I was reviewing the event log of a Small Business Server I monitor and noticed that a user had hit their disk space quota on the C drive. Since users don’t usually have access to the C drive I and the user in question was one of the IUSR_ accounts (that are usually used for IIS anonymous access, among other things) I needed to investigate.

Google found a reference to the “fsutil” utility to list files by owner. The command I used was “fsutil file findbysid IUSR_account c:\” and the files were all in the Trend Micro PCCSRV\Temp folder and the Trend Micro PCCSRV\Virus folder. I could not log into the Trend Micro dashboard (it would immediately return an error message that the session had timed out.) Deleted all the *.TMP files in PCCSRV\Temp and then I could log into the dashboard. Used the dashboard to delete quarantined files and all was good again.

Lessons learned:

1. Small Business Server performance monitor does not report quota alerts.

2. Trend Micro CSMSMB (at least version 3.6) leaves lots of TMP files behind even if you set it to do automatic log maintenance and won’t automatically clean out the quarantine folder (at least I couldn’t find a setting for that.)

3. fsutil to find files by owner. Much better than “dir /q | find”.

No tags

No comments yet.

<< Katrien’s MSDN Blog : Silverlight and the HTML page: let your Silverlight do the work

First Post Using Live Writer >>