Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a disk with several different things going on. I'd like to determine approximately how much of the disk activity is due to file sharing. Is there a counter for this?

Also, and I may have been dreaming this, I seem to remember seeing some program that might allow me to monitor file activity of a particular folder within a share. Ring any bells? Thanks.

share|improve this question

In reference to monitoring the activity of a folder:

You can use WMI (CIM_DataFile) to monitor a folder for any modifications using something similar to this as the query:

SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\Data"

Something like this:

' Full path to the folder to monitor
sPath = "\\localhost\c$\Scripts"
sComputer = split(sPath,"\")(2)
sDrive = split(sPath,"\")(3)
sDrive = REPLACE(sDrive, "$", ":")
sFolders = split(sPath,"$")(1)
sFolders = REPLACE(sFolders, "\", "\\") & "\\"

' Create our WMI instance
Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root\cimv2")
' Begin monitoring
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " _
& "TargetInstance ISA 'CIM_DataFile' AND " _
& "TargetInstance.Drive='" & sDrive & "' AND " _
& "TargetInstance.Path='" & sFolders & "'")

Wscript.Echo vbCrlf & Now & vbTab & _
"Begin Monitoring for a Folder Change Event..." & vbCrlf

    Set objLatestEvent = colMonitoredEvents.NextEvent
    Select Case objLatestEvent.Path_.Class

        Case "__InstanceCreationEvent"
            WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
            & " was created" & vbCrlf

        Case "__InstanceDeletionEvent"
            WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
            & " was deleted" & vbCrlf

        Case "__InstanceOperationEvent"
            If objLatestEvent.TargetInstance.LastModified <> _
                objLatestEvent.PreviousInstance.LastModified then
                WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
                & " was modified" & vbCrlf
            End If

        IF objLatestEvent.TargetInstance.LastAccessed <> _
            objLatestEvent.PreviousInstance.LastAccessed then
            WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
            & " was accessed" & vbCrlf
        End If

    End Select

Set objWMIService = nothing
Set colMonitoredEvents = nothing
Set objLatestEvent = nothing
share|improve this answer
Thanks! I also just realized that sysinternals' Process Montior can show me file operations and I can filter by path. It's not too good for statistics though. – Boden Jan 28 '10 at 17:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.