NAS in workgroup filling up with unknown data...

NAS gets filled up with "stuff"....

I support a small office...4 laptops win 10 in a workgroup all using a network attached NAS to save data...
It is a WD My Cloud Mirror NAS....3 Gb....it normally has about 1.2 Gb of data...leaving about 2.4 Eg of empty space...
Users get error messages....HD full...cannot write etc.etc...

On 2 occasions that NAS drive has suddenly filled up with "stuff"...As I go thru the various folders in the NAS...I don;t see
anything that looks significantly larger than "normal"...

On the first occasion...after about 2 hours...the NAS filled up...something happened and it went back to it's normal size...

3 days later the same thing happened...In this case I had  my users "aware" of what they were doing in case the NAS gets filled up again...
They were working on spreadsheets and word docs....not large complicated files...

In this case...I unplugged the network cable for about 15 minutes while I was starting to connect a 2ed NAS...
I reconnected the first NAS....disconnected the 2ed NAS and left the office for about an hour...
When I got back...the NAS was empty again...

I have NO idea what is causing this...
Going into the dashboard for the WD My CLoud Mirror...it reports that the SMART specs are good...
I'm kinda speculating that perhaps the NAS controlling software and/or the hardware is going bad...

I am going to connect the new NAS...and take this NAS offline....probably reformat it and see what happens...

Appreciate any thoughts and ideas...
LVL 2
Steve MutchlerIT TechAsked:
Who is Participating?
 
Davis McCarnOwnerCommented:
The key would be in determining what is going on WHEN the drive is full in the form of seeing who is connected and using Treesize to locate where the massive growth has occurred.
0
 
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Recycle Bin enabled and there's an encryption event on the go thus causing it to fill up?

Someone running TOR or the like downloads.

TreeSize Pro would do the trick to figure out if the problem is happening at the file level.
0
 
Bill BachPresidentCommented:
You could also put a network analyzer (like Wireshark) in front of the device to see what files are being accessed.
0
Network Scalability - Handle Complex Environments

Monitor your entire network from a single platform. Free 30 Day Trial Now!

 
Steve MutchlerIT TechAuthor Commented:
Thanks guys...
Bill Bach...Wireshark is a good idea...

Phillip Elder...Nobody does any encryption...or TOR...I ran Tree Size but was unable to determine anything...
When I go thru Tree Size and compare folder size...everything seems to match up...
I would need the total size of all the folders and files in the NAS to slightly more than double in size in order to
completely fill the NAS...That...I would think would be quickly and easily noticable....

Recycle Bin Enabled...????...What is this...???
Recycle bin is on the local drive not the NAS...nothing should be able to get from the local recycle bin to the NAS...

Will be back at the client later today...try and figure it out again...

Many thanks
0
 
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
Most NAS devices have a Recycle Bin feature. It should be enabled to protect against an encryption event.
0
 
Steve MutchlerIT TechAuthor Commented:
I think we are just going to replace the NAS...
It filled up again today...and no one was in the office at the time except me working on the problem...

I'm going to blame it on something going wrong with the NAS...be it mecanical...electronic or software wise...
Gonna dump it and install a new unit...

Thanks for the help guys...
0
 
Davis McCarnOwnerCommented:
Do people have "cloud" access?  If they do, how can you know whether or not one of their other devices got hacked?
0
 
Steve MutchlerIT TechAuthor Commented:
No cloud access...I do have RA set up for one user...but the filling up has never happened when he was using RA...
0
 
Steve MutchlerIT TechAuthor Commented:
Sorry I didn't follow up on this sooner...
Resolution to the problem...

Installed a new NAS...problem did NOT go away...
Turns out it was a Quickbooks issue...
QB16 was installed on one users laptop...we upgraded to QB18...We always had the QB
data files on the NAS as the NAS is backed up regurlarly...it was AFTER the upgrade that
the "stuff" filling up the NAS started happening but we didn't realize it at that point...

Turns out the resolution was to move the QB data files from the NAS to the laptop that QB is installed on...
As soon as we did that the problem vanished...

We did use Treesize to analyze the file size on the NAS...and while it didn't show any individual file size
increasing...it did give us a clue that the QB data folder on the NAS was filling up...The QB data folder would
fill up but the file size's remained the same...

Confusing...

But it was Davis McCarn's suggestion for Treesize that gave me the clue I needed...
0
 
Steve MutchlerIT TechAuthor Commented:
Many thanks...
0
 
Philip ElderTechnical Architect - HA/Compute/StorageCommented:
QuickBooks and Sage 50 use a MySQL backend that requires a daemon to be running at the location hosting the files. I'm not so sure a NAS would have that ability?
0
 
Steve MutchlerIT TechAuthor Commented:
I guess one of the confusing aspects of this...
Under QB 16...we had no issues at all with QB16 on the users laptop and the QB data files on the NAS...

Problems started only after we installed QB18 on the laptop and tried to connect to the QB data files
on the NAS...went thru all the updates and conversions etc etc...

Any...it's solved...but it was confusing...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.