Solved

SBS 2003 rapidly loosing disk space on C Drive

Posted on 2013-01-14
8
410 Views
Last Modified: 2013-01-15
I have a SBS 2003 Standard Server with SP2.  

A short while ago, I was infected with a virus that changed my extensions on all my shared folders and files to .exe.  I was able to find the offending pc that caused the infection and everything went back to normal.

This past week I've noticed that the disk space in my local C Drive has shrunk 80% over the past week and has continued to shrink.  I'm now down to 3GB of space.  

I checked the users shared folder "J" Drive and that folder was actually smaller in size from last week.   I had all the users in the network get rid of any unwanted mail and delete any items still sitting in their deleted items bin.  

A day later my logs said my disk space increased 35% but today it's down a huge 80%.  I'm afraid if I can't find what's sucking up all my space then this server won't last till the end of the week.

Any advice on what may be causing this or what I should look for and remove?

Thanks

PS.  The serve is set to RAID5 with 5 drives totaling 200GB in size.   Current size is 3.2GB
0
Comment
Question by:jungliss28
8 Comments
 
LVL 87

Expert Comment

by:rindi
ID: 38774050
Make sure your full backup is running error free. If not the exchange transaction logs won't get cleared.
0
 
LVL 4

Expert Comment

by:amclaughlin01
ID: 38774088
What are you using on the SBS server?  Are you using all services (Exchange, WSUS, SharePoint, etc...)

It could be a combination of things, including Windows updates, Exchange logs, or just log files in general.

As rindi pointed out, I would check the backup and transaction logs.  I would also run the WSUS cleanup wizard.

You may want to browse through your C: drive and try to locate which directory is taking up all the space.
0
 
LVL 10

Assisted Solution

by:CSIPComputing
CSIPComputing earned 125 total points
ID: 38774112
I'd install Treesize Free on the server and do an analysis of Drive C:.

This will show you which folders are taking space, and help you pin down what is causing it.
0
 
LVL 52

Assisted Solution

by:Manpreet SIngh Khatra
Manpreet SIngh Khatra earned 125 total points
ID: 38774133
I would say check for

C:\Windows\System32\Log files (What is the size of this folder)
What is the space used by any AV updates or users folders
Is the VSS folder empty or consuming space ?
What all other 3rd party applications are running ?

- Rancy
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 25

Assisted Solution

by:Tony Giangreco
Tony Giangreco earned 125 total points
ID: 38774205
A qyick fix might be to check the Paging file. If it's on the C drive and you have another partitition, I suggest allocating it on the 2nd drive and reducing the file size on the C drive down to  about 10 to 20% of it's original size.

The 2nd drive should also be an internal drive, not external USB.

You need to restart the server, but ti will be an immediate change.

This should help

http://www.waronerrors.com/kb/move-page-file-to-a-different-drive-in-windows-server-2003.aspx
0
 

Author Comment

by:jungliss28
ID: 38774336
The backups all completed okay.

The paging file on C is 2046 MB initial and max is 4092 MB

Server states that the recommended page file on C should be 3070 MB

C:\Program Files\Exchsrvr\MDBDATA is 42GB

C:\Program Files\Exchsrvr\mtadata 2.99 GB

Not sure if my exchange logs are clearing after my backup but I could be wrong.  I also tried to download Treesize Free on the server but the download continues to fail.  Not sure what's up with that.  Tried to download another program and it also failed immediately.  Not sure if this is related or just another problem.   We are getting a new server in the next 2 weeks so I need to keep this running until the new server arrives.

Here is my log file from my backup:


1/7/2013 11:00 PM
-------------------------------
Date: 1/7/2013
Time: 11:00 PM
User: SYSTEM
-------------------------------

Backup Runner started.
Launching NTBackup: ntbackup.exe backup "@C:\Program Files\Microsoft Windows Small Business Server\Backup\Small Business Backup Script.bks" /d "SBS Backup created on 1/7/2013 at 11:00 PM" /v:yes /r:no /rs:no /hc:off /m normal /j "Small Business Server Backup Job" /l:s /f "E:\Full_Auto_BKUP\Backup Files\Small Business Server Backup (01).bkf" /UM
NTBACKUP LOG FILE: C:\Documents and Settings\SBS Backup User\Local Settings\Application Data\Microsoft\Windows NT\NTBackup\data\backup04.log
=====================<BEGIN NTBACKUP LOG FILE>=====================
Backup Status
Operation: Backup
Active backup destination: File
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Volume shadow copy creation: Attempt 1.
Backup (via shadow copy) of "C: "
Backup set #1 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Backup Type: Normal

Backup started on 1/7/2013 at 11:17 PM.
Backup completed on 1/8/2013 at 7:17 AM.
Directories: 47307
Files: 729670
Bytes: 190,267,285,789
Time:  8 hours,  0 minutes, and  12 seconds
Backup of "JWIPDC\Microsoft Information Store\First Storage Group"
Backup set #2 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Backup Type: Normal

Backup started on 1/8/2013 at 7:17 AM.
Backup completed on 1/8/2013 at 8:52 AM.
Directories: 4
Files: 40
Bytes: 43,190,235,284
Time:  1 hour,  34 minutes, and  47 seconds
Backup (via shadow copy) of "System State"
Backup set #3 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Media name: "Small Business Server Backup (01).bkf created 1/7/2013 at 11:00 PM"

Backup Type: Copy

Backup started on 1/8/2013 at 8:54 AM.
Backup completed on 1/8/2013 at 8:56 AM.
Directories: 252
Files: 3144
Bytes: 620,434,297
Time:  2 minutes and  21 seconds

----------------------

Verify Status
Operation: Verify After Backup
Active backup destination: File
Active backup destination: E:\Full_Auto_BKUP\Backup Files\Small Business Server Backup (01).bkf

Verify of "C:"
Backup set #1 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Verify started on 1/8/2013 at 8:57 AM.
Verify completed on 1/8/2013 at 11:31 AM.
Directories: 47307
Files: 729670
Different: 0
Bytes: 190,267,284,113
Time:  2 hours,  34 minutes, and  4 seconds

Verify of "JWIPDC\Microsoft Information Store\First Storage Group"
Backup set #2 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Verify started on 1/8/2013 at 11:31 AM.
Verify completed on 1/8/2013 at 12:08 PM.
Directories: 4
Files: 0
Different: 0
Bytes: 43,190,235,284
Time:  37 minutes and  21 seconds

Verify of "System State"
Backup set #3 on media #1
Backup description: "SBS Backup created on 1/7/2013 at 11:00 PM"
Verify started on 1/8/2013 at 12:08 PM.
Verify completed on 1/8/2013 at 12:09 PM.
Directories: 252
Files: 3144
Different: 0
Bytes: 620,434,297
Time:  33 seconds

----------------------

=======================<END NTBACKUP LOG FILE>=====================
NTBackup finished the backup with no errors.
Backup ended at Tuesday, January 08, 2013 12:09 PM
Backup Runner finished.
0
 
LVL 4

Accepted Solution

by:
amclaughlin01 earned 125 total points
ID: 38775762
It will take more time then using Treesize or other program, but I would check all the top level directories under C: and find the offending directory that is taking up the most space, then drill down into it find the specific directory.  This may also lead you to what may be causing it.

If you are not able to download or install new software, you may very well still have a virus or malware issue lingering.
0
 

Author Closing Comment

by:jungliss28
ID: 38779800
The help from everyone assisted in finding the problem.  The shadow copy and the snapshots from the profiles took up about 20gb of space on the server.  I disabled the snapshot and a ton of space was recovered.

There was also a lingering infection that I was able to remove.  Thank you all again!!!
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature?  Ever have a signature collision problem (especially with Virtual Machines?)  This article is intended to help you understand what's going on and…
Find out what Office 365 Transport Rules are, how they work and their limitations managing Office 365 signatures.
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now