NAS in workgroup filling up with unknown data...

NAS gets filled up with "stuff"....

I support a small office...4 laptops win 10 in a workgroup all using a network attached NAS to save data...
It is a WD My Cloud Mirror NAS....3 Gb....it normally has about 1.2 Gb of data...leaving about 2.4 Eg of empty space...
Users get error messages....HD full...cannot write etc.etc...

On 2 occasions that NAS drive has suddenly filled up with "stuff"...As I go thru the various folders in the NAS...I don;t see
anything that looks significantly larger than "normal"...

On the first occasion...after about 2 hours...the NAS filled up...something happened and it went back to it's normal size...

3 days later the same thing happened...In this case I had  my users "aware" of what they were doing in case the NAS gets filled up again...
They were working on spreadsheets and word docs....not large complicated files...

In this case...I unplugged the network cable for about 15 minutes while I was starting to connect a 2ed NAS...
I reconnected the first NAS....disconnected the 2ed NAS and left the office for about an hour...
When I got back...the NAS was empty again...

I have NO idea what is causing this...
Going into the dashboard for the WD My CLoud Mirror...it reports that the SMART specs are good...
I'm kinda speculating that perhaps the NAS controlling software and/or the hardware is going bad...

I am going to connect the new NAS...and take this NAS offline....probably reformat it and see what happens...

Appreciate any thoughts and ideas...
LVL 2
Steve MutchlerIT TechAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Recycle Bin enabled and there's an encryption event on the go thus causing it to fill up?

Someone running TOR or the like downloads.

TreeSize Pro would do the trick to figure out if the problem is happening at the file level.
0
Bill BachPresident and Btrieve GuruCommented:
You could also put a network analyzer (like Wireshark) in front of the device to see what files are being accessed.
0
Steve MutchlerIT TechAuthor Commented:
Thanks guys...
Bill Bach...Wireshark is a good idea...

Phillip Elder...Nobody does any encryption...or TOR...I ran Tree Size but was unable to determine anything...
When I go thru Tree Size and compare folder size...everything seems to match up...
I would need the total size of all the folders and files in the NAS to slightly more than double in size in order to
completely fill the NAS...That...I would think would be quickly and easily noticable....

Recycle Bin Enabled...????...What is this...???
Recycle bin is on the local drive not the NAS...nothing should be able to get from the local recycle bin to the NAS...

Will be back at the client later today...try and figure it out again...

Many thanks
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Most NAS devices have a Recycle Bin feature. It should be enabled to protect against an encryption event.
0
Davis McCarnOwnerCommented:
The key would be in determining what is going on WHEN the drive is full in the form of seeing who is connected and using Treesize to locate where the massive growth has occurred.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Steve MutchlerIT TechAuthor Commented:
I think we are just going to replace the NAS...
It filled up again today...and no one was in the office at the time except me working on the problem...

I'm going to blame it on something going wrong with the NAS...be it mecanical...electronic or software wise...
Gonna dump it and install a new unit...

Thanks for the help guys...
0
Davis McCarnOwnerCommented:
Do people have "cloud" access?  If they do, how can you know whether or not one of their other devices got hacked?
0
Steve MutchlerIT TechAuthor Commented:
No cloud access...I do have RA set up for one user...but the filling up has never happened when he was using RA...
0
Steve MutchlerIT TechAuthor Commented:
Sorry I didn't follow up on this sooner...
Resolution to the problem...

Installed a new NAS...problem did NOT go away...
Turns out it was a Quickbooks issue...
QB16 was installed on one users laptop...we upgraded to QB18...We always had the QB
data files on the NAS as the NAS is backed up regurlarly...it was AFTER the upgrade that
the "stuff" filling up the NAS started happening but we didn't realize it at that point...

Turns out the resolution was to move the QB data files from the NAS to the laptop that QB is installed on...
As soon as we did that the problem vanished...

We did use Treesize to analyze the file size on the NAS...and while it didn't show any individual file size
increasing...it did give us a clue that the QB data folder on the NAS was filling up...The QB data folder would
fill up but the file size's remained the same...

Confusing...

But it was Davis McCarn's suggestion for Treesize that gave me the clue I needed...
0
Steve MutchlerIT TechAuthor Commented:
Many thanks...
0
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
QuickBooks and Sage 50 use a MySQL backend that requires a daemon to be running at the location hosting the files. I'm not so sure a NAS would have that ability?
0
Steve MutchlerIT TechAuthor Commented:
I guess one of the confusing aspects of this...
Under QB 16...we had no issues at all with QB16 on the users laptop and the QB data files on the NAS...

Problems started only after we installed QB18 on the laptop and tried to connect to the QB data files
on the NAS...went thru all the updates and conversions etc etc...

Any...it's solved...but it was confusing...
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking

From novice to tech pro — start learning today.