Time to break out procmon to find out what it is! Citrix has a support article on how to do this.

Indeed I tried that, the AV/CheckPoint generates a good bit of write but what I don't understand is the PVS whitespace leak.

When you way "whitespace leak" are you referring to free space on the disk - blocks that were used for files but then the files were deleted? If so, this is something we don't control -- the write cache is based on disk blocks and NTFS is responsible for allocating disk blocks - if it chooses to NOT reuse those blocks previously allocated but instead allocate new blocks there's nothing we can do. TRIM can help with this -- if the OS drivers use TRIM to free previously used sectors, then PVS can delete those from the WC file - but even that wont help unless we're able to free an entire block in the write cache file -- if any disk sectors in that section remains in use then the whole block has to remain in the WC file.

Thanks Simon for the details here. I don't think it's the PVS drivers as it was fine with version. I think something make it misbehave, probably the AV but I don't know how I can prove that. Thanks again.

Oh yes definitely the A/V could be the cause of the cache file growing. My only point was that it's entirely up to WIndows (NTFS) HOW blocks on the boot disk are allocated and PVS has to maintain a block in the cache for each block used by NTFS...

There is still something puzzling when I think about it, Windows Server 2016 supports TRIM. It can reclaim the disk block from the C drive but the write cache cannot as efficiently (why?) even if in theory the 2 should be the same. In the process you also have the write in memory so not all go to the WC directly. Again something is messing the PVS reclain. Tricky.

So, the cache code understands trim BUT allocates fairly large chunks in the VHDX file that implements the cache -- those blocks cannot be reclaimed until all disk blocks in it are TRIM'd. In addition, we can't remove blocks from the middle of the cache file, so we can only truncate the file IF the blocks stored at the end of the file are TRIM'd.

Thank you very much Simon for this clear and concise explanation!🙏