up vote 0 down vote favorite
share [g+] share [fb]

I am seeing this behavior and I find it interesting.

After I close a Virtual Machine on VMWare-Workstation, even closing the VMWware-Workstation console I see lots of hard disk activiy on of the virtual machine.

I have seen this in the VMDK and in the VMEM files as you can see here. enter image description here

¿Why could be this happening?

I dont think is the Antivirus software neither superfecth because I enable it only to fetch the boot files.

link|improve this question
67% accept rate
It'd PID 4 doing the accessing, so it's a SYSTEM process of some kind. Perhaps one of the VMware services is interacting with the file? As Mark suggested, Process Monitor could point to which is doing it. – sysadmin1138♦ Oct 24 '11 at 2:34
feedback

1 Answer

up vote 0 down vote

My trial copy of VMWare Workstation has expired so I can't check this out myself, but Process Monitor by SysInternals is your friend.

Start it monitoring the system, and then do whatever it is that you did to generate this activity. Then use process monitor to filter its results to just that file, and have a look at exactly what DLLs or processes are doing what to that file.

As a side note, process monitor is also a great way of debugging stupid cryptic error messages, such as "The file was not found". What file? Well, process monitor can tell you because it will list the exact file that the software tried to access.

link|improve this answer
I tried with Process Explorer with not Sucess: this has lots of I/O activity but not CPU. So in Process Explorer I cannot open the process System and sort its Threaths to see what is happening. I didn't find anything interesting, all the things that show me high CPU activiy are ntoskrnl.exe. I'll try with Process Monitor, if I Can, because the machine is almost completly frozeen when this happens :). Thank you @Mark – Ricardo Polo Oct 23 '11 at 23:53
1  
Process Explorer is very different to Process Monitor (which is the tool I suggested). Process Monitor only monitors disk activity, and gives you all the handles and instructions and it logs them all historically so you can scroll through and search to find those elusive handles. – Mark Henderson♦ Oct 24 '11 at 0:42
I could find anything interesting with ProcMon. – Ricardo Polo Oct 31 '11 at 14:43
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.