Closed EV partition still growing

[Caseh]

Currently have an issue with an EV partition that has been closed for sometime (over a year) continuing to grow in size. The partition has collections enabled and there are no temp files for items pulled from archives lingering on the drive so i'm at a complete loss as to where to check next.

Any pointers as to what could be causing this or what to check next?

[TonySterling]

Can you tell the last files added?  Are you sure they are not archdvs files?  How much is it growing and is it daily?

Were there any other partitions on the drive?

Lastly, what version of EV?

[JesusWept3 · Accepted solution]

My first thought was ARCHDVS/ARCHDVSSP/ARCHDVSCC getting extracted from the cab files, which is normal for user recalls, PST exports, index rebuilds, DA Exports etc. But it seems like you've already checked for the Arch files. and the clean up is done by the collections process later after the item hasn't been accessed in a certain period of time.

With collections and expiry and sparse collections, i'd expect the items to change, so when items are no longer needed because they've been expired, EV will extract out legitimate items from the CAB file and delete the CAB file. But that would really make the drive grow smaller.

Is the drive purely dedicated to this one partition, or does the drive seperate partitions?
How are you judging the space taken, by the drive properties or the folder properties?
Any chance that you have Shadow Copies/Previous Versions enabled for that particular drive?
Do you have a paging file or anything else the system could be using?
Is there any chance you have another partition writing to the same drive but under that location?

So if you do something like

SELECT VSE.VaultStoreName, PE.PartitionRootPath "Partition Path"
FROM VaultStoreEntry VSE, PartitionEntry PE
WHERE VSE.VaultStoreEntryId = PE.VaultStoreEntryId

Do you see any Partitions using the same drive/path that would be on the same server?

For instance, could you have something like

E:\Enterprise Vault Stores\Mail Store\Ptn1 <-- for a Partition 1 of Mail Store
E:\Enterprise Vault Stores\Mail Store\File Store\Ptn1 <-- for a Partition 1 of File Store

[Caseh]

Hi Tony,

Thanks for the quick response. Just had a look and come up with the following

- The only files being added are FRX files from a staging folder for DFS which sits on the same drive, these amount to approx. 2gb and the drive has a capacity of 375gb. These appear to be on a rolling buffer and are removed after 7 days so the folder never exceeds 2gb. No cab files have been amended since the day the collector created them back in 2011.

- At present there are no archdvs files

- It's growing daily, we have a Solarwinds instance monitoring the drive the partitions sits on and historically it's been growing by approx. 1.5gb a week as far back as I can see.

- Version: 8.0.4.1991
 

Hi Jesuswept

Is the drive purely dedicated to this one partition, or does the drive seperate partitions? There are 3 partitions, each with it's own drive. Two are closed, one is open.

How are you judging the space taken, by the drive properties or the folder properties? Solarwinds history on the drive in question.

Any chance that you have Shadow Copies/Previous Versions enabled for that particular drive? No shadowcopies, drive isn't present under vssadmin.

Do you have a paging file or anything else the system could be using? Paging file is approx 200mb

Is there any chance you have another partition writing to the same drive but under that location? I don't believe so but it's a possibility i'll look into.

[Arjun_Shelke]

Does SolarWinds provide file type related information? For example, if you can get screenshot of size of the drive based file types, count and size then we can monitor it for couple of days and compare the change.

Most probably, sparse collection is re-collecting the files in new cab files. You can note down file type, count and size before and after the collection runs. This will help you identify whats changed and which files have been added.

I have seen that when collection starts, for old partition where nothing new to collect, it will straight-away start the sparse collection. In sparse collection, based on Reference count of items in collection, collected files will be extracted to original location and then re-collected to new collection (CAB) and old CAB will be deleted. When you check the size of the disk, if sparse collection has extracted files then you will see increase in size. So we need to wait until the collection run completes the task.

If you like, additionally you can Dtrace 'StorageFileWatch' process which is responsible for collecting the files. You can setup DTrace before collection starts, you can check the collection time in partition properties >> Collection tab. Wait until collection completes, you can monitor Event logs for Event 7133.

Event 7133 also details the collection files created and number of saveset files added into collection.

I hope this helps..