If you have any doubts, we will be doing it from the command line. Just want to put that out before we start. Also, it turned out this is a long and boring article; deal with it.
So, where were we? Disk space and what is using it. That is a problem common to all OS: you have a partition without infinite disk space (sorry ZFS, it happens sometimes) and is running out of space:
- Sometimes it is a careless user; some OS allow you to tell non-system programs, like the ones run by a user, can only use up to 95% of the disk. This way we have some space to fix things.
- Sometimes it is actually a program being run as a system/root/admin account, which is trouble since it can use up the entire partition.
If the machine in question is a server, a Windows server since that is what we wrote in the name of the article, we might not be able to just ignore it; others will be affected by this. So, how to take care of this problem? The lazy fix is to throw more space at it and move on. The proper solution is to find out who is hoarding all the space and why. I would like to talk about doing the right thing.
The standard Windows approach would be to search for some app online, which must have a graphics interface and ideally from some site with a name like "finddiskusage.com" because such domain names do inspire confidence, right? Specially when the site's text is pretty much "You do not know what is using your disk space? Click here to download the solution!" Any relationship with a phishing email is merely coincidental.
So, after downloading this shady program from the suspicious website, we then install it and make sure to turn off the firewall and run it with admin rights. And after it does what we hope it is supposed to do, we then take a screenshot of the output and paste it to our documentation.
I do not know about you but I really do not like to install programs in any server, be it windows/linux/mac/solaris/aix/whatever. I think they should have only the bare minimum to do their job; you should see my Linux servers. Since I am the one writing this article, I will put my dictator hat and look for something that fits my style.
In Unix in general and Linux as a special case there is a program called du which allows you to check the disk usage at a given location. You can be short and only show, say, how much all the files and directories (folders in Windows) inside a given directory, or go recursively and show detailed views for every single directory inside the original one. Output is text, which means you can feed it to something else like sort or some program that will make a decision based on the data.
It would be really cool if there was something like that in Windows. One can dream...
Thing is, we do not have to wait for unicorns and fairies to come up with a solution. Nor we have to reinvent the wheel. You see,
- There is something like that natively for windows. I do like cygwin but that requires installing yet another collection of packages that need to be patched and upgraded. Kinda wasteful if all you want is little du. I believe less is more.
- It is called du just like the unix one.
- You do not need to look for it in some shady or just compromised site. You can find it right at Microsoft as part of the sysinternals package(s).
- You do not even need to install anything. Just put its directory somewhere you want to use it, including a USB or network drive, and run it from there.
Not bad if you ask me. Enough talk, let's use it.
Using du
The most common way I use du in Windows is like I use in Linux:
C:\Documents and Settings\raub>"\Documents and Settings\raub\My Documents\DU\du.exe" -l 1 \windows >> du.log
Du v1.5 - report directory disk usage
Copyright (C) 2005-2013 Mark Russinovich
Sysinternals - www.sysinternals.com
C:\Documents and Settings\raub>
Ok, it is old but it is not like it is getting more and more useless features to make it bloated. Like interfacing with your bluetooth-enabled IoT-based massage chair. Let me show it in action with a real (!) example: at work I have a Windows 10 vm for desktop. And as you can see, it ran out of disk disk space:
That's not much free space left! If you know Windows, it will get really slow when its boot/OS disk is that full. I am going to assume I should first check the Users directory. If I am wrong, I would then check the Windows one, First I would like to make a point I will be running du.exe off a network fileshare, strongbadia
PS C:\Users\raub> ls \\spacemoose\users\raub\bin
Directory: \\strongbadia\users\raub\bin
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/21/2018 9:32 AM 169072 du.exe
-a---- 5/21/2018 9:32 AM 191616 du64.exe
-a---- 6/28/2018 4:06 PM 543 GetDirSize4DateRange.ps1
-a---- 7/18/2017 10:12 AM 854072 putty.exe
PS C:\Users\raub>You are now getting to learn a few secret things about me! Yes I have a bin dir. Inside it you can see the du.exe and du64.exe. Both are very tiny compared to the crazy GUI programs you can get off suspicious sites to do the very same thing. And, that is all you need: those two files. Well, I will be running du.exe even though my guest is a 64bit windows vm. Because I can. So, let's see what is in the root dir for the users dir:
PS C:\Users\raub> \\strongbadia\users\raub\bin\du.exe -l 1 c:\users\
DU v1.61 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
31,480 c:\users\bob.adm
2,665 c:\users\Default
51,390,386 c:\users\raub
629,717 c:\users\raub.adm
2,727 c:\users\raub.tst
2,768 c:\users\Public
129,592 c:\users\windows-user
Files: 2429983
Directories: 9581
Size: 54,003,166,071 bytes
Size on disk: 59,917,407,544 bytes
PS C:\Users\raub>Man! My homedir is full of junk. What is that and where is it? Let's check it:
PS C:\Users\raub> \\strongbadia\users\raub\bin\du.exe -l 1 c:\users\raub\
DU v1.61 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
46,023,020 c:\users\raub\AppData
0 c:\users\raub\Contacts
1 c:\users\raub\Desktop
3 c:\users\raub\dev
1,836,295 c:\users\raub\Documents
3,551,535 c:\users\raub\Downloads
0 c:\users\raub\eqlgroupmgr
0 c:\users\raub\Favorites
1 c:\users\raub\Links
0 c:\users\raub\Music
0 c:\users\raub\OneDrive
5,012 c:\users\raub\Pictures
0 c:\users\raub\Saved Games
3 c:\users\raub\Searches
0 c:\users\raub\Videos
Files: 2425559
Directories: 3976
Size: 52,663,166,132 bytes
Size on disk: 58,521,224,472 bytes
PS C:\Users\raub>AppData! A conveniently normally invisible source of many out of space drives. Not to du it is. Let's keep going in:
PS C:\Users\raub> \\strongbadia\users\raub\bin\du.exe -l 1 c:\users\raub\appdata\
DU v1.61 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
45,780,916 c:\users\raub\appdata\Local
2,588 c:\users\raub\appdata\LocalLow
198,212 c:\users\raub\appdata\Roaming
Files: 2424970
Directories: 3898
Size: 47,085,278,621 bytes
Size on disk: 52,935,700,880 bytes
PS C:\Users\raub> \\strongbadia\users\raub\bin\du.exe -l 1 c:\users\raub\appdata\local\
[...]
PS C:\Users\raub> \\strongbadia\users\raub\bin\du.exe -l 1 C:\users\raub\appdata\local\Microsoft\Windows\INetCac
he\\
DU v1.61 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
239 c:\users\raub\appdata\local\microsoft\windows\inetcache\Content.MSO
878 c:\users\raub\appdata\local\microsoft\windows\inetcache\Content.Outlook
5,207 c:\users\raub\appdata\local\microsoft\windows\inetcache\Content.Word
18,852 c:\users\raub\appdata\local\microsoft\windows\inetcache\IE
39,825,165 c:\users\raub\appdata\local\microsoft\windows\inetcache\Low
0 c:\users\raub\appdata\local\microsoft\windows\inetcache\Virtualized
0 c:\users\raub\appdata\local\microsoft\windows\inetcache\WebTempDir
Files: 2410022
Directories: 55
Size: 40,806,752,248 bytes
Size on disk: 46,635,979,024 bytes
PS C:\Users\raub> \\strongbadia\users\raub\bin\du.exe -l 1 C:\users\raub\appdata\local\Microsoft\Windows\INetCache\low\
DU v1.61 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
39,819,877 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\IE
Files: 2408915
Directories: 34
Size: 40,780,969,849 bytes
Size on disk: 46,606,749,696 bytes
PS C:\Users\raub>That smells like that other nemesis of web browsers: Internet Explorer or Edge. What is inside that dir?
PS C:\Users\raub> ls C:\users\raub\appdata\local\Microsoft\Windows\INetCache\Low\IE\
PS C:\Users\raub> dir C:\users\raub\appdata\local\Microsoft\Windows\INetCache\Low\IE\
PS C:\Users\raub>
WTF? Why can't I see what is inside it? Let me du inside it:
PS C:\Users\raub> \\strongbadia\users\raub\bin\du.exe -l 1 C:\users\raub\appdata\local\Microsoft\Windows\INetCache\low\
DU v1.61 - Directory disk usage reporter
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
1,237,378 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\10EAXOSV
1,246,204 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\145KIAQM
1,235,782 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\2F8FLUJD
1,241,300 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\2VB3GL0K
1,250,215 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\5BZQD406
1,244,360 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\5IVFOAV9
[...]
1,251,347 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\TQ26RPSG
1,236,991 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\VQH18R7G
1,240,357 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\VYHW6URF
1,239,508 c:\users\raub\appdata\local\microsoft\windows\inetcache\low\ie\XYKKE45S
Files: 2408912
Directories: 33
Size: 40,775,554,697 bytes
Size on disk: 46,601,322,496 bytes
PS C:\Users\raub>
Before you ask, I am using a powershell window, where ls and dir behave the same. I came from unix so you can understand which one I prefer. So we have a ton (33) of stupid cache folders that the browser could not be bothered to delete after it quit. Thanks, Microsoft, for not cleaning after itself. Really. And, everything below c:\users\raub\appdata\local\microsoft\windows\inetcache\low is hidden (?). Alright then, off it goes! Command line cares not about hidden paths! Note: get-help can be seen as the powershell equivalent of the Unix/linux man.
PS C:\Users\raub> get-help rm
NAME
Remove-Item
SYNOPSIS
Deletes files and folders.
SYNTAX
Remove-Item [-Confirm] [-Credential ] [-Exclude ] [-Filter ] [-Force] [-Include
] -LiteralPath [-Recurse] [-Stream ] [-UseTransaction] [-WhatIf]
[]
Remove-Item [-Path] [-Confirm] [-Credential ] [-Exclude ] [-Filter ]
[-Force] [-Include ] [-Recurse] [-Stream ] [-UseTransaction] [-WhatIf] []
Remove-Item [-Stream ] []
DESCRIPTION
The Remove-Item cmdlet deletes one or more items. Because it is supported by many providers, it can delete many
different types of items, including files, folders, registry keys, variables, aliases, and functions.
In file system drives, the Remove-Item cmdlet deletes files and folders.
If you use the Stream dynamic parameter, it deletes the specified alternate data stream, but does not delete the
file.
Note: This custom cmdlet help file explains how the Remove-Item cmdlet works in a file system drive. For
information about the Remove-Item cmdlet in all drives, type "Get-Help Remove-Item -Path $null" or see Remove-Item
at http://go.microsoft.com/fwlink/?LinkID=113373.
RELATED LINKS
Online version: http://technet.microsoft.com/library/jj628241(v=wps.630).aspx
Remove-Item (generic); http://go.microsoft.com/fwlink/?LinkID=113373
FileSystem Provider
Clear-Content
Get-Content
Get-ChildItem
Get-Content
Get-Item
Remove-Item
Set-Content
Test-Path
REMARKS
To see the examples, type: "get-help Remove-Item -examples".
For more information, type: "get-help Remove-Item -detailed".
For technical information, type: "get-help Remove-Item -full".
For online help, type: "get-help Remove-Item -online"
PS C:\Users\raub> rm -force -recurse C:\users\raub\appdata\local\Microsoft\Windows\INetCache\low\IE
Note that since we are running this from the command line, I did not have to do the usual screenshot Windows blog and articles love so much. I could cut and paste the real output and put it here. I could also have piped it into some other script to use the output for its nefarious uses. FYI, the above command has been running for 38 minutes now and has not finished yet.
So, what I have done above in this real example can be also used with servers since
- We are using Microsoft published program.
- The program is self-contained and requires no installation.
- The program fears no hidden directories.
- The program has very small footprint.
- The program can be run locally, off a USB, or from a network drive.
If you can put up with not having a cute window with some animation, I think sysinternals' version of
du is a nice tiny add-on to a Windows server manager arsenal.
