"Perform Windows Update Synchronization" fills up server HDD space

[DLRX]

Using Kaspersky Security Center v.

I have currently set it up to act as the company WSUS server, and the update sync is currently set up to only sync "Critical Updates", "Definition Updates", "Drivers", and "Security Updates". Last week I selected "All categories" and it managed to fill the 1TB hard disk before the task even reached 20%! I have since restored the server to its configuration prior to selecting "All Categories" from backup and not re-enabled them.

I can't imagine that storing all software updates for the company would take up an estimated 5TB of disk space, so what am I doing wrong?

[Konstantin Antonov]

Hi,

Could you please provide export of the WSUS task.

Thank you!

[DLRX]

Here it is (with the "All Categories" box unchecked).

windows sync.klt

[DLRX]

I have also configured it to only install EN-GB and EN-US updates, yet I see the following updates available:

As beautiful as all these languages are, we have no need for them. Could this be a contributing factor?

[Nikolay Arinchev]

Hi,

Using KSC as WSUS could require up to 100GB of free space - https://support.kaspersky.com/ksc10#requirements

Thank you!

[DLRX]

Yes, so why was it taking 10x times that after only completing 20% of the task?

And why is it showing other languages when I have asked it not to?

[Evgeny_E]

Hi. 

Do you have workstations where described languages could be used or installed ?

Also you may try to patch your server to a recent commulitive update version https://support.kaspersky.com/13968

Please do not forget to perform server backup prior to update.

[DLRX]

No, there are no workstations requiring those languages (and it is even shown within Kaspersky Security Center that there are none).

I have already patched the server with the above link.

To provide an update, the folder C:\ProgramData\KasperskyLab has already grown to 229gb with only drivers and security patches.

[Evgeny_E]

What SQL server did you used for KSC setup how is it connected ? 

How many hosts do you have in your network ? 

[DLRX]

The SQL server is the default installation from the Kaspersky setup on the same server host as the Security Center package. I have it listed as SQL Server 2014.

The server manages ~250 hosts.

[DLRX]

Great. Left last night and came back to a nearly bricked admin server - the HD was full. I've expanded the VHD but can't do that indefinitely.

Under the install required updates I get this error:

Quote

Generic db error: "1105 '{42000} Could not allocate space for object '<temporary system object: 1729382299803254784>' in database 'tempdb' because the 'PRIMARY' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.; Could not allocate space for object '<temporary system object: 1729382299803254784>' in database 'tempdb' because the 'PRIMARY' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.' LastStatement='vapm_arrange_task_updates'"

If it needs 100gb of space, why is it using so much? I hasten to add that that is with only security updates and drivers.

Edited November 22, 2017 by DLRX
More detail

[Dmitry Eremeev]

Hello,

please attach full GSI report with event logs.

Thank you.

 

[DLRX]

Can't upload file to a private message:

Quote

There was a problem processing the uploaded file. -200

It's only 2.6mb

[Dmitry Eremeev]

1 hour ago, DLRX said:

Can't upload file to a private message:

It's only 2.6mb

Is it possible to upload it somewhere and send a link to https://forum.kaspersky.com/index.php?/profile/488871-klcentralsupport/ ?

Thank you.

 

[DLRX]

1 hour ago, Dmitry Eremeev said:

Is it possible to upload it somewhere and send a link to https://forum.kaspersky.com/index.php?/profile/488871-klcentralsupport/ ?

Thank you.

 

Yes I've just done so.

Update: I have since cleared the folder c:\programdata\kasperskylab\adminkit\1093\.working\ftserver and wusfiles, deleted all tasks and re-created them and seeing what happens. I did so because it had used an additional 150gb since this morning (using a total of 670gb just for those two folders).

I have also just received this error message from the new windows update sync task: "Assertion "nSize && nSize < 100*1024*1024" failed". Patch A has been installed already.

Edited November 22, 2017 by DLRX
Just got error message.

[Dmitry Eremeev]

26 minutes ago, DLRX said:

Yes I've just done so.

Update: I have since cleared the folder c:\programdata\kasperskylab\adminkit\1093\.working\ftserver and wusfiles, deleted all tasks and re-created them and seeing what happens. I did so because it had used an additional 150gb since this morning (using a total of 670gb just for those two folders).

I have also just received this error message from the new windows update sync task: "Assertion "nSize && nSize < 100*1024*1024" failed". Patch A has been installed already.

Please attach KL software report.

https://support.kaspersky.com/13968#block3

Thank you.

 

 

[DLRX]

[Dmitry Eremeev]

https://support.kaspersky.com/13968#block3

1. Open the report’s properties
2. Go to the Detail fields section.
3. Click Add.
4. Select Report field name → Updates installed.
5. Click OK.

Thank you.

 

[DLRX]

That is what I did.

[Dmitry Eremeev]

Please attach the report as attachment, not screenshot

Thank you.

 

[DLRX]

I do not see how this data is relevant for troubleshooting - however it does list our entire infrastructure which I am not willing to upload.

[Nikolay Arinchev]

Hi,

Please create a request to KL support and attach all previously collected info to it.

Please tell us the number of that request.

Thank you!

[DLRX]

Request ID: INC000008525152

[Kirill Tsapovsky]

On 20.11.2017 at 6:09 PM, DLRX said:

Using Kaspersky Security Center v.

I have currently set it up to act as the company WSUS server, and the update sync is currently set up to only sync "Critical Updates", "Definition Updates", "Drivers", and "Security Updates". Last week I selected "All categories" and it managed to fill the 1TB hard disk before the task even reached 20%! I have since restored the server to its configuration prior to selecting "All Categories" from backup and not re-enabled them.

I can't imagine that storing all software updates for the company would take up an estimated 5TB of disk space, so what am I doing wrong?

Hello.

Please note that during the "Windows Update synchronization" task, only the metadata for the updates is downloaded to the server, rarely exceeding 1 Gb even if all languages are selected. The actual files are downloaded when the "Install updates" task is run. It should also be noted that a set of updates is copied for every existing task of this type, so creating a great number of such tasks is not recommended. You never mention any tasks of this type, please check what approach to this is being used.

If it occurs so that it is in fact the "Windows Update synchronization" task which is generating the traffic, this might be erroneous behavior. To investigate, please collect KSC server + Console traces while starting this task and running it for a short while. Specify how much the server grows over that period.

Thank you.

[DLRX]

I will get those trace files for you, probably tomorrow.

Regarding the tasks, do you mean "Install update" or "install required update and fix vulnerabilities"?