?
Solved

SBS 2003 rapidly loosing disk space on C Drive

Posted on 2013-01-14
8
Medium Priority
?
420 Views
Last Modified: 2013-01-15
I have a SBS 2003 Standard Server with SP2.  

A short while ago, I was infected with a virus that changed my extensions on all my shared folders and files to .exe.  I was able to find the offending pc that caused the infection and everything went back to normal.

This past week I've noticed that the disk space in my local C Drive has shrunk 80% over the past week and has continued to shrink.  I'm now down to 3GB of space.  

I checked the users shared folder "J" Drive and that folder was actually smaller in size from last week.   I had all the users in the network get rid of any unwanted mail and delete any items still sitting in their deleted items bin.  

A day later my logs said my disk space increased 35% but today it's down a huge 80%.  I'm afraid if I can't find what's sucking up all my space then this server won't last till the end of the week.

Any advice on what may be causing this or what I should look for and remove?

Thanks

PS.  The serve is set to RAID5 with 5 drives totaling 200GB in size.   Current size is 3.2GB
0
Comment
Question by:jungliss28
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
8 Comments
 
LVL 88

Expert Comment

by:rindi
ID: 38774050
Make sure your full backup is running error free. If not the exchange transaction logs won't get cleared.
0
 
LVL 4

Expert Comment

by:amclaughlin01
ID: 38774088
What are you using on the SBS server?  Are you using all services (Exchange, WSUS, SharePoint, etc...)

It could be a combination of things, including Windows updates, Exchange logs, or just log files in general.

As rindi pointed out, I would check the backup and transaction logs.  I would also run the WSUS cleanup wizard.

You may want to browse through your C: drive and try to locate which directory is taking up all the space.
0
 
LVL 10

Assisted Solution

by:CSIPComputing
CSIPComputing earned 500 total points
ID: 38774112
I'd install Treesize Free on the server and do an analysis of Drive C:.

This will show you which folders are taking space, and help you pin down what is causing it.
0
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 
LVL 52

Assisted Solution

by:Manpreet SIngh Khatra
Manpreet SIngh Khatra earned 500 total points
ID: 38774133
I would say check for

C:\Windows\System32\Log files (What is the size of this folder)
What is the space used by any AV updates or users folders
Is the VSS folder empty or consuming space ?
What all other 3rd party applications are running ?

- Rancy
0
 
LVL 25

Assisted Solution

by:Tony Giangreco
Tony Giangreco earned 500 total points
ID: 38774205
A qyick fix might be to check the Paging file. If it's on the C drive and you have another partitition, I suggest allocating it on the 2nd drive and reducing the file size on the C drive down to  about 10 to 20% of it's original size.

The 2nd drive should also be an internal drive, not external USB.

You need to restart the server, but ti will be an immediate change.

This should help

http://www.waronerrors.com/kb/move-page-file-to-a-different-drive-in-windows-server-2003.aspx
0
 

Author Comment

by:jungliss28
ID: 38774336
The backups all completed okay.

The paging file on C is 2046 MB initial and max is 4092 MB

Server states that the recommended page file on C should be 3070 MB

C:\Program Files\Exchsrvr\MDBDATA is 42GB

C:\Program Files\Exchsrvr\mtadata 2.99 GB

Not sure if my exchange logs are clearing after my backup but I could be wrong.  I also tried to download Treesize Free on the server but the download continues to fail.  Not sure what's up with that.  Tried to download another program and it also failed immediately.  Not sure if this is related or just another problem.   We are getting a new server in the next 2 weeks so I need to keep this running until the new server arrives.

Here is my log file from my backup:


1/7/2013 11:00 PM
-------------------------------
Date: 1/7/2013
Time: 11:00 PM
User: SYSTEM
-------------------------------

Backup Runner started.
Launching NTBackup: ntbackup.exe backup "@C:\Program Files\Microsoft Windows Small Business Server\Backup\Small Business Backup Script.bks" /d "SBS Backup created on 1/7/2013 at 11:00 PM" /v:yes /r:no /rs:no /hc:off /m normal /j "Small Business Server Backup Job" /l:s /f "E:\Full_Auto_BKUP\Backup Files\Small Business Server Backup (01).bkf" /UM
NTBACKUP LOG FILE: C:\Documents and Settings\SBS Backup User\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\backup04.log
=====================<BEGIN NTBACKUP LOG FILE>=====================
Backup Status
Operation: Backup
Active backup destination: File
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Volume shadow copy creation: Attempt 1.
Backup (via shadow copy) of "C: "
Backup set #1 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Backup Type: Normal

Backup started on 1/7/2013 at 11:17 PM.
Backup completed on 1/8/2013 at 7:17 AM.
Directories: 47307
Files: 729670
Bytes: 190,267,285,789
Time:  8 hours,  0 minutes, and  12 seconds
Backup of "JWIPDC\Microsoft Information Store\First Storage Group"
Backup set #2 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Backup Type: Normal

Backup started on 1/8/2013 at 7:17 AM.
Backup completed on 1/8/2013 at 8:52 AM.
Directories: 4
Files: 40
Bytes: 43,190,235,284
Time:  1 hour,  34 minutes, and  47 seconds
Backup (via shadow copy) of "System State"
Backup set #3 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Backup Type: Copy

Backup started on 1/8/2013 at 8:54 AM.
Backup completed on 1/8/2013 at 8:56 AM.
Directories: 252
Files: 3144
Bytes: 620,434,297
Time:  2 minutes and  21 seconds

----------------------

Verify Status
Operation: Verify After Backup
Active backup destination: File
Active backup destination: E:\Full_Auto_BKUP\Backup Files\Small Business Server Backup (01).bkf

Verify of "C:"
Backup set #1 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Verify started on 1/8/2013 at 8:57 AM.
Verify completed on 1/8/2013 at 11:31 AM.
Directories: 47307
Files: 729670
Different: 0
Bytes: 190,267,284,113
Time:  2 hours,  34 minutes, and  4 seconds

Verify of "JWIPDC\Microsoft Information Store\First Storage Group"
Backup set #2 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Verify started on 1/8/2013 at 11:31 AM.
Verify completed on 1/8/2013 at 12:08 PM.
Directories: 4
Files: 0
Different: 0
Bytes: 43,190,235,284
Time:  37 minutes and  21 seconds

Verify of "System State"
Backup set #3 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Verify started on 1/8/2013 at 12:08 PM.
Verify completed on 1/8/2013 at 12:09 PM.
Directories: 252
Files: 3144
Different: 0
Bytes: 620,434,297
Time:  33 seconds

----------------------

=======================<END NTBACKUP LOG FILE>=====================
NTBackup finished the backup with no errors.
Backup ended at Tuesday, January 08, 2013 12:09 PM
Backup Runner finished.
0
 
LVL 4

Accepted Solution

by:
amclaughlin01 earned 500 total points
ID: 38775762
It will take more time then using Treesize or other program, but I would check all the top level directories under C: and find the offending directory that is taking up the most space, then drill down into it find the specific directory.  This may also lead you to what may be causing it.

If you are not able to download or install new software, you may very well still have a virus or malware issue lingering.
0
 

Author Closing Comment

by:jungliss28
ID: 38779800
The help from everyone assisted in finding the problem.  The shadow copy and the snapshots from the profiles took up about 20gb of space on the server.  I disabled the snapshot and a ton of space was recovered.

There was also a lingering infection that I was able to remove.  Thank you all again!!!
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Email signatures have numerous marketing benefits. Here are 8 top reasons to turn your email signature into a marketing channel.
Follow this checklist to learn more about the 15 things you should never include in an email signature from personal quotes, animated gifs and out-of-date marketing content.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question