?
Solved

Mysterious .tmp files keep appearing on a WinNT4 Server

Posted on 2006-06-07
20
Medium Priority
?
471 Views
Last Modified: 2013-12-23
Using Win NT4 Server SP6
I keep getting mysterious .tmp files showing up in the winnt directory.

The files are,

GLM~0000.tmp
GLM~0001.tmp
GLM~0002.tmp and on and on

About a dozen a day appear,
Over a hundred was there....

I Deleted them all!!
And they keep coming back????

The files are about 700k each.
Anyone got any Ideas????
Should I be worried??
Should I be VERY Worried?????
0
Comment
Question by:xman43r
  • 6
  • 6
  • 3
  • +2
18 Comments
 
LVL 13

Accepted Solution

by:
hstiles earned 500 total points
ID: 16868882
do the files all appear at the same time?  Are there are processes/applications running on your server?  If so, do the times of these scheduled processes co-incide with the times the files appear?
0
 
LVL 88

Assisted Solution

by:rindi
rindi earned 500 total points
ID: 16870665
Download the latest version of HijackThis

http://www.hijackthis.de

(Click on the „Directdownload“ link).

run it and save the log. Paste the log to the following website

http://www.hijackthis.de/en

Follow the following exactly:

At the bottom of the page you'll see a "ANALYZE" button. Click it and you will have an analysis of your log. Now a new button, "SAVE ANALYSIS" will show up at the bottom. Your analyzed log will be saved to a page on that homepage, of which you can post the URL here. I should then be able to see if there is any software causing problems.
0
 
LVL 37

Assisted Solution

by:bbao
bbao earned 500 total points
ID: 16873026
you may download and run Filemon for Windows of Sysinternals to watch which process is generating the .tmp files.
http://www.sysinternals.com/Utilities/Filemon.html
0
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

 

Author Comment

by:xman43r
ID: 16913864
Ran Hijack, here is the log file:

http://www.hijackthis.de/logfiles/3ffa012dd62da204d98e51b836a9edac.html

Also ran Filemon and discovered that  spoolss.exe is the process that
is creating the .tmp files.

I am guessing that this is part of the print spooler??
If so, why are the .tmp files not being deleted??
Do I need to change some settings??
0
 
LVL 88

Expert Comment

by:rindi
ID: 16914459
Use hijackthis to remove those entries which are market as "nasty", then reboot and rerun hijackthis to make sure they are removed, and then monitor the server again to see if the files keep on emerging.
0
 

Author Comment

by:xman43r
ID: 16936245
Ran Hijackthis and removed ALL Nasty Stuff...

Rebooted server.

Temp files are still appearing.......
0
 
LVL 37

Expert Comment

by:bbao
ID: 16939494
is it the same server sharing for DOS programs?
0
 

Author Comment

by:xman43r
ID: 16939505
Yes sir ree,

Running a DOS accounting program off of this server.
0
 
LVL 8

Assisted Solution

by:H
H earned 500 total points
ID: 16992616
I think program will help you figure out were there coming from....


http://www.sysinternals.com/Utilities/Filemon.html


Also the rest of the utilities on this sight are great especially process XP....
0
 
LVL 8

Expert Comment

by:H
ID: 16992748
Do you have any Backup programs like veritas Backup exec running on there...Or symantec products...Ive seen them create temp files with GLM in the name...

Group Lock Manager(GLM)  is used in some Veritas backup programs....
0
 

Author Comment

by:xman43r
ID: 16997153
I used Filemon for windows, the temp files are coming from spoolss.exe

They seem to be print jobs.

I just don't know why they are not being deleted???
0
 
LVL 8

Expert Comment

by:H
ID: 17001081
spoolss.exe is a process belonging to the Microsoft Windows operating system. This process deals with the printing process from disk to local printer. This program is important for the stable and secure running of your computer and should not be terminated.

One fisrt guess is those files are creaated whenever you login to the windows server.  Are you on a domain with login scripts?  Do the login scripts automatically try and set or connect you to a default network printer.  Check in the server event manager.  Do you see events realted to login and printer connections?  Like a message from TerservDevices...staing printer cannot be installed?
0
 
LVL 8

Expert Comment

by:H
ID: 17001145
Also we need to keep in mind.  Just becuase the spooler process is useing those files or locking them doesnt mean its being created by the spooler process..  


Did you see my other response above also?
Do you have any Backup programs like veritas Backup exec running on there
Group Lock Manager(GLM)  is used in some Veritas backup programs....
0
 

Author Comment

by:xman43r
ID: 17003990
There are NO login scripts, the workstations just capture
a printer port  for sending print jobs.

Not useing any backup programs on the server.

Do all backups manually and take offsite.

I do print to a Xerox Workcentre XD100 copier/printer.
This uses Xerox's software to emulate a HP laser printer.

Also use a program called Reform, this takes text files and
adds graphics to print Invoices and such.

I just deleted about 50 temp files and all but 3 were created
in the afternoon around 4 to 6pm.

These temp files don't seem to be causing any problems, they
just start taking up a lot of space if I don't delete them on a
regular basis.
Only 3 were in the morning at 9am.
 
So the problem is not happening during login.
0
 
LVL 8

Expert Comment

by:H
ID: 17004403
Sounds to me that one of those programs you mentioned are creating the temp files and the programs were not written to clean up after themselfs.  You can always schedule a script to automatically delete them at a scheduled time...  I can help you write one if you dont already know how...
0
 
LVL 37

Expert Comment

by:bbao
ID: 17028926
have you ever tried to print a test page and monitor if the strange temp files still appear at the same time? if they do, i think it should be a printer driver depended issue. moreover, please also post the content of the test page here, it may give the basic driver information as well as those such as data format, which might be helpful for diagnosis.

hope it helps,
bbao
0
 
LVL 8

Expert Comment

by:H
ID: 17192288
Well I spent some time researching this with the author...I should at least get a couple points..
0
 

Author Comment

by:xman43r
ID: 17193276
Thanks to all who responed! I also think everyone should get the points. All hints were valid, its just that none actually solved the problem. So Keith, everyone helped, so lets award some points!
0

Featured Post

Upgrade your Question Security!

Add Premium security features to your question to ensure its privacy or anonymity. Learn more about your ability to control Question Security today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Enterprise networks where VoIP phones have been deployed frequently use port configurations that allow both a computer and an IP phone to be plugged into the same switch port but use different VLANs. On Cisco equipment I'm referring to the "native V…
Trying to figure out group policy inheritance and which settings apply where can be a chore.  Here's a very simple summary I've written which might help.  Keep in mind, this is just a high-level conceptual overview where I try to avoid getting bogge…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question