Recently I have been asked a couple of questions about the \Windows\winsxs\ManifestCache\blobs.bin file and what it does. Specifically, the question I have been asked it why the file takes up the amount of space that it does, or in some cases, grows out of control. In looking around on the web, I’ve seen various explanations for the file and some of the things that you can do to it when you get into this state. I figured I would go over the options you have if you’re running Windows 2008 and you have a blobs.bin file thats growing out of control.
First, let’s define what “out of control” really means. If you have a blobs.bin file that is taking up a few hundred MBs of space, you’re not out of control. If you’ve got a file thats several gigabytes in size you “may” be out of control depending on the circumstance. If you’re in the group that has one that is over 10GB, you’re in the out of control group I am focused on speaking to. So, what are your options when you hit this state and what does that file actually do.
The blobs.bin file is used as a caching mechanism for servicing operations that are set to happen against the system. The file will naturally grow and shrink in size as various servicing actions take place against the machine and are satisfied. Typically, if you reboot your system on a machine with a large file, you’ll notice that update(s) may have been pended and rebooting satisfies the finalization of the operation and reduces the size of the file. But, all in all, the file is there for caching.
So, what causes the file to grow as large as it does? Well, several things can do this. Anything that is regularly querying the stack will cause the file to grow in size, things like WSUS, SCCM, Windows Update, Server Manager and some WMI calls can cause the file to recursively grow in size. Tracking these things down can be fairly difficult but usually isolating a machine that is experiencing the problem can be a good start to figuring out whats happening and narrow down the potential offenders.
Lastly, what can you do if you’re in this situation? You have several options:
1. Upgrade to Windows 2008 R2. I know that sounds like a sales pitch, but its not. This particular issue doesnt happen in R2.
2. Delete the file and reboot the system. Yes, you can safely delete this file without any fear of it damaging anything on the server. I’ve seen sites that said this file cant be deleted, they are wrong. We’ll recreate the file on boot.
3. If deleting the file didnt resolve the growth issue, ACL the file to deny everyone from writing to it. The stack will see a failure to write to this as a signal that it doesnt need caching and it will move on servicing files.
Hope that helps…