Thread: Windows Server: monitoring file creation

  1. #1
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413

    Windows Server: monitoring file creation

    Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.

  2. #2
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413
    Currently looking at / set up a trace log.

  3. #3
    Banned
    Join Date
    Aug 2010
    Location
    Ontario Canada
    Posts
    9,547
    Quote Originally Posted by Epy View Post
    Is there a way either through the API or by a built-in MMC or something to monitor the creation of new files? Tons of space is disappearing from a network share and we can't figure out why from simple examination. Thanks in advance.
    Monitoring in code or monitoring through some other means?

    First make sure you have things set so you can see hidden and system files ... Windows is bad for this, hiding stuff from users.

    If you want to do this in code/Windows... look up Change Notices on MSDN... Windows will signal when a directory or file is altered.

    Also... (and forgive me if this is too obvious... but a lot of people get tripped up on it)... make sure you limit the sizes of your "garbage cans". Dleted files still occupy space!
    Last edited by CommonTater; 12-14-2011 at 12:55 PM.

  4. #4
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413
    Monitoring by any means. I went to lunch today and we had 106 GB free on the server. I came back and we had 79 GB left. We desperately need to know who is moving/copying what.

    Right now I set up a trace log for disk input/output under performance monitoring. Going to first try the tracerpt tool to produce a report and when that doesn't tell me anything, I'll probably just write a python script to parse it.

  5. #5
    'Allo, 'Allo, Allo
    Join Date
    Apr 2008
    Posts
    639
    You could also use Process Monitor. Set the filters for disk activity, 'path' to the shared drive and 'operation' to WriteFile and it'll spew out which process is writing to what file, and the offset and size of the write.

  6. #6
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413
    I was using that for a bit and started to look at the filters but it looked too complex, figured there was any easier way. I'll take a look at it again. Thanks

  7. #7
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413
    Okay, that actually looks pretty good. Thanks!

  8. #8
    Registered User ledow's Avatar
    Join Date
    Dec 2011
    Posts
    435
    The two most useful tools as a network admin are WinDirStat and Process Monitor.

    Also, check things like Shadow Copies (which can "consume" space on the drive as time goes by unless you set the options to a fixed size).

    - Compiler warnings are like "Bridge Out Ahead" warnings. DON'T just ignore them.
    - A compiler error is something SO stupid that the compiler genuinely can't carry on with its job. A compiler warning is the compiler saying "Well, that's bloody stupid but if you WANT to ignore me..." and carrying on.
    - The best debugging tool in the world is a bunch of printf()'s for everything important around the bits you think might be wrong.

  9. #9
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413

  10. #10
    &TH of undefined behavior Fordy's Avatar
    Join Date
    Aug 2001
    Posts
    5,793
    Are you using windows backup regularly? - How to remove Exchange Server transaction log files

    Stab in the dark, but this happened to me once and the exchange transaction logs ate all disk space because I want using an "exchange aware" backup

  11. #11
    Make Fortran great again
    Join Date
    Sep 2009
    Posts
    1,413
    Exchange is on a different server. This is just a file server running server 2003. We use Norton backup exec to backup stuff onto tapes.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Replies: 2
    Last Post: 12-16-2008, 02:43 PM
  2. File creation date (in windows 98 and XP)
    By esbo in forum C Programming
    Replies: 12
    Last Post: 05-03-2006, 05:27 PM
  3. windows creation
    By SAMSAM in forum Windows Programming
    Replies: 13
    Last Post: 01-23-2003, 10:48 AM
  4. File creation
    By Unregistered in forum A Brief History of Cprogramming.com
    Replies: 2
    Last Post: 04-18-2002, 08:36 PM
  5. *.dat file creation
    By Robert_Ingleby in forum C Programming
    Replies: 6
    Last Post: 03-07-2002, 05:32 PM