Windows Server: monitoring file creation

This is a discussion on Windows Server: monitoring file creation within the Windows Programming forums, part of the Platform Specific Boards category; Is there a way either through the API or by a built-in MMC or something to monitor the creation of ...

  1. #1
    Epy
    Epy is offline
    Hen-teaser Epy's Avatar
    Join Date
    Sep 2009
    Location
    California, USA
    Posts
    878

    Windows Server: monitoring file creation

    Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.

  2. #2
    Epy
    Epy is offline
    Hen-teaser Epy's Avatar
    Join Date
    Sep 2009
    Location
    California, USA
    Posts
    878
    Currently looking at / set up a trace log.

  3. #3
    Banned
    Join Date
    Aug 2010
    Location
    Ontario Canada
    Posts
    9,547
    Quote Originally Posted by Epy View Post
    Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.
    Monitoring in code or monitoring through some other means?

    First make sure you have things set so you can see hidden and system files ... Windows is bad for this, hiding stuff from users.

    If you want to do this in code/Windows... look up Change Notices on MSDN... Windows will signal when a directory or file is altered.

    Also... (and forgive me if this is too obvious... but a lot of people get tripped up on it)... make sure you limit the sizes of your "garbage cans". Dleted files still occupy space!
    Last edited by CommonTater; 12-14-2011 at 11:55 AM.

  4. #4
    Epy
    Epy is offline
    Hen-teaser Epy's Avatar
    Join Date
    Sep 2009
    Location
    California, USA
    Posts
    878
    Monitoring by any means. I went to lunch today and we had 106 GB free on the server. I came back and we had 79 GB left. We desperately need to know who is moving/copying what.

    Right now I set up a trace log for disk input/output under performance monitoring. Going to first try the tracerpt tool to produce a report and when that doesn't tell me anything, I'll probably just write a python script to parse it.

  5. #5
    'Allo, 'Allo, Allo
    Join Date
    Apr 2008
    Posts
    611
    You could also use Process Monitor. Set the filters for disk activity, 'path' to the shared drive and 'operation' to WriteFile and it'll spew out which process is writing to what file, and the offset and size of the write.

  6. #6
    Epy
    Epy is offline
    Hen-teaser Epy's Avatar
    Join Date
    Sep 2009
    Location
    California, USA
    Posts
    878
    I was using that for a bit and started to look at the filters but it looked too complex, figured there was any easier way. I'll take a look at it again. Thanks

  7. #7
    Epy
    Epy is offline
    Hen-teaser Epy's Avatar
    Join Date
    Sep 2009
    Location
    California, USA
    Posts
    878
    Okay, that actually looks pretty good. Thanks!

  8. #8
    Registered User ledow's Avatar
    Join Date
    Dec 2011
    Posts
    435
    The two most useful tools as a network admin are WinDirStat and Process Monitor.

    Also, check things like Shadow Copies (which can "consume" space on the drive as time goes by unless you set the options to a fixed size).

    - Compiler warnings are like "Bridge Out Ahead" warnings. DON'T just ignore them.
    - A compiler error is something SO stupid that the compiler genuinely can't carry on with its job. A compiler warning is the compiler saying "Well, that's bloody stupid but if you WANT to ignore me..." and carrying on.
    - The best debugging tool in the world is a bunch of printf()'s for everything important around the bits you think might be wrong.

  9. #9
    Epy
    Epy is offline
    Hen-teaser Epy's Avatar
    Join Date
    Sep 2009
    Location
    California, USA
    Posts
    878

  10. #10
    &TH of undefined behavior Fordy's Avatar
    Join Date
    Aug 2001
    Posts
    5,786
    Are you using windows backup regularly? - How to remove Exchange Server transaction log files

    Stab in the dark, but this happened to me once and the exchange transaction logs ate all disk space because I want using an "exchange aware" backup

  11. #11
    Epy
    Epy is offline
    Hen-teaser Epy's Avatar
    Join Date
    Sep 2009
    Location
    California, USA
    Posts
    878
    Exchange is on a different server. This is just a file server running server 2003. We use Norton backup exec to backup stuff onto tapes.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Replies: 2
    Last Post: 12-16-2008, 01:43 PM
  2. File creation date (in windows 98 and XP)
    By esbo in forum C Programming
    Replies: 12
    Last Post: 05-03-2006, 05:27 PM
  3. windows creation
    By SAMSAM in forum Windows Programming
    Replies: 13
    Last Post: 01-23-2003, 09:48 AM
  4. File creation
    By Unregistered in forum A Brief History of Cprogramming.com
    Replies: 2
    Last Post: 04-18-2002, 08:36 PM
  5. *.dat file creation
    By Robert_Ingleby in forum C Programming
    Replies: 6
    Last Post: 03-07-2002, 04:32 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21