Windows Search Committing Unusually High Number of Writes

We’ve noticed on our Terminal Server that the Windows Search service is periodically writing large amounts of data (sustained 600,000-1,000,000 B/sec). This was first noticed when our ShadowProtect backups began generating 2-5GB incremental files. We run them every 15 minutes and this is much larger than our typical backup. We tracked the problem down to Windows Search.

This was noticed after rebooting the server. We restarted the WSearch service and things seemed to calm down for a while. Within a couple of days the problem reappeared. Since then we rebuilt the search index and configured to only index Outlook. Again, it seemed to run fine for a couple of days and then we noticed the large incremental backups caused by WSearch.

Our Terminal Server is Server 2012 R2 which is virtualized on an ESXi host machine. We had Widows Search/Indexing up and running without issue long before this problem appeared.
iccavemanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

robocatCommented:
You could try the resource monitor (resmon) to look at the disk activity of the windows search process(es).

Under disk you can select the process that you want to monitor. Below click open the pane "disk activity" and you will see the files it is reading and writing. Look at the files it is reading.

Look if the search indexer is taking a long time reading/revisiting certain files. This might be an indication there's something going on with that file.

Hopefully this will give you a clue to investigate further.
0
iccavemanAuthor Commented:
Thank you. I'll take a look at that today and report back. I had not considered what the service was reading so I appreciate your input.
0
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Since ResMon does real-time monitoring, you might want to use SysInternals ProcMon instead to record file actions by the Windows Search processes over a period of time. However, this can create a lot of logging if not used carefully ;-). In particular make sure the tick the "Drop Filtered Events" in the Filter menu, otherwise ProcMon stores everything happening, and not what you filter for, consumimg a lot of memory.
0
10 Tips to Protect Your Business from Ransomware

Did you know that ransomware is the most widespread, destructive malware in the world today? It accounts for 39% of all security breaches, with ransomware gangsters projected to make $11.5B in profits from online extortion by 2019.

robocatCommented:
iccaveman, do you have any feedback for us?
0
iccavemanAuthor Commented:
Robocat,

I did as you suggested but all of the reads seemed to be on ebd.log or the temp version of the log. We ended up creating a new drive that isn't backed up and just relocated the index there.

Qlemo,

I'm sorry that I didn't notice this before we moved the index. Thank you for the suggestion. If this comes up again I'll give that a try.

I appreciate both of your responses.
0
iccavemanAuthor Commented:
Not really a solution but we moved the index to a drive that is not backed up. The main concern were the large incremental backup files this situation was producing so not backing up the index worked.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Storage Software

From novice to tech pro — start learning today.