[RESOLVED] Growing amount of missing disk space on Microsoft Exchange

Abstract: On a Microsoft Exchange Server you discovered that something is eating slowly the disk space and you need to find out the reason for that.

Troubleshooting:

Step 1:

So the first troubleshooting step you need to do is to check the size from all files on the disk and compare that against the size from the disk itself:

In the example above you can see that all files on that disk need around 113 GB disk space, but more then 312 GB disk space is used. So it must be a background process which takes the amount of around 199 GB disk space, for example the Volume shadow copy (VSS).

Step 2:

We need to check now which store the Volume shadow copy (VSS) is using. This can be done via:

vssadmin list shadowstorage

and in our example it shows:

C:\Windows\system32>vssadmin list shadowstorage
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Shadow Copy Storage association
   For volume: (D:)\\?\Volume{5eed2ff6-6151-46df-ab94-7b3bfb749c2a}\
   Shadow Copy Storage volume: (S:)\\?\Volume{99bd5a1f-4d5f-40ab-980f-6ed8ae8ed69d}\
   Used Shadow Copy Storage space: 112 GB (21%)
   Allocated Shadow Copy Storage space: 113 GB (21%)
   Maximum Shadow Copy Storage space: UNBOUNDED (3278399746%)

Shadow Copy Storage association
   For volume: (E:)\\?\Volume{b7022f37-d486-4363-8167-be7b8e0c119d}\
   Shadow Copy Storage volume: (S:)\\?\Volume{99bd5a1f-4d5f-40ab-980f-6ed8ae8ed69d}\
   Used Shadow Copy Storage space: 79.5 GB (15%)
   Allocated Shadow Copy Storage space: 79.9 GB (15%)
   Maximum Shadow Copy Storage space: UNBOUNDED (3278399746%)

If we count 112 GB + 79,5 GB we get 191,5 GB which is very close towards the disk space we are missing here. So we need to check out which service is currently using the Volume shadow copy (VSS).

Step 3:

To check what is using Volume shadow copy (VSS) we can use:

vssadmin list writers

which should output the following:

C:\Windows\system32>vssadmin list writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

<CUT>

Writer name: 'Microsoft Exchange Writer'
   Writer Id: {76fe1ac4-15f7-4bcd-987e-8e1acb462fb7}
   Writer Instance Id: {1bcf28f2-653c-4101-9ff7-11bcd9254c45}
   State: [5] Waiting for completion
   Last error: No error

<CUT>

In the case above we can see the MS Exchange writer is waiting for completion. So the next step is to check the status from the Microsoft Exchange Backup.

Step 4:

To find out if a backup is in progress we can use:

get-MailboxDatabase -Status -server exch01.int.contoso.com | FL Name,*Backup*

which will outline the following:

Name                           : EXCHMB1
BackupInProgress               : True
SnapshotLastFullBackup         : True
SnapshotLastIncrementalBackup  : True
SnapshotLastDifferentialBackup :
SnapshotLastCopyBackup         :
LastFullBackup                 : 2017-02-15 03:05:33
LastIncrementalBackup          : 2017-02-21 03:05:11
LastDifferentialBackup         :
LastCopyBackup                 :
RetainDeletedItemsUntilBackup  : True

We can see that “BackupInProgress” is on True which means that an Microsoft Exchange backup is still in progress.

Solution:

The disk space issue should be solved once the MS Exchange Backup finished.

Workarounds:

In some rare situations it might be needed to take corrective actions in order to prevent that the server will crash, due to the reason that there is no disk space left on the server. Some of the are outlined below.

The steps below should be only be done when know what you are doing here!

Workaround 1:

You can reboot the affected server.

Workaround 2:

1.) Open a CMD

2.) Start the disk shadow console via:

diskshadow

3.) inside the new console enter:

delete shadows all

to delete all disk shadows

Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  DEFFMEXCH01,  2017-02-22 18:45:39


DISKSHADOW> delete shadows all
Deleting shadow copy {d1d43a8b-8388-40cf-96c9-b6490196bf12} on volume \\?\Volume{5eed2ff6-6151-46df-ab94-7b3bfb749c2a}\ from provider {b5946137-7b9f-4925-af80-51abd60b20d5} [Attrib
utes: 0x00020000]...
Deleting shadow copy {2457c371-1758-45ac-8bd1-45f7ab258553} on volume \\?\Volume{b7022f37-d486-4363-8167-be7b8e0c119d}\ from provider {b5946137-7b9f-4925-af80-51abd60b20d5} [Attrib
utes: 0x00020000]...

Number of shadow copies deleted: 2

DISKSHADOW>