How to investigate the Citrix PVS Write Cache filling up

After all the years Citrix still hasn’t developed, or published, a tool to monitor the Citrix Provisioning Server (PVS) Write Cache. It is recommended to use the “Cahe in device RAM with overflow on hard disk” cache option for your vDisk. This means that the write cache is located in your server RAM, and only writes to the attached hard disk when the RAM cache is full. In this blog post I want to show you some tools that I use to investigate what file operations are causing the Write Cache to grow.


How to investigate the Citrix PVS Write Cache filling up – Background

Ideally your configured the RAM cache big enough so that the servers will never use the Write Cache overflow on disk. Ideally you boot your Citrix VDI’s every night so that the Write Cache will be cleared …… but we don’t live in an ideal world and not everyone can boot their whole Citrix farm every night.

In my case we have Citrix VDI farm that can only boot on every weekend. The vDisks were configured with 2048 MB of RAM Cache each. But some of them had an overflow from up to 15 GB each week. This shouldn’t be a problem if your hard drive that you are using for your write cache is big enough. But in my case it wasn’t, which meant we had to configure a SCOM alert that warns us when the disk is full. We then enabled the Maintenance Mode on these server and rebooted them as soon as no user were connected anymore.

Of course I was curious why the Write Cache size grow so big. A quick internet search showed me that there is now Tool available from Citrix that could easily show which file operations are causing the Write Cache to grow over time. So I had to find other ways to figure out why the write cache was getting bigger.

How to investigate the Citrix PVS Write Cache filling up – Tools

The first tool that came to mind was Process Monitor (Procmon) from Sysinternals. To limit the output to just the Write Operations you should use the following filters:

Operation begins with WriteFile Include
Operation begins with WriteConfig Include

Citrix Write Cache Procmon Filter


This will then only show the Processes that do a Write operation on your Hard Disk:

Citrix Write Cache Procmon Filters

Since Procmon produces a lot of Output I searched for a different tool, a bit more lightweight, that only shows the file operations on your Hard Disk. I then found the Software called FolderChangesView from Nirsoft.

With this software you can easily keep track of all file operations. It can also safe the output to a file for later investigation. As procmon it is only one executable with no installation needed.

Citrix Write Cache FolderChangesView

It’s output is very clean and organized and it is easy to spot what File Operations happened. Ideally you compare the timestamp from the Write Cache on your Cache disk with the Output of the program to investigate which Write Operations maybe responsible for the Citrix PVS Write Cache filling up.

Citrix WriteCache FolderChangesView

How to investigate the Citrix PVS Write Cache filling up – Conclusion

I really hope that Citrix will release a Tool that shows the file operations writing to the Write Cache one day. Even with the tools mentioned it is a pain in the ass to investigate which behavior is responsible for the Write Cache to fill up. In my case in the end it was the Windows Updates that still moved files around (which I got rid off by leaving the Image open over night) and the mscorsvw.exe (.Net Framework) compiling some files. Also increasing the RAM Cache size to 4096MB helped to get rid of the Write Cache growing.

Hope the blog post helped you!


Leave a Reply

Your email address will not be published. Required fields are marked *