Urgent: Losing disk space before my eyes

Posted on 2005-04-06
Last Modified: 2009-12-16
My server is losing GBs of disk space within minutes without explanation. I have got several websites running on it and just deleted 6GB of log files, yet within 5 minutes the space was reduced to 0KB.

Something's chewing up space like mad and it started a day ago. I searched all folders and checked file-sizes: they seem to be normal.

I stopped Disk Cleanup and uninstalled Recovery Bin - no results.

Thanks for the help!
Question by:andreas_boehmer
    LVL 95

    Assisted Solution

    by:Lee W, MVP
    I would suggest using DirUse ( ) to get an idea of what folders use up what space (looking through explorer might hide things).  Then you should be able to figure out what is using your space.
    LVL 2

    Expert Comment

    Although I think there's something else to your problem, you might want to try this link as a first attempt

    LVL 2

    Accepted Solution

    First let's determine what's causing the writes. Once we have the cause then we can come up with the remedy.

    *This reply will address only the what part*

    The simple way first.
    Start Task Manager, go into Processes tab, View->Select Columns..., Check I/O Writes
    Click OK, come back to the Processes tab, there sort the view on I/O Writes Descending.

    If the maximum I/O writes are attributed to either Services.exe or svchost.exe, then we need to find out which service running under those parent processes are consuming the disk. For that download ProcExpNT (also DiskMon and FileMon) from

    Unzip ProcexpNT.exe from the zip and start it. The same process that we did with Task Manager has to be repeated here. View->Select Columns…Process Performance Tab, Check I/O Writes.
    Select OK, come back to the process list view and sort descending on I/O Writes. Rt Click on the process that’s consuming max. I/O and select Properties. Click on Services tab which will list the services which are running under that process.

    To give you a hint of what could be causing those writes, here are some pointers.

    1. NT Pagefile, if there is a lot of thrashing happening, because of some process going over-board with memory consumption, combined with a fragmented harddisk, expect to see a lot of disk activity, especially if the size of the pagefile is not limited. (But I doubt if the disk size would decrease to 0)
    2. IIS Logging, Plausible since you have mentioned that this particular machine is being used as a web server.
    3. EventLog service. Unless you have set filters on what information you want to log, this service is an I/O hog logging every event into the log. Check in the Local Security Policy and if necessary in the Group Security Policy to determine the right level of logging
    4. SQL Server Logging. With constant db activity, its probable that the recovery log can go beyond a few GBS (a few days ago, my friend found that his web server running a front end to the company ERP came down to a few kilobytes of free disk space. The culprit was the recovery log which had bloated to 65GB rendering the server slow and useless)
    5. Another possibility, Malware. Its highly probable that you might have a virus infection
    6. Then there is the possiblity of Distributed File System or Share replication being abused.

    As I said, first lets find out whats causing the writes, so do let us know what ProcExpNT shows.
    Best regards,

    Author Comment

    Hi guys, both answers helped me solve the problem - it was still a problem caused by the recovery bin, although I had undeleted it. I could find it in the processes and DirUse showed me where the space went.


    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    It is a known fact that servers reach the end of their lives. Some get there quicker than others, based on age, manufacturer, usage and several other factors. However, if your organization has spent time deploying Microsoft's Active Directory server…
    by Batuhan Cetin Within the dynamic life of an IT administrator, we hold many information in our minds like user names, passwords, IDs, phone numbers, incomes, service tags, bills and the order from our wives to buy milk when coming back to home.…
    how to add IIS SMTP to handle application/Scanner relays into office 365.
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now