem that al users, when they log in, they transport 55 Mb over the network and you network doesn't like that one...

You can find the profile option in the GPO by:

User Configuration --> Administrative Templates --> User profiles

For as far as the winnt\temp folder. As the folders name allready states, this is a TEMPorary folder. All files in this folder are temporary. If you have the time, i'd reboot the server, and after the reboot try to delete all files that end with *.tmp, these are temp files. And by rebooting you can make sure that the .tmp files aren't used anymore.

Please let me know if it works??
rh...  Just thought I would amend your GPO location for profile size..  :)

In W2K it is located here in ADUC/GPO

User Configuration --> Administrative Templates --> System --> Logon/Logoff --> Limit Profile Size

FE

(I believe in W2K3 it is:   User Configuration --> Administrative Templates --> System -->  User Profiles...)
Hi Fatal_Exception,

You're right. I looked it up on my own server and we are using W2K3. So, Fatal Exception is right with the GPO profile size...
yea..  you know how MS loves to change things and make us hunt them down....   Gotta love it..  :)
Hi,

O.k. I can reboot my server tomorrow. But let me make sure the steps you have suggested me.

1. Firstly I reboot the server ( at that time temp folder still occupies 250 MB)
2. After reboot I will delete all *.tmp files ( temp folder at that time will occupy about 30-40 MB)
3. After that do I have to reboot again just to make sure no temp files are generated ?

Now regarding profile, I have one user's profile(previous administrator's)  that we are never gonna use so can I delete that folder first?

And now if I configure GP to set user profile 12.5 MB then it might give me error becuase All User's profile is 55 MB or it might give me warning every 15 minutes....so how and what to delete from that profile...

By the way c drive space decreases by 3 MB today. Latest files with the name LB*.tmp filled up 1MB of space and I am still looking for the other files...

PS
Hi PS.

Yes, reboot the server and then delete the temp files. You don't have to reboot the server after this. *.tmp files will always be made, but if they are made, then you shouldn't delete them.

About the profiles.

Yes, you can delete the profile that never is used on the server. Nothing strange will happen. Only thing you shouldn't remove is the user you are currently logged in with, the default user profile and the all user profile.

The other thing, yes, isn't it lovelly when everybody starts to call you that there profile is to large.... ;)
I'd go for the Temporary Internet Files and TEMP files. But you will need to search for them, Microsoft has it's way with profiles. They always seem to put different files and folders in different places.. :) Make sure to let you explorer see all files, also the hidden files...
Thanks a lot. I'll search more info on profiles. I will give you feedback.

PS
Hi all,

Finally I cleared out my c:\winnt\temp folder and that freed up about quarter GB( I know its a lot so now I will clear that folder regularly) of disk space but my OS or some application still create some log files somewhere else in amount of MB so I have to watch carefully. but the major role was from this temp folder. Thanks Ray.

I have two more questions. One is related to this and the other one is related to this but can be a seprate thread(thats what I think, for you people it might be a routine question asked from novice)
1. There are 9-10 files( about 25 MB) in temp folder which are read only files. What should we do with those files? should I delete them? File names are "OLD1", "OLD2" and so on and those are also tmp files.
2. sometimes my os behaves very strangely( in the morning time) it reduces the C drive space drastically and goes down to 0 kb in size( my heartbeats go to the maximum count)  and then comes back to the original size. what can be reason for that. Now I suspect that its related to my mcfee av becuase I am doing automatic system scan thrice a week in the morning about 4 a.m. but I didn't get any clue for the relation between the above problem and mcfee. I have seen eventviewr, scan activity logs and nothing described in that also so what can be the reason with this problem ?

PS
Hi PS.

Nice to know that this, kind of'fixed your problem. Here are my answers to your two qeustions.

1. Yes you can. The names OLD1 and OLD2 are kinda like the giveaways. Normally everything in this folder can be deleted if your server or pc doesn't have any program or installation open. Temp files are mostly used for installation of programs (to temporarely set the files on the disk) or for programs that are being used (for the same purpose).

2. For as far as i can see it, this is what happens. At the morning, a lot of users log in. Therefore the SWAP file becomes larger. If you made a minimun and maximum SWAP file setting, than this could be the problem. You can change the swap file location (this also frees up some space on your c drive.

1. Click on the Windows key and Pause/Break key (system properties opens)
2. On system Properties, choose Advanced
3. Go to (or choose) performance settings
4. Depending on 2000 or 2003, go to the size of the Virtual Memory.

Make sure to set the virtual memory small enough so it fits on your HD, and large enough to make sure performance isn't downgraded...

Hope this helps a bit. Otherwise i think you should make a new thread for the other problem.
Hi,

Actually  Ray very few users( about 3-4) log on in the morning upto 8 a.m but as you told, I have gathered some of the info about my server.

paging file size for selective drive c:

space available : 5407 MB ( I didn't understand this . actual space avilable is just 1.27GB now)
initial size : 4095MB
Max. size :  4095MB

Total paging file ize for all drives

minimum allowed : 2MB
Recommended     : 3070MB
currently allocated: 4095MB

registry size
current reg. size : 21MB
Max. reg. size    : 114MB

Now, what should I do? on my D drive almost 30 GB is available but that is my data drive as well as network drive which is shared by all the users.. whats your suggestion?

Now, regarding temp files,I have seen a file which is in all users, documents, Dr. watson directory, two files drwatson.txt(2MB) and user.dmp(25MB) are updating daily. what are those file for? can I delete the folder temp( not temp internet files) in my profile?

PS

p.s. -- I am considering more points for this thread now as I have asked one more question and still asking questions for the old one. Thanks for your patient and cooperation.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Yes..  I too would reduce the system partition page file size...   I use the size = amount of RAM for the root PF size, as this allows a memory dump if things go south on you..

Other than that, this is my only recommendation..

FE
Hi SP,

JammyPak is right about the page file, this would be my first suggestions also. Split the page file. Also, you can make the max reg size a bit smaller (something like 30 Mb) If you set it like this, then the register will allocate the space and you might need it.

About the temp folder in your profile, don't delete the folder, but delete the files in it. The folder doesn't take up that much space. The files in the folder do.

drwatson.txt probably will be some kind of dump on a program fault. drwatson is a integrated problem solver (never solves anything, but looks like it). This file will most likely contain the errors, so you can delete it.

Here's a EE thread about the user.dmp file and also about Dr. Watson
https://www.experts-exchange.com/questions/10218436/User-dmp-file.html


also, take a look to see if you have a "Memory.dmp" file in your c:\winnt folder.. if the system crashed and restored on its own it is possible there is a large dmp file out there outside of the usr.dmp file to look at...
Hi all.

I am having the same issues as PS's original post - HD space filling up.  I have noticed the same wfv directories in the c:\Winnt\Temp directory.  Files contained in these directories are not .tmp files, and they appear to be more or less the same files from directory to directory.  The modified dates of the files in the wfv directories seem to correspond to backups that I am running. They also seem to be misc system files and drivers.  This box is an Exchange 2000 server on Win2K server also running OWA.  No SQL and not a DC.  I am running Veritas 9.0 from another box w/ the Exchange agent on this box.  Does anyone know what these wfv directories are?  I can't find any reference to them at Veritas, or through MS.  I am temped to remove them, but although they are in the temp directory, they are not .tmp files.

Any ideas based on what has been thrown out so far?
Thanks in advance!
MG
Hi MG,

Same thing here. This files are piled up after my backup starts everyday and around 10 MB big folders. Most of files are iis_401-1 kind of html files.(around 1000s 4kb files) + some GIF files + some ASP files.  I am using another backup program and couldn't find any reference from my backup software vendor or MS too. Those are wfv folders but as RH suggested I have deleted all the folders from temp directory( actually copied to another drive in case something happens). So any thoughts based on this ?

Now I have decided to move my half pagefile to D drive after enough reading. so what are the steps to do that? Actually verify my steps below and give me suggestions if I am doing anything wrong.

First I will  set the pagefile for D drive :
min. size  : 2 MB
initial size : 2000 MB
Max. size  : 2000 MB
and then change the C drive pagefile

initial size : 2195 MB
Max. size  : 2195 MB

after that I have to restart the server. Are the above steps are right?

PS

PS
Hi there,

You guyes have a lot of questions....

PS, because you started this post, i will go into that question...
Yes, the thing stated above is coorect. First make sure to add a pagefile to d by selecting the d drive and then putting in the start en max values. After that click the set button. And do the same with the c drive. Then you'r in the clear for the 2 Gb on the c drive.

But make sure to have your pagefile on c as big as your internal memeory, else the server cannot make a system dump if something goes wrong.

Second. The iis 40x files are Internet Informations Services files. If someone tries to access your server with a browser and some connection goes wrong, then these files are used. You can delete them. They are also placed in the c:\inetpub\wwwroot directory. But your option to move the files to another idrectory is even better. Then you can go back if soemthing goes wrong, nice one....
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
This question needs to be closed out, unless you have a reason to leave it open.  If you would, please accept one of the experts comments, or split the points if more than one expert helped you.  If you do not know how to do this, please go here for help:

How do I close a question?
https://www.experts-exchange.com/Community_Support/help.jsp#hi9

Closing Questions
https://www.experts-exchange.com/Community_Support/help.jsp#hs5

Thanks,

FE
Hi all,

Thank you very much for your time to slove the above problem. Its a big help. Well, the C drive was under observation for its space utilization. Its now highly stabilize. Well to distribute points I have to increase the points too.

I accept the answer from Ray for his suggestion to clear out the temp files from c:\winnt\temp folder. The files in that folder were the main culprit becuase they were using almost .5 Gb of space unnecessarily. Thanks Ray. 250 points

I also agree with JammyPak's suggestion to split the pagefile in two drives. so I give him 50 points too.

And last but not the least I higly appreciate Mgremmert for his suggestions to solve the problem of  " wfv*" folders and workaround for that problem. Let me tell you all that My Antivirus program scans all the files( while writing and reading). Now when the backup program starts AV scans the file and then the file backed up. And AV scans the .cab file and backup backs up that .cab file and the " Wfv##" folder creates in winnt\temp directory at that time. so I am not backuping up that file and no folders are created in temp directory. I also tried not to scan file while reading and that worked too but I chose the first option not to backup .cab file. Thanks Mgremmert for this wonderful suggestion. 100 points.

Parag Shah