Currently I'm having an issue with a piece of software that makes use of specific files (which are basically xml), sometimes stored on a file share and sometimes stored locally.
Every so often one of these files goes missing unexpectedly. No users have deleted the files, even though the windows event logs state that it is a user that has deleted them (using process id 4). Unfortunately process id 4 is a pseudo PID which is assigned to the Windows Kernel, so the event log isn't granular enough to let me know which application is actually deleting the file.
Normally I'd install process monitor to monitor the file so I can see if any applications are using the file handle for deletes etc, but the problem is that the steps to reproduce the files going missing aren't definite, and they are only intermittently deleted. so leaving process monitor running seems heavy handed as it will be monitoring a lot of stuff.
Is there a tool like process monitor that is able to run in the background to monitor the files and write to a log when the files are deleted? Is leaving process monitor watching the folder as bad as I think it is (my worry is that the log it produces might get a little large)?
Anything that is free is obviously preferred but I'm really just looking for recommendations and advice.