closed partition drive is filling up

[goof717]

Thanks for your time and effort.

This is a pretty odd one.  We received a warning that the F drive is filling up however the partitions that reside on that drive have closed for a while now (months). yet something is being written to that drive. I am worried that when it does reach 99% EV will shut down.  I have opened a case with symantec support but so far we haven't gotten anywhere.  any thoughts?  

Event Type: Warning

Event Source: Enterprise Vault 

Event Category: Admin Service 

Event ID: 4145

Date: 6/4/2012

Time: 10:56:05 AM

User: N/A

Computer: EV02

Description:

The system is running out of diskspace on drive F: - delete any unwanted files 

Enterprise Vault will be shut down when 99% of the diskspace is used 

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp?EvtID=4145

[AWMorris]

Is it possible that there a bunch of ARCHDVS files?

[TonySterling]

So as AWMorris has said, it could be archdvs files.  Do you use collections?

[goof717]

digging into the subfolders of the partitions there are DVS files. but none of them have been recently modified.  

Yes we do use collections.  max collection size is 10MB and collecting files older than 10 days.  Can I delete these collection cab files?  or just turn off collections for the drive since it is no longer in use?

[TonySterling · Accepted solution]

No you can't delete the cab files, if you do that you will be deleting your archived files!

and, no, don't turn off collections.  The collection process removes the archdvs files created when someone views an archived item.

See

Disk Space may be Unexpectedly Utilized on Closed NTFS Partitions

Article: TECH175538

|

Created: 2011-11-28

|

Updated: 2012-03-29

|

Article URL http://www.symantec.com/docs/TECH175538

[goof717]

only have 7 files. 

 Total Files Listed:

               7 File(s)      3,260,667 bytes

               0 Dir(s)  85,398,065,152 bytes free

and did collection run with the following results..

Archived items: 0 

Files added to collections: 0 

Collections: 0 

[AWMorris]

I vaguely remember a bug in the product which incorrectly reported drive space.  As a result, the 4145 warning was logged.  What happens if you set the Start and Stop time for Collections to be the same, and restart the Admin Service?  Does the warning go away?

[AndrewB]

what's the total size of the drive and how much free space do you actually have based on what windows os tells you?

[goof717]

i wont be able to restart the admin service during business hours. 

total drive is 2000.00 GB (1.95TB) 

free space is 79.53GB (3%)

Andrew and others thanks for sticking through this.

[AndrewB]

so the drive is genuinely full and the warning seems to be accurate. 80GB is a pretty good chunk of free space. what you might consider doing is moving the oldest partition off to another location or to a lower tier of storage.

[goof717]

I will talk to the storage team to see if we can do that.  it doesnt explain what is causing the growth. or is it the collections?

[AndrewB]

if the drive only has closed partitions like you said then the change in size has to do with collections.

[TonySterling]

Also, an index rebuild will cause a bunch of archdvs files to be put onto the file system until the next run of the collection process.  Things like that.

[AndrewB]

that has to do with collections too... it's the counter-effect of how the system works when you have collections enabled.

[TonySterling]

yeah, that is why I mentioned it here.

[goof717]

appreciate the help guys.  you are all correct.  I spoke with Symantec support and they confirmed that it is the collections that is causing the growth, with the unpacking of cab files.  thanks for the patience and lesson.