?
Solved

Server 2003 Eating Hard Drive Space

Posted on 2010-01-12
29
Medium Priority
?
528 Views
Last Modified: 2012-05-08
I have an IBM xSeries runnnig Server 2003 OS.  The server is going through Hard Drive space like candy (pardon my analaogy, best I can think of).  The drive has been steady at around 10GB free until recently when I checked, it has went from 10 GB to under 1GB in two days.  I am not sure what may be happening here.  I am in the middle of running a full scan now for any virus (Symantec Endpoint Protection v 11.0).  I have also done a search for a file over 1gb that may have been changed within the last week, and no results?

Please help.
0
Comment
Question by:cbarbre
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 13
  • 10
  • 3
  • +2
29 Comments
 
LVL 16

Expert Comment

by:Raheem05
ID: 26294245
This could be Microsoft Search please look here:

C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data

If its huge turn off indexing

http://www.dslreports.com/forum/r18453529-How-can-I-turn-off-Microsoft-Search-Index-save-disk-space
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26294249
There is also a service called windows search I think from the top of my head
0
 
LVL 15

Expert Comment

by:Tray896
ID: 26294271
This may be caused by the volume shadow copy service.  I've seen it eat up tons of disk space and it's not an easy thing to track down.  If you see huge images being created in a folder called \system volume information\ then this is likely your cause.  Check this link for steps on disabling it:

http://en.kioskea.net/faq/sujet-2679-turning-off-volume-shadow-copy

0
ATEN's HDBaseT Presentation at InfoComm 2017

Hear ATEN Product Manager YT Liang review HDBaseT technology, highlighting ATEN’s latest solutions as they relate to real-world applications during her presentation at the HDBaseT booth at InfoComm 2017.

 

Author Comment

by:cbarbre
ID: 26294504
Tray896:  Where can I find this directory?
0
 
LVL 15

Expert Comment

by:Tray896
ID: 26294700
You'll have to modify the folder view options so that it shows you 'Protected Operating System Files.'  Then you should be able to find it in the root of one of your drives.

This link has instructions on enabling this view on an XP machine, but it is essentially the same on 2003 server: http://support.microsoft.com/kb/309531
0
 

Author Comment

by:cbarbre
ID: 26294802
Tray896:  I located the file, however, it is empty.  this does not seem to be the culprit.  Any other thoughts?
0
 

Author Comment

by:cbarbre
ID: 26294881
Raheem05:

I have turned indexing off.  Still no file that seems to be growing exponentially?  Any other ideas?

UPDATE:  Virus scan returns nothing.  Possibly run scan through third party?
0
 

Author Comment

by:cbarbre
ID: 26296678
Alright.  

I have been digging into this problem.  Most recent search including hidden and system files, I have found over 250 VIRSCN7.dat files each file hovering around 50MB a piece.  There are multiple files associated with the same date??  This server runs the Symantec Endpoint Protection Manager.  These files are virus definitions?  Why multiple files for the same date?  Have been running Symantec Endpoint Manager on this machine for over a year, this has not been a problem in the past, only recently.

Thanks for the help.
Server4FileSearch.JPG
0
 
LVL 16

Accepted Solution

by:
Raheem05 earned 1200 total points
ID: 26297055
This is a known issue you need to apply the following patch Fix ID: 1177176 (search fix id in the below article which will confirm this)


http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007121216360648

0
 

Author Comment

by:cbarbre
ID: 26297156
Great:

Where do I download the patch?  Symantec site I assume?
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26297192
0
 

Author Comment

by:cbarbre
ID: 26297234
Sorry.  I am still a little confused.  I do not see the patch listed at that page.  Those files are simply virus definitions?  Please advise.
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26297298
I have not used Symantec endpoint before but the last link is a download for Intelligent Updater files I am assuming once you have downloaded the correct and deployed on your symantec appliance it will then work like microsoft updates the tool will check for updates and download etc yes this is correct see:

http://service1.symantec.com/support/ent-security.nsf/docid/2007100816530248
0
 

Author Comment

by:cbarbre
ID: 26297568
I have used this link and downloaded the correct file.  My virus defs are up to date.  However, all .tmp files, and .dat files still exist and consume my Hard Drive space?  IS it wise to manually delete these files?  Should I reboot first, and then see if the files have been removed?  Please advise.

Thank you for all your help. (Raheem05)
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26297593
Its safe to say you can delete these files...try a reboot first and if this fails to remove them them it means the patch will work moving forward for future dats in the meantime delete all the files manually as a one off have a good evening im calling it a night :)
0
 

Author Comment

by:cbarbre
ID: 26297623
Alright.  I will reboot after hours this evening, and will update once it comes back online.

Thank you.
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26297637
Your welcome and good luck all should be good you can manually remove the DATS if you like to free up space now remove some and test the reboot I honestly doubt that it will remove current ones as the patch will normally work moving forward
0
 

Author Comment

by:cbarbre
ID: 26297656
Deleting all DATS will not cause corruption?
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26297743
No sorry dont delete all I dont think it will allow you anyway it will always be using the latest DAT leave the most recent 4 to be safe (check date and time) and delete the rest which are older
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26301583
Cbarbe has this now been resolved?
0
 
LVL 7

Assisted Solution

by:jhalapradeep
jhalapradeep earned 800 total points
ID: 26301748
Hi,

This was a known issue  with Symantec Endpoint Protection version 11.0 MR2 and MR3 but it was successfully resolved in version MR4 and above.

1) Permanent solution: To upgrade the version of SYmantec Endpoint Protection software to latest version.
2) It is absolutely safe to delete all the .tmp folders but make sure you stop the SEPM service first.

3) The excellent symantec tool that will automatically clear all the .tmp folders and files.
You can run this tool on the affected systems and it will do the needful.
You can download the tool from this location:

https://fileshare.symantec.com
Login ID: SymDelTmps
Password: SymD31tmp5!

password to extract the file: symantec

This should for sure resolve the issue and freeup enough disk space.

Regards,
Pradeep Jhala

0
 

Author Comment

by:cbarbre
ID: 26305342
Raheem05:

I am monitoring the server currently to see if HDD space is still being consumed.  I will monitor through the day.  So fara, it seems to have done the trick.

jhalapradeep:

The executable ran like a charm, and more than doubled my HDD space from the deletion of tmp files that I must have missed from the manual deletion.

I will award points once I have this Server monitored to see if the "fix" worked as it should.  I appreciate all the help.
0
 
LVL 16

Expert Comment

by:Raheem05
ID: 26305358
Ok keep us posted
0
 
LVL 3

Expert Comment

by:BarryDo
ID: 26308042
there's a program you can use called treesize that will tell you where the space is going this is really useful for troubleshooting.

longterm you might invest in some network monitoring software like www.bastmonitoring.com, we use this its great
0
 

Author Comment

by:cbarbre
ID: 26308058
Thanks BarryDO.   I will look into this software.
0
 
LVL 7

Expert Comment

by:jhalapradeep
ID: 26334387
Hi,

I hope the issue is fixed now.

Regards,
Pradeep Jhala
0
 

Author Comment

by:cbarbre
ID: 26341274
Issue is resolved.  I will award points accordingly.

Thanks for all the help.
0
 
LVL 7

Expert Comment

by:jhalapradeep
ID: 26341302
Hi,

Thats great news!

Regards,
Pradeep Jhala
0
 

Author Closing Comment

by:cbarbre
ID: 31676148
Both of these solutions resolved my issue.

Thanks Experts.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

More or less everybody in the IT market understands the basics of Networking, however when we start talking about Storage Networks, things get a bit dizzier, and this is where I would like to help.
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question