Exchange 2007 on Server 2003 Running Low on Disk Space and Don't Know How to Proceed:

Hi all.
We have one Exchange 2007 server running Server 2003.
We have a Barracuda Spam Filter as well.
On the Exchange server, we have a C drive, an E drive and an F drive.
The C drive has 60GB in total and 23GB left.
The E drive has 191GB in total and 2.35GB left.
The F drive has 149GB in total and 9.56GB left.

Incoming email is stuck in the Barracuda filter supposedly because of low system resources (Barracuda tech said this).
I backed up the Exchange database to tape using our backup software but this didn't solve anything.
I don't know what's taking up all of the disk space.
When I go into the E drive and select all folders, only 77GB of space is being used.  Why is it saying there is only 2.35GB left?
The same goes for the F drive.  I select all folders in the F drive and only 260MB is being used (not 140GB like it's stating in Windows Explorer).
I don't know what's going on here or how to resolve it.
This is running as a VM and I could probably allot more disk space to the E and F drives but I'm not sure why this is happening.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Do you have unlimited shadow copy turned on?
homerslmpsonAuthor Commented:
On the Exchange server drives?  No.  It shows as DISABLED for each of the drives.
OK, then try Windirstat to see what is taking all the space.
IT Pros Agree: AI and Machine Learning Key

We’d all like to think our company’s data is well protected, but when you ask IT professionals they admit the data probably is not as safe as it could be.

homerslmpsonAuthor Commented:
It doesn't make any sense.

You can see that the E drive is showing that 77.6GB is in use but in explorer you see completely different numbers.
Do you have Show hidden files turned on?
homerslmpsonAuthor Commented:
Yes, along with hidden Operating System files.
Does not make sense to me either.  Is your AV up to-date? Could be a virus or rootkit, run a full scan.  If AV doesn't find anything run an updated Malwarebytes.

Have you tried defrag & Disk cleanup?

How old are the drives? Disk system may be corrupted, check this article to see if it is any help:
homerslmpsonAuthor Commented:
This is a VM.
There are many additional VMs on this host and I haven't seen anything like this.
I wound up doing a couple of things to get things back up and running:
- changed “EnableResourceMonitoring” from “True” to “False” in edgetransport.exe.config
- restarted the Microsoft Exchange Transport Service
- that didn't seem to help but then I rebooted the server and email started flowing again
- I then added 100GB to the E drive and 100GB to the F drive and extended the partitions
- I changed "EnableResourceMonitoring" back to "True" and restarted the Exchange Transport Service again.
Now I'm going to look into this a bit further now that I have some breathing room.
Going to try a defrag although I'm not sure how much that's actually going to accomplish.
I'll then check my AV software on the server...
homerslmpsonAuthor Commented:
I haven't ran a defrag in quite some time but this looks a bit abnormal, no?
The white space is all of the new space I added which is why it hasn't been used at all but look at all that red!!
Are any of the VM's THIN provisioned?  

Do check this Article regarding Windows VM and thin provisioned disks: 0 753389846

When creating a virtual disk file, by default VMware ESXi/ESX uses a thick type of virtual disk. The thick disk pre-allocates all of the space specified during the creation of the disk. For example, if you create a 10 megabyte disk, all 10 megabytes are pre-allocated for that virtual disk.

In contrast, a thin virtual disk does not pre-allocate all of the space. Blocks in the VMDK file are not allocated and backed by physical storage until they are written during the normal course of operation. A read to an unallocated block returns zeroes, but the block is not backed with physical storage until it is written.
By implementing thin provisioned disks, you are able to over-allocate storage. If storage is over-allocated, thin virtual disks can grow to fill an entire datastore if left unchecked.
sounds like a plan, good luck.
I did not know it was, not sure you need to do defrag on virtual.
homerslmpsonAuthor Commented:
@ Sola-Admin:
They aren't thin-provisioned.  I always use the default.

@ pjam:
Thanks!  Hopefully it's just a fragmentation issue. Looks like it's going to take a while for this to finish so I'll be assigning points later on.
Seth SimmonsSr. Systems AdministratorCommented:
running a defrag will not recover disk space and will only make things worse because you are increasing the disk i/o while it's running thus slowing down exchange processes

whether your vm is thin or thick provisioned is also irrelevant here; you need to identify where the usage is

what is the output of vssadmin list shadowstorage (from elevated command prompt)?
homerslmpsonAuthor Commented:
See screenshot below.  Maybe you can make some sense of this...
homerslmpsonAuthor Commented:
FYI - I'm leaving for the day but I'll be back tomorrow @ 6am (EST) and look forward to your input regarding this.
Seth SimmonsSr. Systems AdministratorCommented:
well, there you go...113gb used for shadow storage on E; 132gb used on F

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
He said in the beginning it was disabled on E&F.  How can he remove shadow copy? re-enable and then disable again?
Seth SimmonsSr. Systems AdministratorCommented:
to purge the shadow copies, would do vssadmin delete shadows /for:e (then repeat for f)
what backup software is being used?
homerslmpsonAuthor Commented:
I'm glad we're making some progress but the command you mentioned above doesn't work.
I also tried using /for=e instead of /for:e and it said "Error: Either the specified volume was not found or it is not a local volume"
homerslmpsonAuthor Commented:
And regarding the backup software being used, it is CA ARCserve Backup v16.5.
It's definitely "Exchange-aware" and this hasn't been an issue until recently.
June 1st was when I last monitored the disk space on the servers and everything was fine at that time.
homerslmpsonAuthor Commented:
I managed to get one of them to clean up (E:\) but I'm not sure how exactly.
I tried Delete Shadows /All but it gives me the message "No items found that satisfy the query".
But hey, at least I got one drive cleaned up!!
homerslmpsonAuthor Commented:
OK managed to clean up both of them.
Found an article somewhere else that mentioned stopping VSS and changing the amount of disk space used for Shadow Copies to 300MB. After starting the service again, I can see that the disk space has been returned to normal.
I guess my question now is how can I prevent this from happening again?
Seth SimmonsSr. Systems AdministratorCommented:
actually, the command i specified is correct, though for 2008 and higher
sorry, i forget sometimes people are still running unsupported operating systems :)
homerslmpsonAuthor Commented:
Thanks guys! Now I need to work on the issues I just discovered on some of my DCs.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.