Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a disk with several different things going on. I'd like to determine approximately how much of the disk activity is due to file sharing. Is there a counter for this?

Also, and I may have been dreaming this, I seem to remember seeing some program that might allow me to monitor file activity of a particular folder within a share. Ring any bells? Thanks.

share|improve this question
add comment

1 Answer

In reference to monitoring the activity of a folder:

You can use WMI (CIM_DataFile) to monitor a folder for any modifications using something similar to this as the query:

SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\Data"

Something like this:

' Full path to the folder to monitor
sPath = "\\localhost\c$\Scripts"
sComputer = split(sPath,"\")(2)
sDrive = split(sPath,"\")(3)
sDrive = REPLACE(sDrive, "$", ":")
sFolders = split(sPath,"$")(1)
sFolders = REPLACE(sFolders, "\", "\\") & "\\"

' Create our WMI instance
Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root\cimv2")
' Begin monitoring
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " _
& "TargetInstance ISA 'CIM_DataFile' AND " _
& "TargetInstance.Drive='" & sDrive & "' AND " _
& "TargetInstance.Path='" & sFolders & "'")

Wscript.Echo vbCrlf & Now & vbTab & _
"Begin Monitoring for a Folder Change Event..." & vbCrlf

Do
    Set objLatestEvent = colMonitoredEvents.NextEvent
    Select Case objLatestEvent.Path_.Class

        Case "__InstanceCreationEvent"
            WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
            & " was created" & vbCrlf

        Case "__InstanceDeletionEvent"
            WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
            & " was deleted" & vbCrlf

        Case "__InstanceOperationEvent"
            If objLatestEvent.TargetInstance.LastModified <> _
                objLatestEvent.PreviousInstance.LastModified then
                WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
                & " was modified" & vbCrlf
            End If

        IF objLatestEvent.TargetInstance.LastAccessed <> _
            objLatestEvent.PreviousInstance.LastAccessed then
            WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
            & " was accessed" & vbCrlf
        End If

    End Select
Loop

Set objWMIService = nothing
Set colMonitoredEvents = nothing
Set objLatestEvent = nothing
share|improve this answer
    
Thanks! I also just realized that sysinternals' Process Montior can show me file operations and I can filter by path. It's not too good for statistics though. –  Boden Jan 28 '10 at 17:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.