Windows Server: monitoring file creation

Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.

Currently looking at / set up a trace log.

Originally Posted by Epy

Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.

Monitoring in code or monitoring through some other means?

First make sure you have things set so you can see hidden and system files ... Windows is bad for this, hiding stuff from users.

If you want to do this in code/Windows... look up Change Notices on MSDN... Windows will signal when a directory or file is altered.

Also... (and forgive me if this is too obvious... but a lot of people get tripped up on it)... make sure you limit the sizes of your "garbage cans". Dleted files still occupy space!

Monitoring by any means. I went to lunch today and we had 106 GB free on the server. I came back and we had 79 GB left. We desperately need to know who is moving/copying what.

Right now I set up a trace log for disk input/output under performance monitoring. Going to first try the tracerpt tool to produce a report and when that doesn't tell me anything, I'll probably just write a python script to parse it.

You could also use Process Monitor. Set the filters for disk activity, 'path' to the shared drive and 'operation' to WriteFile and it'll spew out which process is writing to what file, and the offset and size of the write.

I was using that for a bit and started to look at the filters but it looked too complex, figured there was any easier way. I'll take a look at it again. Thanks

Okay, that actually looks pretty good. Thanks!

The two most useful tools as a network admin are WinDirStat and Process Monitor.

Also, check things like Shadow Copies (which can "consume" space on the drive as time goes by unless you set the options to a fixed size).

I've always been fond of Extensions for Windows - The Unofficial Windows Upgrade myself.

Are you using windows backup regularly? - How to remove Exchange Server transaction log files

Stab in the dark, but this happened to me once and the exchange transaction logs ate all disk space because I want using an "exchange aware" backup

Exchange is on a different server. This is just a file server running server 2003. We use Norton backup exec to backup stuff onto tapes.