User Temp folder is running full
Hello there,
we´re facing a strange problem. On some Windows XP machines, clean install with SP2 or SP3, Office 2003 SP3 or Office 2007 (without any SP installed) the user temp folder is running full of files. After a few hours or days the temp folder is full and every App that uses files based on the oledocument-format refuses to work. After deleting the temp files everything goes well.
I could "fix" the problem by scheduling deletes of the users temp folder, but that doesn´t seem to be a solution.
Apps installed:
Windows XP SP2 or SP3
Adobe Reader 7 or 8
Office 2003 SP3 or Office 2007, Outlook, Word, Excel, PowerPoint, Access (only 2003)
Avira Antivirus, Version 8
I tried to work normally with the computers, and there seemed to be no problem. What gives me the creeps: Most of the systems were working correctly for month.
Scanning for viruses, trojans or malware didn´t brought any news. We tried Trend Micro PC Cilling, Avira Antivirus, Symantec Products, HijackThis, AdAware, ... and so on.
Hope that anyone has an idea, because this problem seems to spread, why I first thought, it would be a virus.
we´re facing a strange problem. On some Windows XP machines, clean install with SP2 or SP3, Office 2003 SP3 or Office 2007 (without any SP installed) the user temp folder is running full of files. After a few hours or days the temp folder is full and every App that uses files based on the oledocument-format refuses to work. After deleting the temp files everything goes well.
I could "fix" the problem by scheduling deletes of the users temp folder, but that doesn´t seem to be a solution.
Apps installed:
Windows XP SP2 or SP3
Adobe Reader 7 or 8
Office 2003 SP3 or Office 2007, Outlook, Word, Excel, PowerPoint, Access (only 2003)
Avira Antivirus, Version 8
I tried to work normally with the computers, and there seemed to be no problem. What gives me the creeps: Most of the systems were working correctly for month.
Scanning for viruses, trojans or malware didn´t brought any news. We tried Trend Micro PC Cilling, Avira Antivirus, Symantec Products, HijackThis, AdAware, ... and so on.
Hope that anyone has an idea, because this problem seems to spread, why I first thought, it would be a virus.
ASKER
Thanks for your comment.
The Files are like ~wk3434.tmp - typically created files by Office or other apps. There are a few more, as soon as I´m in the office, I´ll start checking for a pattern. I´ll add my resuluts tomorrow.
But as I said in the question I have used adaware and such software, without any result. That was the first thing we did.
Trying to reinstall the systems did not bring any cure. On 2 systems the error occurs after installing the basics (OS, Office) - without having connection to the internet. Only Windows, Office, some other apps are installed.
One of my clients reported the same problem a few minutes ago. In the temp-folder are over 64000 files (the max it can take), afterwards all apps relying to the oledocument-format can not create nor open files.
Typically this results in a very slow response by Office-Programs (and ours), before throwing error messages. The result is a MFC-Comment, that the temporary file, that should be created, already exists. That is nonsense and comes only because the temp-folder is full. Why it takes so long is because Windows, which provides the oledocument-format, tries 64k combinations for creating a unique temp-file for the app (or document). Because it cannot due to system limitations in files in the folder, it´s getting the odd message that the file already exists.
When I work normally with the systems, the temp-files seem to keep stable - nothing bad happens, only a few files stay resident after closing some apps. These apps show the same behaviour on systems that don´t have any problems, so I guess they aren´t the real problem.
Currently I´m trying to let the machine run for a day without doing anything, then checking the filecount in the user-temp-folder. In case this comes of a tumbling windows-service, I´d be able to look in this direction...
The Files are like ~wk3434.tmp - typically created files by Office or other apps. There are a few more, as soon as I´m in the office, I´ll start checking for a pattern. I´ll add my resuluts tomorrow.
But as I said in the question I have used adaware and such software, without any result. That was the first thing we did.
Trying to reinstall the systems did not bring any cure. On 2 systems the error occurs after installing the basics (OS, Office) - without having connection to the internet. Only Windows, Office, some other apps are installed.
One of my clients reported the same problem a few minutes ago. In the temp-folder are over 64000 files (the max it can take), afterwards all apps relying to the oledocument-format can not create nor open files.
Typically this results in a very slow response by Office-Programs (and ours), before throwing error messages. The result is a MFC-Comment, that the temporary file, that should be created, already exists. That is nonsense and comes only because the temp-folder is full. Why it takes so long is because Windows, which provides the oledocument-format, tries 64k combinations for creating a unique temp-file for the app (or document). Because it cannot due to system limitations in files in the folder, it´s getting the odd message that the file already exists.
When I work normally with the systems, the temp-files seem to keep stable - nothing bad happens, only a few files stay resident after closing some apps. These apps show the same behaviour on systems that don´t have any problems, so I guess they aren´t the real problem.
Currently I´m trying to let the machine run for a day without doing anything, then checking the filecount in the user-temp-folder. In case this comes of a tumbling windows-service, I´d be able to look in this direction...
swpdev--How big is the Temp file when it starts to cause problems? Reboot. How big is it now? The Temp folder is supposed to automatically empty most contents on each boot. But maybe there are many files which are not deleting and so the free space is small until the problem starts again.
If files are building up, of course you can do it manually during a session if you do not want to reboot
http://pcsupport.about.com/od/maintenance/ht/manualtempxp.htm See line #5
Here are other references with ideas for emptying the Temp folder on reboot.
http://www.tech-archive.net/Archive/WinXP/microsoft.public.windowsxp.general/2006-01/msg00918.html
https://www.indigorose.com/forums/showthread.php?p=98293
http://www.msfn.org/board/lofiversion/index.php/t78599.html
If files are building up, of course you can do it manually during a session if you do not want to reboot
http://pcsupport.about.com/od/maintenance/ht/manualtempxp.htm See line #5
Here are other references with ideas for emptying the Temp folder on reboot.
http://www.tech-archive.net/Archive/WinXP/microsoft.public.windowsxp.general/2006-01/msg00918.html
https://www.indigorose.com/forums/showthread.php?p=98293
http://www.msfn.org/board/lofiversion/index.php/t78599.html
So you're hitting the max files/directory limit, not running out of free disk space. This is pretty unusual. You've said this occurs in hours to days. Can you correlate the dates on the files with Office activity, because even if Word isn't cleaning up temp files, that's a LOT of fles.
If they don't line up, is there a time pattern to the dates on the temp files? For instance, is it possible that these files are being created as part of a backup strategy that's failing. Look for clusters of times that might point to an identifiable activity.
If they don't line up, is there a time pattern to the dates on the temp files? For instance, is it possible that these files are being created as part of a backup strategy that's failing. Look for clusters of times that might point to an identifiable activity.
Give Filemon a go http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx
this program should tell you exactly which applications are writing to which folders, filtering down to the directory in question should lead you which app is causing this issue.
this program should tell you exactly which applications are writing to which folders, filtering down to the directory in question should lead you which app is causing this issue.
ProcessMonitor has replaced FileMon
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
ASKER
Yes, I hit the max files / directory limit. There´s not one BIG temp-file, but thousands of litte temp-files, generated by an oledocument-app.
We already gave it a try with ProcessMonitor. While working one day on one of the computers everything seemed fine. Only 10 temp-files where left. I´ll monitor it when the users are working with the system and let you know, what happened. I suppose that an app crashes somehow without reporting it to windows event viewer (is this possible...?).
The temp-files are from different times.
The main question is, why windows doesn´t clear the files. On most of the systems I know the temp files are deleted after rebooting (or at least after some reboots).
Emptying the temp-folder via script is the current solution we´re using (before writing this thread). But I really like to know, WHY this happens. I´m sure that an app is the problem that is interfering with other apps on that systems. I´m trying to track it down.
We already gave it a try with ProcessMonitor. While working one day on one of the computers everything seemed fine. Only 10 temp-files where left. I´ll monitor it when the users are working with the system and let you know, what happened. I suppose that an app crashes somehow without reporting it to windows event viewer (is this possible...?).
The temp-files are from different times.
The main question is, why windows doesn´t clear the files. On most of the systems I know the temp files are deleted after rebooting (or at least after some reboots).
Emptying the temp-folder via script is the current solution we´re using (before writing this thread). But I really like to know, WHY this happens. I´m sure that an app is the problem that is interfering with other apps on that systems. I´m trying to track it down.
In many manufacturing environments, computers are left on overnight for daily maintenance (OS or AV updates, backups, etc.), or they're used 24x7 and don't get rebooted. I have never seen an application (Word or otherwise) that generates 64,000 temp files over a few days. As you mentioned, it sure sounds like a virus.
Have you checked the content (with something like notepad) of the temp files? Do they contain anything that looks suspicious?
You've done clean installs with the same problem. It's certainly possible your install image is infected with something. You could check to see if it's distribution or network born by doing an install on a machine that's not connected to the network.
I'd also suggest throwing an IDS on the network (either a commercial package or something like Snort) to watch for suspicious traffic.
Have you checked the content (with something like notepad) of the temp files? Do they contain anything that looks suspicious?
You've done clean installs with the same problem. It's certainly possible your install image is infected with something. You could check to see if it's distribution or network born by doing an install on a machine that's not connected to the network.
I'd also suggest throwing an IDS on the network (either a commercial package or something like Snort) to watch for suspicious traffic.
ASKER
Hm. Will check the install image, but as far as I know it´s the same DVD used many times before without any problems... I´ll give feedback as soon it is checked!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
A short update: The problem seems not to occur any more. It seems to be a combination of problems. I found many posts regarding the error messages word is throwing, after emptying the temp-folder it was all okay. In the case here I can only guess what the problem is.
Checking for AV or Trojans was without effect, the systems are all okay. The tmp-files look exactly the same as the other ones on the "OK"-computers.
We´ve updated Office SP3 with the hotfixes released afterwards and Office 2007 with SP1. Some other apps where patched too. It seems to be a problem in combination with the apps installed - but only on some systems.
Our best guess is that after a crash of an app a thread has gone wild and created repeatedly temp-files. This only happens on some systems, so the other computers are unaffected. The users said that there was a delayed UI on the machines before the crash happened. So this seems to point to what hfraser said - not exactly a macro, but it lead us to the right point.
Why the app crashed was because of the full temp-folder, and the temp-folder was (my guess) filled by 2 or more apps locking each others temp-files. After crashing, all open oledocument-temp files where left open. Because of the fact, that the temp-folder doesn´t get cleared on that systems (no matter what timespan has gone by, or how many reboots) this problem occurs.
Thanks everyone for your help!
Checking for AV or Trojans was without effect, the systems are all okay. The tmp-files look exactly the same as the other ones on the "OK"-computers.
We´ve updated Office SP3 with the hotfixes released afterwards and Office 2007 with SP1. Some other apps where patched too. It seems to be a problem in combination with the apps installed - but only on some systems.
Our best guess is that after a crash of an app a thread has gone wild and created repeatedly temp-files. This only happens on some systems, so the other computers are unaffected. The users said that there was a delayed UI on the machines before the crash happened. So this seems to point to what hfraser said - not exactly a macro, but it lead us to the right point.
Why the app crashed was because of the full temp-folder, and the temp-folder was (my guess) filled by 2 or more apps locking each others temp-files. After crashing, all open oledocument-temp files where left open. Because of the fact, that the temp-folder doesn´t get cleared on that systems (no matter what timespan has gone by, or how many reboots) this problem occurs.
Thanks everyone for your help!
ASKER
Thanks for your help. You´ve pointed me to the right direction!
Have you checked for spyware (use adware, spybot, etc.) in addition to viruses?