Some PRTG users that use the new "HTTP Full Page Sensor" on the local probe (or on remote probes) have found huge amounts of disk space eaten up by the Internet Explorer cache folder of the "default user". The folder is (on Windows XP):

C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\

Can't see the folder?

Actually you must set two options in Windows Explorer in order to see the folders: Select "Show hidden files and folders" and deselect "hide protected operating system files".

Where do these files come from?

Under yet unknown circumstances there seems to be a problem within Internet Explorer that leads to broken index.dat files. In index.dat files Internet Explorer manages its browser cache. As soon as the file is broken or index.dat file looses sync to the actual files on the disk the problem starts growing: expired files are not completely deleted from the cache, because IE simply "forgot" that they exist. So they remain... forever. During normal "human" use of Internet Explorer this problem does not grow too big, but when you set up one ore more "Full Page Sensors" to monitor a website every minute you do create a lot of internet traffic. In fact every minute for each monitoring request all the HTML files and all their subelements (i.e. images) are stored in the cache because caching is disabled for the Full Page Sensor. These files "should" be cleared from the cache later - if everything works fine. But we have seen cases where several subfolders of the "Content.IE5" folder contained more than 800 MB each (in more than 100.000 files which are often a few weeks or even months old). And what makes things worse: The sheer number of files dramatically reduces system performance, too.

Why are all these files stored in the "Default User" profile?

When a user surfs the Net using Internet Explorer all the cache files are stored in his own profile, i.e.
C:\Documents and Settings\[USERNAME]\Local Settings\Temporary Internet Files\Content.IE5\
But PRTG's "Full Page Sensor" runs under the "SYSTEM" account which does not have its own profile, so it uses the "default user" profile.

The Problem

Microsoft has a support article that covers the situation where the IE cache files use way too much disk space. They recommend to open IE settings dialog, then move the IE cache location to another folder and finally delete the old files. But you can not log into the "default user" or "system" account and open IE settings because it is not a real user account. In theory deleting the index.dat file and rebooting should solve the problem. IE would recreate a brand new index.dat file and would remove all orphaned files. But you can't delete the file because it is in use all the time. Using privacy tools like CCleaner doesn't help either: they only delete index.dat for the logged-in user, not for the "default user".

The Solution (Part 1)

The index.dat file must be deleted during startup of Windows. The fastest solution I could find was using the "Remove on Reboot" Explorer Extension a free download from Snapfiles.com. After installation of this tool you must navigate to the content.ie5 folder
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\
in Windows explorer, right click on "index.dat", choose "Remove on Next Reboot" and finally reboot the system. After the reboot go back to the folder and check the size of the "Content.ie5" folder. It should be just a few megabytes. But here is another problem: In our labs we have seen situations where still many hundred megabytes were used, most of these left over files and folders have dates that are weeks or months old. Note: Another solution would be to use unlocker which removes file locks, but there may be unwanted side effects.

The Solution (Part 2)

OK, so the "delete-index-dat" trick did not work completely. There are still huge folders with orphaned files. To find out which folders are largest we used the FolderSize extension (for XP and Win2k3) (you can also right click each folder and choose "properties"). We found that simply deleting these huge folders using the command line works best (using Windows Explorer takes forever when a folder contains 100.000 files or more). Open a command line (enter cmd in the "start|run" dialog) and navigate to the folder
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\
using the "cd" command. Now enter the "rmdir" command for the huge folder(s):
rmdir /s [foldername]
The result looks like this:

Conclusion

On one of the systems in our software test lab (that has been running Full Page Sensors for several months) we were able to free up 4 GB of lost disk space by following the procedure outlined above.

More about index.dat files

Latest Articles by Dirk Paessler

2014-May-29: How It All Started: 11 Years PRTG Network Monitor

2014-May-22: Monitoring of Things: Exploring a New World of Data

2014-Apr-25: Please Support the OpenSSL Project

2014-Apr- 8: OpenSSL Heartbleed Bug Vulnerability

2014-Mar- 5: The Future is Mobile: Are You Ready?

2014-Feb-25: Critical Security Update Available for PRTG Network Monitor

2013-Jul-16: Introducing Our New Passive Application Performance Sensor

2013-Apr-23: Paessler at VMware Forum 2013

2012-Nov- 7: New Version of PRTG Introduces 64bit Core Server and Other New Features

2012-Jul-13: The WMI Performance Test (2012 Edition)

  • en
  • de
  • es
  • fr
  • it
  • br
  • cn
Copyright © 1998 - 2014 Paessler AG