Re: Server Losing Hard Disk Space

I apologize for the late post.

We ran into a similar problem a while back and we used the software
FolderSizes, a network based disk analysis tool
(http://www.foldersizes.com/), to take a visual representation of the
disk on a daily basis and compare the snapshots of the different days.

-Shariff

On 12/2/06, Dan Denton <ddenton@xxxxxxxxxxxxxxxxx> wrote:
Thank you all for your input on this. We've finally found out that this
box (also running exchange and a mail proxy) had a flaw in the
mail-proxy software allowing it to be used as an open relay. This was
causing increased traffic, and increased log files. Thanks again...

-----Original Message-----
From: Petter Bruland [mailto:pbruland@xxxxxxxxx]
Sent: Thursday, November 30, 2006 1:39 PM
To: Dan Denton; security-basics@xxxxxxxxxxxxxxxxx
Subject: RE: Server Losing Hard Disk Space

Hi,

Check your event log to see if there are errors showing up.

Also, have you made any changes lately? Like turning on
logging/debugging for any applications, such as DNS, DHCP etc?

What service do you have on this box? Exchange? File server? FTP?

Do you have a public available FTP server that might be used by
unauthorized users? I had this happen on a box, where I suddenly found
some cool games and a movie.

If you are running Exchange on it, and you haven't had a successful
backup, you might have some log files filling up the drive.

Just my two cents... or so

-Petter

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Dan Denton
Sent: Wednesday, November 29, 2006 6:07 AM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Server Losing Hard Disk Space

I have a win2k which has been steadily losing disk space for the last
few days at a rate of half a gig a day or more. Can anyone point me in
the direction of a tool that will allow me to see which files have
increased in size between determined intervals? Any help is
appreciated...

Dan Denton
Information Technology Manager, CCNA
Pay-LESS Office Products






--
"Only two things are infinite; the universe and human stupidity, and
I'm not sure about the former."
-Albert Einstein

---------------------------------------------------------------------------
This list is sponsored by: ByteCrusher

Detect Malicious Web Content and Exploits in Real-Time.
Anti-Virus engines can't detect unknown or new threats.
LinkScanner can. Web surfing just became a whole lot safer.

http://www.explabs.com/staging/promotions/xern_lspro.asp?loc=sfmaildetect
---------------------------------------------------------------------------

Relevant Pages

  • I/O request taking longer than 15 seconds
    ... I/O request taking longer than 15 seconds to complete ... I've seen this same problem and my suspicions are that the disk defrag is ... reading or writing to your data or log files? ... getting your feedback but unfortunately that didn't resolve the problem ...
    (microsoft.public.sqlserver.server)
  • Re: IO Bottleneck
    ... A lot of it is going to utilize the disk. ... noticable to users is the sequential write of the log files. ... files on their own separate set of write-optimized physical disks is a low ... of your users are OWA users, then the impact on the server should be much ...
    (microsoft.public.exchange.design)
  • Re: securing system after giving away root password
    ... >>I signed an agreement with a provider in Germany for server housing. ... > complete and total control over your machine. ... They could have changed any log files. ... They can thus remove your hard disk, ...
    (comp.os.linux.security)
  • Re: Computer forensics to uncover illegal internet use
    ... Examine the disk using something like Knoppix STD or Audit or other ... Alternative Browser history files ... Home of "Network Security using Linux" ... > consult log files to track his activities? ...
    (Security-Basics)
  • RE: disk caching
    ... Also, write caching is ... disabled on a disk ... >Active Directory log files. ... >Move the Active Directory database and the Active ...
    (microsoft.public.windows.server.general)