Big size of Ntfs/MFT reservation on windows server 2022

Question

Hi,

Over 1 month ago I started to have have problems with free space on drive C: as it's suddenly started to decrease every day.

External tools like TreeSize od Dirstat weren't able to show what is "eating" space.

Finnaly it turned out that for some reason NTFS/MFT allocates enormous space, and it's freeing it up only after the server restart or within few minutes after somebody is logon via RDP session to the server.

Reserved space is visible via cmd line and attribute "Total Reserved clusters". Total reserved size when somebody is logon is aroud 44gb, but if I logoff and wait couple of hours, space occupied by reservation will increase by another few Gb's/.

I checked c: volume by running chkdsk, but is healthy. There are no quota settings on drive nor shadow copies set.

On the other Win2022 Server this NTFS occupying only around 1Gb, so where is the problem ?

Can you advise ??

This issue concerns: Windows Server 2022 Standard + Exchange 2019 (on-premise).

PS C:\Windows\system32> fsutil fsinfo ntfsinfo c:

NTFS Volume Serial Number : 0x0edc1ca0dc1c83dd

NTFS Version : 3.1

LFS Version : 2.0

Total Sectors : 429,705,215 (204.9 GB)

Total Clusters : 53,713,151 (204.9 GB)

Free Clusters : 27,462,030 (104.8 GB)

Total Reserved Clusters : 11,536,195 ( 44.0 GB)

Reserved For Storage Reserve : 0 ( 0.0 KB)

Bytes Per Sector : 512

Bytes Per Physical Sector : 512

Bytes Per Cluster : 4096 (4 KB)

Bytes Per FileRecord Segment : 1024

Clusters Per FileRecord Segment : 0

Mft Valid Data Length : 552.75 MB

Mft Start Lcn : 0x00000000000c0000

Mft2 Start Lcn : 0x0000000000000002

Mft Zone Start : 0x0000000002d20240

Mft Zone End : 0x0000000002d25180

MFT Zone Size : 79.25 MB

Max Device Trim Extent Count : 64

Max Device Trim Byte Count : 0x2000000

Max Volume Trim Extent Count : 62

Max Volume Trim Byte Count : 0x2000000

Resource Manager Identifier : 393C6EFA-7A42-11ED-BF42-AD3018B76F78

Answer 1

Do you have some process that is creating a lot of little files? Small files are stored in the MFT.

This Powershell statement will add up the size of all small files. Maybe compare a few servers.

Get-ChildItem c:\ -file -recurse -Force -ea SilentlyContinue | Where-Object -Property Length -lt 512 | Measure-Object -Sum Length

If it's logon related, you can display the names of small files in the Users directory with this.

(Get-ChildItem c:\users -file -recurse -Force -ea SilentlyContinue | Where-Object -Property Length -lt 512).fullname | more

Answer 2

Thanks for hint, but I think that I know more or less what happened as finally I was managed to decreased reserved space. I achieved it by turning off compression on several folders.

As I mentioned server has Exchange roles installed, therefore there are logs stored on c:\ drive .

Some logs I'm deleting automatically by powershell script, but still there are lot's of logs where compression is enabled. Once I disabled compression, accupied space significally decreased.

However it's odd that compressed security logs in default location C:\Windows\System32\winevt\Logs, with normal size of 25gb (9,57 compressed) is almost equal to the size of reserved space.

PS C:> fsutil fsinfo ntfsinfo c:

NTFS Volume Serial Number : 0x0edc1ca0dc1c83dd

NTFS Version : 3.1

LFS Version : 2.0

Total Sectors : 429,705,215 (204.9 GB)

Total Clusters : 53,713,151 (204.9 GB)

Free Clusters : 25,461,707 ( 97.1 GB)

Total Reserved Clusters : 6,258,186 ( 23.9 GB)

Reserved For Storage Reserve : 0 ( 0.0 KB)