# Random Temp File Creation



## RSpecianjr (Jan 20, 2010)

Hey everyone,

My Windows 2003 server is acting up. I am not sure how long its been going on, but every so often, not consistent, lots of temp files will be written to the C:/WINDOWS/Temp. The file size ranges from 200mb to 600mb. The filenames are pretty generic: tmp44.tmp tmp45.tmp... random numbers, usually in sort of consecutive order.

Its perplexing me and I can't figure out what program is making them. I have run multiple antivirus and malware programs with no results. 

Does anyone know how I can pinpoint the program making the temp files?

Regards,

Robert D. Specian Jr.


----------



## djaburg (May 15, 2008)

Is the server used to browse the web or as a "workstation"? Often that's the cause of those kinds of random temp files.


----------



## RSpecianjr (Jan 20, 2010)

Hey djaburg,

The server is really only used for Filemaker Pro, Exchange, and User Accounts. There is occassionally someone that will use it to surf, but nothing that would prompt multiple gigs of temp files. Also, the temp files will be created randomly and tremendously slow down the server to the point that everything remote goes offline... email goes down as does the network folders stored on the server. Its really rather bothersome haha. 

When I get disconnected, I know its creating the temp files. If I walk over to the server and open up the temp folder (which takes a moment to open), I can slowly see the temp files getting bigger. This goes on for about 20 minutes and when all is said and done the Temp folder goes from about 500 mb to 15+ gigs. At the time this is happening, there is nobody browsing. If I do a hard reboot, then the problem will go away until the next time it comes around.

I honestly haven't worked enough with Windows Servers to know where to go to begin to look. So any help would be appreciated.

Thanks,

Robert D. Specian Jr.


----------



## RSpecianjr (Jan 20, 2010)

:bump:


----------



## Corday (Mar 3, 2010)

I don't know if Wordpad can open something so big, but if you can open one in some program, there might be a clue as to what's happening.


----------



## TheOutcaste (Mar 19, 2009)

Might try sysinternals ProcessExplorer, it you can catch it when those files are being created.
Turn on the *Handles* window in the lower pane (CTRL+H, or *View | Lower Pane View | Handles*)
Set the Highlight duration to the max (9 seconds, *Options | Difference Highlight Duration*)
Then select each process and check the File handles to see if any are in the Windows\Temp folder.

Only thing that comes to mind that would be that large is a backup of somekind. My System State Backup is 565 MB, but I don't know if NTBackup first creates it in the Temp folder, then copies it to it's final destination.
If it does, and something goes wrong (can't access destination for example) it may keep trying without cleaning up after itself)

Wordpad should be able to open it, but it may take a a long time, especially if the file is larger than your installed RAM.
After 10 minutes in a VM with 512 MB RAM, wordpad showed only 1% complete on a 565MB file.
Notepad++ might deal with larger files better. Notepad++ loaded in it about 6 minutes. With 1 GB RAM, took Notepad++ 2 minutes.

Something to try first though, open a Command Prompt and use the *Type* command. It will stop at the first *Nul* byte, but may show the first line or two, which might help:
*type C:\Windows\Temp\tmp44.tmp*

For my SystemState backup, it lists the first line, which shows the *TAPE* FileID which is used by NTBackup.

```
[PLAIN]TAPE  ♥ 0☻#                                     ☻ ▬♠G┤[/PLAIN]
```


----------



## RSpecianjr (Jan 20, 2010)

Thanks! I am taking a long weekend so I'll be back Monday and check it out.

Much appreciated, 

Robert D. Specian Jr.


----------



## reventon (Oct 16, 2009)

Adding to TheOutcaste's comment - personal preference but I would use *ProcessMonitor* instead of *ProcessExplorer*

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

My reason for doing that - with the filters on Process Monitor you can set it up to only record file system activity in the relevant folder, and you can record for longer than 9 seconds (because the process may not be constantly accessing those large files). 

Once you have a trace then you can go through it and play around with the filters to close in on those exact files and see what is creating them.

One warning though - Procmon writes to the Page File, if you are running it for ~24 hours or so it will be using gigabytes of page.


----------



## jcgriff2 (Sep 30, 2007)

Summarize SysInternals ProcMon results - "Tools", "Cross Reference"

It will tell you file name, the writer and reader app name.


----------



## RSpecianjr (Jan 20, 2010)

Hey,

Thanks for all the info, I am running ProcMon right now and will let you all know what happens as soon as the issue starts happening. I like the filtration system on it, quite easy to handle.

Thanks,

Robert


----------



## RSpecianjr (Jan 20, 2010)

Hey Everybody,

Alright, so I finally got to have ProcMon running while the temp files were being created. Looks like Explorer.exe is creating the files.... yay... = (. Not to helpful to me, but perhaps someone else knows what I can do from here? 

I went back over there to try and do the cross reference idea J. C. Griffith gave. Somehow all the temp files are gone and ProcMon had an error and closed out. I don't think the issue is resolved, but I will let you know if the temp files keep getting made.

Thanks,

Robert D. Specian Jr.


----------



## reventon (Oct 16, 2009)

> FileMaker Pro for Windows uses temporary files during normal operation, and saves them by default in the Temp directory, which is by default C:\WINDOWS\TEMP.


http://help.filemaker.com/app/answe...-"cannot-create-temporary-file-filename[.tmp"

Not sure why they are showing as being written to by *explorer.exe* however I have noticed explorer.exe writing to files on the behalf of other programs before... not sure at all why that happens.

At least you now know what is the cause.


----------



## jcgriff2 (Sep 30, 2007)

RSpecianjr said:


> I went back over there to try and do the cross reference idea J. C. Griffith gave. Somehow all the temp files are gone and ProcMon had an error and closed out. I don't think the issue is resolved, but I will let you know if the temp files keep getting made.


How long was ProcMon running for? ProcMon writes directly to the page file and can write GB's of output in an hour or two.

For info about ProcMon's crash, check - 
1. WERCON - 
START | type* view * | "View all Problem Reports" | 2x-click on Process Monitor line item for additional crash info

2. Reliability Monitor - 
START | type *perfmon /rel* | click on red x's

Kind Regards. . .

John

`


----------



## RSpecianjr (Jan 20, 2010)

Hey,

Thanks for the replies! 

I haven't really seen the problem happening anymore, but there have been times where it died down... so I am just waiting for it to happen again. We have had Filemaker for a while... and the problem hasn't been that long. Could be coincidence though... so I am not ruling it out. 

Ill let you guys know when it happens again, as I am sure it will. = )

Thanks!

Robert


----------



## RSpecianjr (Jan 20, 2010)

Hey,

It is still happening... The files tend to be fairly consistent in size, around 384,439 KB. As before it claims to be made by explorer.exe. Its mindboggling to me and I cannot figure out whats going on! 

When the files are being created, everything slows else slows down to the point where we cannot use the server. Our exchange disconnects and we cannot remotely access files. If we are on the server itself, it is sluggish, multiple minutes to open. When the temp files are done being created or after a reboot, everything comes back to normal.

It seems to be consistent with time, always in the morning right about when we get here 8ish.

Any more ideas?

Thanks,

Robert D. Specian Jr.


----------



## RSpecianjr (Jan 20, 2010)

Hey,

So, it looks like Store.exe is eating up lots of the CPU usage. Bounces up and down a lot but seems to be in tune with the temp file creation. I'm so lost haha

Hope someone can help,

Robert D. Specian Jr.


----------



## jcgriff2 (Sep 30, 2007)

Hi Robert. . .

If you don't mind, system files may yield clues - Blue Screen of Death (BSOD) Posting Instructions

Save time -- download these 2 files; save to Documents directory -

1. http://live.sysinternals.com/autoruns.exe
2. http://sysnative.com/0x8/BSOD_Windows7_Vista_v2.60_jcgriff2_.exe

RIGHT-click on #2, "Run as Administrator"

~5 minutes, Windows Explorer will open and hilite a new directory in Documents named Windows7_Vista_jcgriff2

Zip it up and attach to post.

Happy Holidays !

John

`


----------



## jcgriff2 (Sep 30, 2007)

Apologies, Robert.

You are Server 2003.... 

This is #2 files to run - http://jcgriff2.com/0x2/BSOD_XP_v1.3_jcgriff2_PROD_.exe

John


----------



## RSpecianjr (Jan 20, 2010)

Hey,

Ran the applications and sent you the files in a private message, will let everyone know if we find a solution or any good information.

Thanks,

Robert D. Specian Jr.


----------



## jcgriff2 (Sep 30, 2007)

Hi Robert. . .

*NtFrs* service hung 5x, 30 secs each time; 2 hour period - 



NtFrs = NT File Replication Service. From what I read, FRS detects file creation/ modification, then copies it to the other servers. Any chance FRS could be creating the temp files? 

I found a KB on FRS, although it does not mention \windows\temp - http://support.microsoft.com/kb/221112


There are > 100 of these errors in a 4 hour period - 

```
[font=lucida console]
Type :		Error
Date :		12/21/2010
Time :		17:03:25
Event :		3015
Source :		Server ActiveSync
Category :	None
User :		N/A
Computer :	SERVER
Description:
The description for Event ID ( 3015 ) in Source ( Server ActiveSync ) 
        could not be found. 
	It contains the following insertion string(s): .
	[COLOR=Red]80004005[/COLOR]
	2883
[/font]
```
0x8004005 = unable to connect with servers. I usually see this error code related to Windows Updates, i.e., Microsoft Servers


Has Process Monitor been running this whole time? I found a few log entries showing ProcMon crashed -

```
[font=lucida console]
Application popup: Process Monitor: Procmon.exe - 
	Application Error : The instruction at "0x00406363" referenced memory 
	at "0x003ffe30". The memory could not be "read".[/font]
```
That entry could refer to virtual or physical memory. ProcMon writes output to the Page File.


AutoRuns shows - 
- 2 dead entries for Punch Clock Server
- 1 " " Network Manager
- Intuit Sync Manager

Don't know the exact effect these entries have here. Could Intuit Sync be interfering/ competing with FRS -- or at least causing FRS to work overtime?




AutoRuns - Services tab - 


> *WinHttpAutoProxySvc*
> Implements the Web Proxy Auto-Discovery (WPAD) protocol for Windows HTTP Services (WinHTTP). WPAD is a protocol to enable an HTTP client to automatically discover a proxy configuration. If this service is stopped or disabled, the WPAD protocol will be executed within the HTTP client's process instead of an external service process; there would be no loss of functionality as a result.
> 
> File not found: winhttp.dll




Here are running processes in decending RAM usage order - 



```
[font=lucida console]
Image Name                     PID Session Name        Session#    Mem Usage Status          User Name                                              CPU Time 
========================= ======== ================ =========== ============ =============== ================================================== ============ 
store.exe                     5444 Console                    0    387,344 K Unknown         NT AUTHORITY\SYSTEM                                     0:14:55 
services.exe                   592 Console                    0    135,444 K Unknown         NT AUTHORITY\SYSTEM                                     0:01:41 
fmadminserver.exe             2276 Console                    0    106,652 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:32 
fmscwpe.exe                   2708 Console                    0     96,240 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:06 
wmiprvse.exe                  5952 Console                    0     84,572 K Unknown         NT AUTHORITY\NETWORK SERVICE                            0:02:17 
fmserver.exe                  2240 Console                    0     75,256 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:03 
fmswpc.exe                    2676 Console                    0     72,208 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:06 
spoolsv.exe                   1448 Console                    0     54,620 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:12 
sqlservr.exe                  2580 Console                    0     49,420 K Unknown         DAC\PVAdmin                                             0:00:06 
w3wp.exe                      3372 Console                    0     43,592 K Unknown         NT AUTHORITY\SYSTEM                                     0:03:45 
dns.exe                       1740 Console                    0     36,872 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:01 
svchost.exe                   1064 Console                    0     32,772 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:31 
inetinfo.exe                  1972 Console                    0     31,212 K Unknown         NT AUTHORITY\SYSTEM                                     0:01:01 
lsass.exe                      604 Console                    0     26,624 K Unknown         NT AUTHORITY\SYSTEM                                     0:04:47 
explorer.exe                  5408 RDP-Tcp#2                  1     23,212 K Running         DAC\administrator                                       0:01:08 
fmshelper.exe                 1844 Console                    0     22,864 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
mad.exe                       4032 Console                    0     19,944 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:03 
PVDMAutoSvc.EXE               2872 Console                    0     18,424 K Unknown         DAC\PVAdmin                                             0:00:09 
iexplore.exe                  8876 Console                    0     18,332 K Unknown         DAC\administrator                                       0:00:00 
hpsmhd.exe                    4236 Console                    0     16,784 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
dxdiag.exe                   10188 RDP-Tcp#2                  1     16,616 K Not Responding  DAC\administrator                                       0:00:00 
wmiprvse.exe                  5984 Console                    0     15,284 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
explorer.exe                 10184 Console                    0     15,260 K Unknown         DAC\administrator                                       0:00:01 
QBCFMonitorService.exe        2928 Console                    0     14,584 K Unknown         NT AUTHORITY\SYSTEM                                     0:03:45 
Pclock.exe                    5644 Console                    0     10,968 K Unknown         DAC\administrator                                       0:00:01 
hpsmhd.exe                    4060 Console                    0     10,668 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
svchost.exe                    844 Console                    0      8,752 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
ismserv.exe                   1992 Console                    0      7,816 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
dllhost.exe                   6552 Console                    0      7,664 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
QBDBMgrN.exe                  7088 Console                    0      7,340 K Unknown         DAC\QBDataServiceUser19                                 0:00:00 
emsmta.exe                    5664 Console                    0      7,104 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
vcagent.exe                   1700 Console                    0      7,100 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
exmgmt.exe                     784 Console                    0      6,972 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
wins.exe                      3932 Console                    0      6,740 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
llssrv.exe                    2100 Console                    0      6,084 K Unknown         NT AUTHORITY\NETWORK SERVICE                            0:00:00 
TimounterMonitor.exe         10132 Console                    0      5,900 K Unknown         DAC\administrator                                       0:00:00 
TimounterMonitor.exe          6092 RDP-Tcp#2                  1      5,868 K Running         DAC\administrator                                       0:00:00 
winlogon.exe                  7544 RDP-Tcp#2                  1      5,460 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:05 
svchost.exe                   1000 Console                    0      5,428 K Unknown         NT AUTHORITY\NETWORK SERVICE                            0:00:00 
dfssvc.exe                    1720 Console                    0      5,176 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
svchost.exe                   6532 Console                    0      5,092 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:01 
dllhost.exe                   1552 Console                    0      4,712 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
wmiprvse.exe                 12068 Console                    0      4,708 K Unknown         NT AUTHORITY\LOCAL SERVICE                              0:00:00 
msdtc.exe                     1484 Console                    0      4,608 K Unknown         NT AUTHORITY\NETWORK SERVICE                            0:00:00 
csrss.exe                      516 Console                    0      4,596 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:02 
tasklist.exe                 11176 RDP-Tcp#2                  1      4,356 K Unknown         DAC\administrator                                       0:00:00 
svchost.exe                    932 Console                    0      4,268 K Unknown         NT AUTHORITY\NETWORK SERVICE                            0:00:03 
svchost.exe                   3888 Console                    0      4,220 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
mDNSResponder.exe             1656 Console                    0      4,180 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
iexplore.exe                  3692 Console                    0      4,108 K Unknown         DAC\administrator                                       0:00:00 
csrss.exe                     7516 RDP-Tcp#2                  1      3,980 K Running         NT AUTHORITY\SYSTEM                                     0:00:04 
sqlwriter.exe                 3808 Console                    0      3,968 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
rdpclip.exe                   8176 RDP-Tcp#2                  1      3,952 K Running         DAC\administrator                                       0:00:00 
winlogon.exe                   544 Console                    0      3,896 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:01 
svchost.exe                   1036 Console                    0      3,864 K Unknown         NT AUTHORITY\LOCAL SERVICE                              0:00:00 
smhstart.exe                  3844 Console                    0      3,584 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
acrotray.exe                   672 Console                    0      3,520 K Unknown         DAC\administrator                                       0:00:00 
acrotray.exe                  6396 RDP-Tcp#2                  1      3,508 K Running         DAC\administrator                                       0:00:00 
cisvc.exe                     1680 Console                    0      3,480 K Unknown         NT AUTHORITY\SYSTEM                                     0:02:38 
ctfmon.exe                     596 RDP-Tcp#2                  1      3,464 K Running         DAC\administrator                                       0:00:00 
svchost.exe                    764 Console                    0      3,264 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
ctfmon.exe                    8052 Console                    0      3,256 K Unknown         DAC\administrator                                       0:00:00 
cidaemon.exe                  8024 Console                    0      3,152 K Unknown         NT AUTHORITY\SYSTEM                                     0:08:01 
mdm.exe                       2136 Console                    0      3,100 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
BSOD_XP_v1.3_jcgriff2_PRO     9064 RDP-Tcp#2                  1      2,852 K Running         DAC\administrator                                       0:00:00 
schedhlp.exe                  8556 Console                    0      2,816 K Unknown         DAC\administrator                                       0:00:00 
schedhlp.exe                  5912 RDP-Tcp#2                  1      2,808 K Running         DAC\administrator                                       0:00:00 
jusched.exe                   5900 RDP-Tcp#2                  1      2,800 K Not Responding  DAC\administrator                                       0:00:00 
jusched.exe                  10884 Console                    0      2,796 K Unknown         DAC\administrator                                       0:00:00 
schedul2.exe                  1588 Console                    0      2,776 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
svchost.exe                   1792 Console                    0      2,700 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:02 
sqlbrowser.exe                3720 Console                    0      2,632 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
cpqteam.exe                   6176 RDP-Tcp#2                  1      2,564 K Running         DAC\administrator                                       0:00:00 
locator.exe                   3684 Console                    0      2,460 K Unknown         NT AUTHORITY\NETWORK SERVICE                            0:00:00 
cpqteam.exe                   1072 Console                    0      2,388 K Unknown         DAC\administrator                                       0:00:00 
svchost.exe                   3176 Console                    0      2,248 K Unknown         NT AUTHORITY\LOCAL SERVICE                              0:00:00 
svchost.exe                   2796 Console                    0      2,224 K Unknown         NT AUTHORITY\LOCAL SERVICE                              0:00:00 
TrueImageMonitor.exe          2588 RDP-Tcp#2                  1      2,096 K Running         DAC\administrator                                       0:00:00 
rotatelogs.exe                4280 Console                    0      1,988 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
rotatelogs.exe                4176 Console                    0      1,976 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
rotatelogs.exe                4288 Console                    0      1,972 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
rotatelogs.exe                4184 Console                    0      1,960 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
cmd.exe                      11476 RDP-Tcp#2                  1      1,940 K Unknown         DAC\administrator                                       0:00:00 
jqs.exe                       2004 Console                    0      1,824 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:01 
TrueImageMonitor.exe          7288 Console                    0      1,760 K Unknown         DAC\administrator                                       0:00:00 
sysdown.exe                   3828 Console                    0      1,568 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
ntfrs.exe                     2660 Console                    0      1,456 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:02 
mssearch.exe                   352 Console                    0      1,340 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
cidaemon.exe                  8184 Console                    0        904 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
smss.exe                       380 Console                    0        488 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
cidaemon.exe                  7868 Console                    0        440 K Unknown         NT AUTHORITY\SYSTEM                                     0:00:00 
System                           4 Console                    0        228 K Unknown         NT AUTHORITY\SYSTEM                                     0:03:02 
System Idle Process              0 Console                    0         16 K Unknown         NT AUTHORITY\SYSTEM                                    15:36:09 

[/font]
```

I am unsure exactly what is creating those temp files. Top of my suspect list would be - 
- FRS
- Intuit Sync
- Acronis
- other similar sync apps

I know there are no real answers here Robert, but I wanted to post items that I found of interest in the hopes that Q & A can continue with a visible foundation.

Is the summary info from ProcMon helpful at all? Does it "catch" the app writing these temp files?

Happy Holidays !

John


----------



## RSpecianjr (Jan 20, 2010)

Hey guys,

Thanks for all the info! I've been going through those applications/services and trying to narrow down which one it could be. None of them seem to be affecting the temp file creation. The only process I can find that is, is Store. If I end the Store process, it will halt and remove the temp files that were being created.

The only information I really got out of ProcMon was the main process was explorer.exe, not sure why it would pop up in the temp folder so much, I believe they were queries. Store was also in ProcMon, but not as often.

The only thing I can think of that is tied to Store.exe is the Exchange server... = ( do you know of any other programs that use Store.exe?

Many thanks!!

Robert D. Specian Jr.


----------



## Corday (Mar 3, 2010)

Just in case you didn't see this Microsoft site: http://support.microsoft.com/kb/925252


----------



## jcgriff2 (Sep 30, 2007)

Nice find.

Store.exe does appear related to Exchange Server.


----------



## RSpecianjr (Jan 20, 2010)

Hey guys,

I am out of the office the rest of the week, but I have a good feeling about this!

Truly great find Corday, I really appreciate it!

Mucho Gracias!

Robert D. Specian Jr.


----------



## RSpecianjr (Jan 20, 2010)

Hey everybody! It's me again Margaret!

Okay, so I think we are making a bit of progress. I have Exchange 2003, so that particular link wont help, but I thought the theory might. I checked for any updates or hotfixes and I couldn't find any.

One thing I did find is an attribute that might be of help: 

msExchESEParamCacheSizeMin

I followed the instructions on Microsoft Technet...
How to Set the msExchESEParamCacheSizeMin Attribute

But I ran into one small problem... haha I am missing the attribute = / which might explain things. I have looked to see if anyone else has had this attribute missing, but couldn't find anything on it. I feel pretty confident that if I can find or replace that attribute that I can adjust the setting to prevent it from freezing the server.

I don't know if the temp files will build up over time, but the occassional clearing of temp files is much better than it freezing all the time.

Thanks

Robert D. Specian Jr.


----------



## Corday (Mar 3, 2010)

Something I forgot before. Did you try Event Viewer Application log. I'm thinking that if Exchange doesn't close properly additional temp files are created, so restarting gets slower and slower. Really outside the box --- get a 2 tetrabyte external HD and divert all Temp files to it (just kidding).


----------



## RSpecianjr (Jan 20, 2010)

Hey Corday,

I've checked the Application Log in the past and couldn't find anything, there was another guy that looked at it too and he was befuddled. Though, now that we know what we are looking for it might be a little different though. Next time the issue runs its course I will try and capture the log and post it.

Hmm, we are a non-profit so we can't afford an external harddrive. Whats your server address? Ill just send them your way. = P

Thanks,

Robert

Edit: I'd still like to know about the missing Exchange Attribute I mentioned before, if anyone knows anything about it. Gracious!


----------



## RSpecianjr (Jan 20, 2010)

Hey everybody,

It happened again this morning and now my boss is getting po'd about it. So, time, as always, is of the essence. I am attaching the application event log. We did a manual restart at 8:01:48 AM (the seconds may be off by a few).

Please let me know if you find anything or if the you know anything about the Missing Exchange Attribute I mentioned above. Again the Attribute is:

msExchESEParamCacheSizeMin

Many Thanks!

Robert D. Specian Jr.

Had to zip the log due to its size, thanks!


----------



## Corday (Mar 3, 2010)

The attribute determines the cache size based on the amount of available memory. It's supposed to be self figuring/automatic.


----------



## RSpecianjr (Jan 20, 2010)

Hey Corday,

Yeah, but do you know why it would be missing? I imagine it might be the cause of the memory usage shooting through the roof, if nothing is there to control it. This is just speculation on my part though.

Regards,

Robert


----------



## Corday (Mar 3, 2010)

Even though you don't see it now, what happens if you use the ADSI Utility in the Support/Tools folder on your servers CD ROM? Using your FQDN, get to the missing attribute and see what editing possibilities exist. If your 501 (c) ? CEO (yes, I've worked with not for profits) is so hyper, tell them what an outside consultant charges per hour and what effect it would have on the budget if a full day had to be spent.


----------



## RSpecianjr (Jan 20, 2010)

Hey Corday,

501 (c) is correct! He will be alright haha. 

As I am not terribly familiar with this, I am not sure what you are referring to (might just be the acronyms). Can you post a step by step?

Regards,

Robert


----------



## Corday (Mar 3, 2010)

Source: ESE Event ID: 804 (Exchange 6.5.6940.0) - Technet Events And Errors Message Center: Message Details
Step by step. Good luck!


----------



## RSpecianjr (Jan 20, 2010)

Hey Corday,

I haven't had a chance to go through the steps, as I do not have the installation disc. I am getting a copy of it tomorrow, but my boss is now wanting me to upgrade our server completely haha. OS and Exchange. So who know what will happen then. 

I'll see if I can test out the above solution first though.

Regards,

Robert D. Specian Jr.


----------



## jcgriff2 (Sep 30, 2007)

If it turns out to be a 3rd party app creating the temp files, you'll suffer the same++ under the new system !!

Are you upgrading to Server 2008 or Server 2008RC or..?

It would be nice to figure this puzzle out.


----------



## i MaRk i (Dec 29, 2009)

> this problem occurs because the index is not available when the Microsoft Exchange Information Store service tries to create an index-based view. It takes lots of CPU resource to create such views.


Have you tried creating an index throughout the system?

this may help:
Working With the Windows Server 2003 Indexing Service

Regards,

Mark


----------



## Geekgirl (Jan 1, 2005)

What anti-virus is installed? Any backup program installed? Check to see whats scheduled, possibly client system backing up to server. Is there any network traffic going on at this time?


----------



## Dave Atkin (Sep 4, 2009)

Hi Robert,

Just to throw it out there.... I have had viruses before that have duplicated certain files to waste disk space. Sounds silly but have you ran a virus scan on the Server?

Also, if you are running sharepoint on the Server take a look at this to see if this helps (It may not be relivent but who knows!):

Download details: .NET Framework 1.1 Temporary File Explosion on SharePoint Servers - Windows Server 2003


Dave


----------



## RSpecianjr (Jan 20, 2010)

Hey guys,

Sorry for the delay, this issue has had to be put off due to other pressing matters. I'll be back in the office in the morning to get back with specifics but here is what I know at the moment.

We have narrowed it down to Store.exe creating the files. Whether it is truly part of exchange or something hijacking is still up for question.

We had Symantec anti-virus and backup software installed. It was one of the first things I removed to try and alleviate the issue. 

As far as network traffic, it isn't anything outside of the norm. Mostly document files being scanned in or accessed via network drives. The only server software we have on there is going to be Quickbooks, filemaker pro, and exchange. All three are used daily but there is only a total of 9 people that have access. Only 2 use Quickbooks. Filemaker usage is small at best. Our email usage is fairly limited as well. 

Though, come to think of it, we did switch over from ISP's a while back. Not sure if it's relevant, but we now host our own email. Previously it was handled by our ISP. I cannot recall the timing of it all so the problem may have started prior to our ISP switch over.

Since the removal of the Antivirus software I have been doing consistent scans. Either with NOD32 and Malware Bytes.

Many thanks,

Robert


----------

