This may be a silly question, but are you sure it's defrag that's causing the large snap shot file that you mentioned in your first post.
You also mentioned that you have renamed the defrag to defrag old, so has another defrag file been set up in spite of this.
That is a very good question and yes I am pretty sure it is the defrag. As the defragmentation value is at 0% most if not all the time. The large snapshot are huge at odd hours like 3AM or 6AM.
Second question, I did rename defrag.exe to .old and no I could not think of other defrag file. That is what got me stuck.
Check Disc Defragmenter & see when it was last run. Click the Start button, All Programs, Accessories, System Tools & then click on Disc Defragmenter.
When that opens it should show that it is disabled & it should show when it was last run.
I am using an SSD so I have it disabled & the last time it was run was 9 Dec 2014 at 2:30pm.
So I might have look at this the wrong way. I enabled the process creation monitor on and during 30 minutes interval between each backup. Here is the list of process that were created during the time before the unusually large snapshot happened.
taskhost.exe
WmiPrvSE.exe
Outlook.exe
SearchProtocolHost.exe
Osppsvc.exe
SearchFilterHost.exe
Acrobat.exe
VSSVC.exe
svchost.exe
conhost.exe
I don't see anything out of ordinary that could cause bigger than usual snapshot. Any suggestion?
Did you check Disc Defragmenter to see when it last ran as I suggested in Post #13. If the last run was not at the time of this large snapshot then it's not the problem.
You mentioned that the snapshots occur at 3AM & 6AM. What time do the auto backups occurs.
I think the snapshots are associated with the backup program, as backups require a frozen shot to actually do the backup if the system is in use, otherwise details of the system could constantly be changing, so it needs what is called a snapshot, which is like a picture snap we photograph with a camera that actually is a frozen shot of a constantly changing scene.
I have checked the disk defragmenter. Last run was 12/30/15 5:51AM. You might be right that it may not cause by disk defragmentation, but the fact that the disk defragmentation is always at 0% make me suspect the defragmentator. The backup software we use is indeed use a snapshot at disk level, so any change of the data block would cause larger than usual snapshot.
The event log I have been looking is between these time intervals in a day.
11:35PM - 12:05 AM, 2:58AM - 3:27AM, 6-50AM - 7:19AM, (these should be fine as during business hours) 9:43AM - 11:02AM, 1:54PM - 2:24PM, 8:12PM - 8:41PM, 11:06PM - 11:35PM.
The backup set to run all day 30 minutes interval. so the interval above are when it is unusually large.
Does the backup software use an incremental data backup or does it use a full system backup. An incremental backup only backs up the latest data changes to main backup.
From what you are saying it looks like it might be doing incremental backups at certain times & a full backup during the times when it is unusually large.
Just as a matter of interest how much space has been used on the OS hard drive. If the amount of space used on the hard drive is say 150gb & the snapshot is about the same size then this could be what is happening. This suggestion is just food for thought.
It's doing incremental on all snapshot. i have a base image created year or so ago. Machine 1 used space is about 58GB. Normal incremental every 30minutes are a few megabytes and the large one are 200MB+. Machine 2 (I can't test on this one), it is using 300GB. Each snapshot it made are rougly 150GB - 200GB and normal size are usually at a few MB for hourly snapshot before this issue happened.
It looks like machine 1 might be operating properly as the backups are what would seem reasonable.
But on machine 2 it seems that something else is happening to cause the huge snapshot.
You could try this program to find out what is possibly causing the snapshot to be so large. This program lists what space is being used by what. I have used it & found it very helpful in trying to find where disc space has gone. While you probably don't want to know where disc space has gone it might help you see a program that might be causing the large snapshot. It's a free download.
https://www.jam-software.com/treesize_free/
machine 1 actually is not behave normally. Normal snapshot, especially incremental every 30 minutes, should be a few MB not 200MB+ during off hours. The machine is on the domain, so all change should/would have been on the server not the local drive itself. Machine 2, drive usage itself is steady and has not grow for months now. Same reason I suspect defragmentation because drive shown 0% fragmented almost all the time.
Quote