Re: Disappearing disk space?



Hi Terence - thankyou for posting this list, it's very useful information.

However, I switched off the AV scanning completely last night and the
problem recurred, so although I'll reconfigure the scanning according to
your advice, it's now clear that AV activity wasn't causing the huge
SMSMonitoring log. I watched the log build up last night, and it happens
very quickly - 2Gb in about 5 minutes - and I stopped it by rebooting the
server. I have one more experiment to try tonight, and if that doesn't
solve the problem, I'll try reinstalling the monitoring component as you
suggest.

Thanks again for all your suggestions.
Regards
Nik


"Terence Liu [MSFT]" <v-terliu@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:EnDd%232fuHHA.360@xxxxxxxxxxxxxxxxxxxxxxxxx
Hello Nik,

For your concern about: Is there anywhere I can obtain a complete list of
folders to exclude?

We do not have a complete list of the exceptions folders, however, you can
refer to the following lists:

Consider the following file scanning exceptions for your Anti-Virus
software where applicable:

NOTE: The %systemroot% is normally the C:\WINDOWS or C:\WINNT directory
depending on your OS.

1.) %systemroot%\System32\Spool (and all the sub-folders and files)
2.) %systemroot%\SoftwareDistribution\Datastore
Refer to the following article for information:
KB822158 - Virus scanning recommendations for computers that are running
Windows Server 2003, Windows 2000, or Windows XP
http://support.microsoft.com/kb/822158
3.) Any Network Drives that are mapped.

The following steps are Server Role specific:
==========================================================
1.) If your system is also a Domain Controller (DC) / DNS / DHCP also
exclude the following from Anti-Virus Scanning:
a.) %systemroot%\Sysvol folder (include all the sub-folders and files)
b.) %systemroot%\system32\dhcp folder (include all the sub-folders and
files)
c.) %systemroot%\system32\dns folder (include all the sub-folders and
files)
d.) %systemroot%\ntds
Refer to the following article for information:
KB822158 - Virus scanning recommendations for computers that are running
Windows Server 2003, Windows 2000, or Windows XP
http://support.microsoft.com/kb/822158

2.) If File Replication (NTFR) service is running on your system, make
sure
your Anti-Virus software is compatible:
KB815263 - Antivirus, backup, and disk optimization programs that are
compatible with the File Replication Service
http://support.microsoft.com/kb/815263
And exclude:
a.) %systemroot%\ntfrs folder (include all the sub-folders and files)
b.) Files that have the .log and .dit extension

3.) If you have IIS installed, exclude:
a.) The IIS compression directory (default compression directory is
%systemroot%\IIS Temporary Compressed Files)
b.) %systemroot%\system32\inetsrv folder
c.) Files that have the .log extension
Refer to the following knowledge base articles for reference:
KB817442 - IIS 6.0: Antivirus Scanning of IIS Compression Directory May
Result in 0-Byte File
http://support.microsoft.com/kb/817442
KB821749 - Antivirus software may cause IIS to stop unexpectedly
http://support.microsoft.com/kb/821749

4.) If you have SQL installed, you may want to exclude the SQL folder and
databases files (or database file types) from scanning for performance
reasons:
KB309422 - Guidelines for choosing antivirus software to run on the
computers that are running SQL Server
http://support.microsoft.com/kb/309422

5.) If you have Exchange installed, perform the relevant file-based
scanning exclusions listed in Knowledge Base articles:
KB328841 - Exchange and antivirus software
http://support.microsoft.com/kb/328841
KB823166 - Overview of Exchange Server 2003 and antivirus software
http://support.microsoft.com/kb/823166
KB245822 - Recommendations for troubleshooting an Exchange Server computer
with antivirus software installed
http://support.microsoft.com/kb/245822

6.) If you have Cluster services, make sure your Anti-Virus software is
compatible:

KB250355 - Antivirus Software May Cause Problems with Cluster Services
http://support.microsoft.com/kb/250355
NOTE: If you have a SQL cluster, make sure that you exclude these
locations
from virus scanning:
a.) Q:\ (Quorum drive)
b.) %systemroot%\Cluster
c.) SQL Server data files that have the .mdf extension, the .ldf
extension,
and the .ndf extension

7.) If you have Sharepoint installed, you should exclude:
a.) Drive:\Program Files\SharePoint Portal Server
b.) Drive:\Program Files\Common Files\Microsoft Shared\Web Storage System
c.) Drive:\MSDEDatabases (particularly on SBS)
(where Drive: is the drive letter where you installed SharePoint Portal
Server)
Refer to the following knowledge base articles for reference:
KB320111 - Random Errors May Occur When Antivirus Software Scans Microsoft
Web Storage System
http://support.microsoft.com/kb/320111
KB322941 - Microsoft's Position on Antivirus Solutions for Microsoft
SharePoint Portal Server
http://support.microsoft.com/kb/322941

8.) If you have a Systems Management Server (SMS), you should exclude
folders:
a.) SMS\Inboxes
b.) SMS_CCM\ServiceData
Refer to the following knowledge base articles for reference:
KB327453 - Antivirus programs may contribute to file backlogs in SMS 2.0
and in SMS 2003
http://support.microsoft.com/kb/327453
NOTE: If you exclude the SMS\Inboxes directory from virus scanning or
remove the antivirus software, you may make the site server and all
clients
vulnerable to potential virus risks. The client base component files
reside
in the SMS\Inboxes directory.

9.) If you have a MOM (Microsoft Operations Manager) Server, you consider
excluding:
a.) Drive:\Documents and Settings\All Users\Application
Data\Microsoft\Microsoft Operations Manager
b.) Drive:\Program Files\Microsoft Operations Manager 2005
(where Drive: is the drive letter where profiles are located)

10.) If you have an Internet Security and Acceleration Server (ISA)
Server,
you should exclude:
a.) The ISALogs folder. By default, the ISALogs folder is located in the
folder where you installed ISA Server. Typically, this location is
Drive:\Program Files\Microsoft ISA Server.
Refer to the following knowledge base articles for reference:
KB887311 - Event ID 5, event ID 14079, and event ID 14176 are logged in
the
Application log on your Internet Security and Acceleration Server 2000
computer
http://support.microsoft.com/kb/887311

11.) If you have a Windows Software Update Services (WSUS) Server role,
you
consider excluding:
a.) Drive:\MSSQL$WSUS
b.) Drive:\WSUS
(where Drive: is the drive letter where you installed Windows Software
Update Services)
Also refer to the following knowledge base articles for reference:
KB900638 - Multiple symptoms occur if an antivirus scan occurs while the
Wsusscan.cab file is copied
http://support.microsoft.com/kb/900638

MORE INFORMATION:
KB49500 - List of antivirus software vendors
http://support.microsoft.com/kb/49500
KB129972 - Computer viruses: description, prevention, and recovery
http://support.microsoft.com/kb/129972

Hope the info will give you some help.

Thanks and have a nice day!

Best regards,

Terence Liu(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check
the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In
doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.

--------------------
| From: "nik" <nik_AT_cict.co.uk>
| References: <eKPwf89tHHA.576@xxxxxxxxxxxxxxxxxxxx>
<bTr#urGuHHA.3972@xxxxxxxxxxxxxxxxxxxxxx>
<#Ka4mFKuHHA.3796@xxxxxxxxxxxxxxxxxxxx>
<E7F94CEE-09CA-4D88-A5CE-C3589C49587F@xxxxxxxxxxxxx>
<#BTMYdWuHHA.1672@xxxxxxxxxxxxxxxxxxxx>
<9A0F9CF9-FC92-481D-8AC8-DE361EC73724@xxxxxxxxxxxxx>
| Subject: Re: Disappearing disk space?
| Date: Thu, 28 Jun 2007 21:29:31 +0100
| Lines: 214
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2800.1807
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1896
| Message-ID: <eQUbMMcuHHA.3660@xxxxxxxxxxxxxxxxxxxx>
| Newsgroups: microsoft.public.windows.server.sbs
| NNTP-Posting-Host: ctmd.demon.co.uk 80.176.224.181
| Path: TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTNGP06.phx.gbl
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:47044
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| Hi Les: thanks for this response.
|
| "Les Connor [SBS MVP]" <les.connor@xxxxxxxxxxxx> wrote in message
| news:9A0F9CF9-FC92-481D-8AC8-DE361EC73724@xxxxxxxxxxxxxxxx
| > As a test, temporarily disable A/V file space scanning on the system
| drive.
|
| I noted this when I was looking at the docs for moving data folders, and
| most of the 3 years that the server has been running happily, it's run
| without any AV - it's NATted and isn't used for client email or by
users,
| so I used to feel OK about leaving out the AV. But I lost my nerve a
few
| months ago and installed it. :-) So it sounds like the AV is the
problem -
| though I would be interested to understand more about why.
|
| >
| > There are a number of files, file types, and folders that should be
| excluded
| > from A/V scanning. Because SBS does lots of things, the list is longer
| than
| > on any other system.
| >
| > SQL (or any database, for that example) should not be scanned, same
for
| > Exchange, and some of the folders pertaining to the DC function.
|
| Is there anywhere I can obtain a complete list of folders to exclude? I
| assume that you mean data folders for the db and Exchange, rather than
| binaries?
|
| I already excluded the particular folder with the problem logfile in it,
but
| I'll try suspending the AV overnight and see if that cures it.
|
| Thanks
| Nik
|
| >
| > --
| > Les Connor [SBS MVP]
| >
| >
| > "nik" <nik_AT_cict.co.uk> wrote in message
| > news:%23BTMYdWuHHA.1672@xxxxxxxxxxxxxxxxxxxxxxx
| > > Hi Les:
| > >
| > >> What anti-virus application do you have installed?
| > >
| > > Sophos.
| > >
| > >>I've noticed similar
| > >> behaviour with Trend CSM on very tight system partitions.
| > >>There may be some
| > >> relief, but it's only a temporary measure as it's really hard to
keep
| > > enough
| > >> free space on a 12 gb system partition.
| > >
| > > Last night, after moving the scheduled tasks as Terence suggested,
the
| > > problem recurred - but more severely. I suspect that one of the
| scheduled
| > > tasks which I moved was limiting the damage, not causing it!
| > >
| > > But I have nailed down where the disc space is going - it's filling
up
| > > with
| > > this SQL logfile:
| > > C:\Program Files\Microsoft SQL
| > > Server\MSSQL$SBSMONITORING\Data\SBSMonitoring_log.LDF
| > > Once I shrink that dB, I get my 2.5Gb of space back - until
tomorrow.
| > >
| > > Any idea why this might be happening? Both our backup and our AV
| software
| > > use SQL dBs - but does the fact that this is the SBSMonitoring dB
still
| > > suggest that a 3rd-party app is responsible? Is there any tool in
SBS
| > > which
| > > I can use to look at this logfile?
| > >
| > >> So in the end, you'll need to resize c: anyway. You should find
lots
of
| > > hits
| > >> on resizing if you do a google search of this newsgroup. A disk
imaging
| > >> product is your best bet for this task.
| > >
| > > Thanks, I'll check it out.
| > >
| > > Regards
| > > Nik
| > >
| > >>
| > >> --
| > >> Les Connor [SBS MVP]
| > >>
| > >>
| > >> "nik" <nik_AT_cict.co.uk> wrote in message
| > >> news:%23Ka4mFKuHHA.3796@xxxxxxxxxxxxxxxxxxxxxxx
| > >> > Hi Terence: many thanks for your detailed and informative reply.
| > >> >
| > >> >>
| > >> >> According to your description, I understand that your SBS system
| > >> >> partition
| > >> >> free space disappear at every 03:00. If I have misunderstood the
| > > problem,
| > >> >> please don't hesitate to let me know.
| > >> >
| > >> > Mostly correct, though on a small minority of days, the issue
simply
| > >> > doesn't
| > >> > happen. There seems to be no pattern to this.
| > >> >
| > >> > What's especially strange is that the free space usually comes
back
| > > again
| > >> > within a couple of hours, and when it disappears, it doesn't show
up
| in
| > >> > file/folder sizes on the drive at that time.
| > >> >
| > >> >> Based on my research, I think this issue relate to 3rd-party
| software
| > > or
| > >> >> some scheduled tasks running on SBS.
| > >> >
| > >> > I had suspcisions about the Backup Exec backup software we use,
but I
| > >> > stopped all Backup Exec services yesterday evevning, and the
problem
| > > still
| > >> > recurred last night. There's no other 3rd-party software running
on
| a
| > >> > schedule AFAIK - and there's certainly nothing coming up in the
event
| > >> > logs.
| > >> >
| > >> >>I suggest we try the following steps
| > >> >> to see if we can resolve this issue:
| > >> >>
| > >> >> 1. Please check the scheduled tasks running on SBS
| > >> >>
| > >> >> a. Please open control panel->Scheduled Tasks
| > >> >>
| > >> >> b. Please check whether some scheduled tasks' Next Run time is
| nearby
| > >> > 03:00
| > >> >
| > >> > Nothing is scheduled to run specifically at 03:00. The only
| scheduled
| > >> > tasks
| > >> > are:
| > >> >
| > >> > Collect Server Performance Data (every hour)
| > >> > Collect Usage Data (Daily at 04:30)
| > >> > File_Backup (disabled, as we have 3rd party backup software)
| > >> > Small Business Server - Server Status Report - Server Performance
| > >> > Report
| > >> > (daily at 06:00)
| > >> >
| > >> > I guess that means that the Collect Server Performance Data will
run
| at
| > >> > 03:00 though... I'll try moving the tasks tonight.
| > >> >
| > >> >>
| > >> >> c. Please move all scheduled tasks to another folder, the tasks
will
| > >> >> do
| > >> > not
| > >> >> run, then monitor the SBS at 03:00
| > >> >>
| > >> >> d. If the issue persists, we can move all scheduled tasks back.
| > >> >>
| > >> >> 2. Please do clean boot on SBS and monitor to narrow down this
issue
| > >> >
| > >> > I will try this option over the next couple of days, but as other
| folks
| > >> > here
| > >> > have observed, SBS tends to be a single-server setup, so it can
be
| > >> > difficult
| > >> > to get maintenance time when there are problems. OK, not many
people
| > > want
| > >> > to work at 3am, but then again, neither do I. :-)
| > >> >
| > >> >>
| > >> >> 3. For SBS 2003 server, the 2.5GB free space in system partition
is
| > >> >> too
| > >> >> little. I suggest you move some data or folders from system
| partition
| > > to
| > >> >> additional partition or disk. This will make SBS run smooth.
| > >> >
| > >> > Tell me about it - but when I installed this system in 2004, 12Gb
was
| > > the
| > >> > system partition size recommended by Microsoft for our server.
It's
| > >> > now
| > >> > hopelessly inadequate, even though I've moved all the data files
| which
| > >> > Technet articles suggest moving. We have more drive space
available
| on
| > >> > the
| > >> > machine, but I know of no way to increase the system partition
size -
| > >> > is
| > >> > there a way of adding unused space to the system partition or
| > >> > recreating
| > >> > the
| > >> > system partition to another drive? The server is SCSI RAID5, and
I'm
| > > just
| > >> > about to install an additional array of 3 drives in it, so now
would
| be
| > > a
| > >> > good time to reorganise the storage if it's possible.
| > >> >
| > >> > Would it be sensible to try reinstalling the system from scratch
on
| the
| > >> > new
| > >> > drive, using a larger system partition (how big?), and restoring
our
| > > data
| > >> > into that new installation from backup?
| > >> >
| > >> > Best regards
| > >> > Nik
| > >> >
| > >> >
| > >>
| > >
| > >
| >
|
|
|



.