[Last Call] Learn how to a build a cloud-first strategyRegister Now


%system%\temp\Gthrsvc folder filling up hard drive

Posted on 2007-07-29
Medium Priority
Last Modified: 2013-11-22
Hi all,

I have a problem with an exchange 2003 server which has it's C: drive maxxing out due to a folder- Windows\Temp\gthrsvc filling up with all sorts of junk each morning (usually around 4-5am).

This problem pretty much matches this one here-

Sophos MailMonitor and Sophos AV are installed and I have added the gthrsvc folder as an exception (it was not previously), however this problem still remains.
Veritas backup is also installed but does not do a backup of anything on the C: drive at all (exchange is storing onto a different partition)

Unfortunately I'm asking you guys because I have no access to sophos support.

I realise this is usually down to file indexing and a virus scanner scanning this folder, win2k did have a problem with this and a hotfix was available but not for 2003.

Is there any way to force sophos to stop scanning this folder other than using the enterprise console?
(perhaps by changing permissions on this folder- I'm worried what permissions would be needed though for normal operation)
I ask this because sophos is plainly not applying policy correctly!
Is it a good idea to disable indexing as a temporary measure to cure the symptoms while this is resolved- what effect would this have and how is this done?

I'm not that keen on sophos (or symantec for that matter) if I had my way I'd use NOD32...alas it's not up to me :)

Question by:Gonkster
  • 5
  • 3
LVL 23

Expert Comment

by:Stacy Spear
ID: 19588007
Sophos has a faster response rate than any other vender, I would keep them. What are the extensions on the files in that folder? I am wondering if it not log files from your SMTP service or something.


Author Comment

ID: 19588026
Hi Darkstar,

At the moment there are just two files- Ntf2.tmp and Ntf3.tmp which are always seem to be in-use.
I've logged in earlier in the morning and deleted all the other files (had no choice here as the drive was full), supposedly the search service should intermittently pop files in here but then delete them shortly afterwards.

I can tell you from memory that the vast majority were .eml files. If I remember rightly a few .doc and excel files.
LVL 23

Expert Comment

by:Stacy Spear
ID: 19588036
.eml files are emails.

If you disable Sophos temporarily, does any files show up there?
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.


Author Comment

ID: 19588097
A fair question!
I've already asked if I could do just this, but been told that this is a no no.

I'll ask again and point out that this is quite a reasonable thing to do for test purposes, makes sense to me anyway :)

I'll just add a note here to make things clear- the files only show up in the wee small hours- no doubt when a scheduled scan is run, after deleting these files in the morning there are no problems until the following day and no files show up in that folder until then apart from those two ntf.tmp files mentioned above.

I won't be able to get back to you about this until 31st July ...that's providing I do get permission on the 30th to disable it overnight.

Author Comment

ID: 19595658
I've disabled sophos tonight, will know for sure tomorrow.
LVL 23

Expert Comment

by:Stacy Spear
ID: 19595991
Also, as these are emails, perhaps there is something else simular about them. So instead of deleting them if they reappear, move them somewhere and save them for analysis. They should compress pretty good if you are short of space.

Author Comment

ID: 19598748
They're just indexed emails left there by the indexing service, they should not remain there however, afaik the indexing service should delete these temporary files.

After logging in this morning, the files were still there even after sophos was disabled, so we can count out virus scanning and any backup software from locking files in use there etc.

As per http://support.microsoft.com/kb/812387/en-us there's a hotfix for this on win2k quite some time ago, nothing about 2003 having this trouble as far as I can tell.

Accepted Solution

krazy1ox earned 1000 total points
ID: 20610889
Gonkster I have a fix for you which I just ran myself and it has done the trick.

The following steps were gotten from the "Exchange Server 2003: Resource Kit" book. The steps will relocate the temp file location store for the MSSearch program which is doing the Full-Text Indexing.

1. Creat a folder in another drive with plenty of space called temp (d:\temp).
2. Run SetTmpPath.vbs which is located in Program Files\Common Files\System\MSSearch\Bin in a cmd window.
                         "SetTmpPath d:\temp"

You will then getfeed back which reads
          Setting temp path for mssearch to d:\temp

Your files will automatically dissapear from the gthrsvc folder, and the gthrsvc folder will automatically appear in the D:\temp folder.

Hope this helps you,
Best of Luck

Author Closing Comment

ID: 31407564
Well done Brian, this works!

Featured Post

Restore individual SQL databases with ease

Veeam Explorer for Microsoft SQL Server delivers an easy-to-use, wizard-driven interface for restoring your databases from a backup. No expert SQL background required. Web interface provides a complete view of all available SQL databases to simplify the recovery of lost database

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are like me and like multiple layers of protection, read on!
In this post, I will showcase the steps for how to create groups in Office 365. Office 365 groups allow for ease of flexibility and collaboration between staff members.
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Suggested Courses

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question