File Server Audit

[sm00th1]

Hello. We use Windows 2003 Server Std Ed. as a file server and it keeps running out of space. Like the other day, the free space on the server is 50+GB, then just before I pack up and go home, our monitoring software alerted me about the disk space for that file server is almost full. I checked it and sure enough, the free space has gone down to 2.3GB! I need some way to know who's dumping massive amounts of data into my file server. Is there a tool you can recommend to do this? I also need something that will tell me who's deleting file/s/folder/s from the file server.
Thanks in advanced!

 

[captaincrunch00]

Can you just manually grab some folders, then check the size on them as a whole, then if you find a big one narrow down your search?

It really should be cake once you do that. Just find the folder/files that are insanely huge and see if the name, placement, or type of files they are will clue you in as to what is doing it.

I'd just figure it out manually, hopefully someone can recommend a tool that will browse your drive and find big files for you...

 

[sm00th1]

The fileserver has 98 shared folders. I could do it manually but it would be a big waste of time. I already tried it on the first 20 folders but it's too time consuming. And what if it's not located in just 1 folder?

But anyway, the person/s who put it there deleted it already because the free space is back to normal. I just need a tool to audit the server space so that I'll know who is doing it.

Thanks.

 

[captaincrunch00]

Sorry, cant help with a tool, but I'd tell you how I would do it manually. It would take about 5 minutes tops.

Say it's on the D: where this is happening.
You have 15 folders in the root of the D drive.

Highlight 5 of the folders, check the properties of all of them at once (highlight the folders, then hit ALT+Enter). If the size is insanely big (50GB too large to be normal, hell, any folder that has 50GB is probably screwed up) then highlight 2 of them at a time and try it again.
You'll narrow it down to what folder in about 30 seconds.
Open that folder, if there are 98 shared folders, try half of them at once. If it's not in that half, it's in the other half, so start selecting 10-20 folders and check the properties until you find out what folder group it's in, then select 5 or so and narrow it down.

It'll take about 5 minutes tops to narrow it down to the exact folder and files that are doing it. I dont know what way you were trying to do it, but you'll notice what chunk of folders have an extra 50GB when you see the first few folders have 1.8GB, then the next few have 68.8GB.

I honestly think I could find the exact folder in about 3 minutes if I was there. I've done it before over here, turns out a log file was making new huge logs about 400 times per second. That filled up fast, I found out what folder it was, knew the program doing it because of the names, and I stopped it.

 

[Spirit]

Check out;

http://www.jam-software.com/treesize/

Its what I use and it's fandaby dosy, just run it against
\\YourServer\c$
\\YourServer\d$
\\YourServer\e$
\\YourServer\f$
ETC and then you'll be able to expand anything that looks a bit odd.

Regards,
Iain

 

[NickFerrar]

I use STG FolderPrintPlus for investigating where my disk space is going but it just gives you a summary per folder level and you can drill down, rather than a summary per user which might be what you're after?

 

[fs483]

I use FolderInfo. It works really well, provides, drill down, reports... However it doesn't keep track if a user created all the files after you leave the office and deletes them before you start your shift the next day. I discovered one user at one of my customer had 10GB of MP3s in their MyDocuments and since the MyDocuments are synchronized with their home folders, then it was transfering it to the filesrv. It doesn't take much time to fill a file server when you have 50 users on the network.

 

[sm00th1]

Thanks all for the tips. I'll try out all of them. =)