[Last Call] Learn how to a build a cloud-first strategyRegister Now


Urgent: Losing disk space before my eyes

Posted on 2005-04-06
Medium Priority
Last Modified: 2009-12-16
My server is losing GBs of disk space within minutes without explanation. I have got several websites running on it and just deleted 6GB of log files, yet within 5 minutes the space was reduced to 0KB.

Something's chewing up space like mad and it started a day ago. I searched all folders and checked file-sizes: they seem to be normal.

I stopped Disk Cleanup and uninstalled Recovery Bin - no results.

Thanks for the help!
Question by:andreas_boehmer
  • 2
LVL 97

Assisted Solution

by:Lee W, MVP
Lee W, MVP earned 600 total points
ID: 13722672
I would suggest using DirUse ( http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/diruse-o.asp ) to get an idea of what folders use up what space (looking through explorer might hide things).  Then you should be able to figure out what is using your space.

Expert Comment

ID: 13723406
Although I think there's something else to your problem, you might want to try this link as a first attempt



Accepted Solution

vinil earned 900 total points
ID: 13723507
First let's determine what's causing the writes. Once we have the cause then we can come up with the remedy.

*This reply will address only the what part*

The simple way first.
Start Task Manager, go into Processes tab, View->Select Columns..., Check I/O Writes
Click OK, come back to the Processes tab, there sort the view on I/O Writes Descending.

If the maximum I/O writes are attributed to either Services.exe or svchost.exe, then we need to find out which service running under those parent processes are consuming the disk. For that download ProcExpNT (also DiskMon and FileMon) from http://www.sysinternals.com/ntw2k/utilities.shtml

Unzip ProcexpNT.exe from the zip and start it. The same process that we did with Task Manager has to be repeated here. View->Select Columns…Process Performance Tab, Check I/O Writes.
Select OK, come back to the process list view and sort descending on I/O Writes. Rt Click on the process that’s consuming max. I/O and select Properties. Click on Services tab which will list the services which are running under that process.

To give you a hint of what could be causing those writes, here are some pointers.

1. NT Pagefile, if there is a lot of thrashing happening, because of some process going over-board with memory consumption, combined with a fragmented harddisk, expect to see a lot of disk activity, especially if the size of the pagefile is not limited. (But I doubt if the disk size would decrease to 0)
2. IIS Logging, Plausible since you have mentioned that this particular machine is being used as a web server.
3. EventLog service. Unless you have set filters on what information you want to log, this service is an I/O hog logging every event into the log. Check in the Local Security Policy and if necessary in the Group Security Policy to determine the right level of logging
4. SQL Server Logging. With constant db activity, its probable that the recovery log can go beyond a few GBS (a few days ago, my friend found that his web server running a front end to the company ERP came down to a few kilobytes of free disk space. The culprit was the recovery log which had bloated to 65GB rendering the server slow and useless)
5. Another possibility, Malware. Its highly probable that you might have a virus infection
6. Then there is the possiblity of Distributed File System or Share replication being abused.

As I said, first lets find out whats causing the writes, so do let us know what ProcExpNT shows.
Best regards,

Author Comment

ID: 13724874
Hi guys, both answers helped me solve the problem - it was still a problem caused by the recovery bin, although I had undeleted it. I could find it in the processes and DirUse showed me where the space went.


Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question