I have an IIS webservice (commercial product) that writes files to a remote Windows file server using UNC.

From time to time, particularly when writing a large number of small files in a batch, the process fails. The Event Log shows that the process failed due to "The process cannot access the file because it is being used by another process."

When I go and have a look at the file, whatever was locking it is no longer locking it, and I can write to it without any issue.

So something is temporarily locking the file.

I can't use Process Monitor, OpenFiles, etc. because I need to catch the issue when it randomly and transiently occurs.

I can't monitor a specific file, because brand new files are written by the webservice each time. But they are written to a specific top folder and random subfolders.

It sounds a lot like AntiVirus, but our McAfee has OnAccess scan disabled on all of the machines involved.

Can run something on the servers to monitor file lock failure errors/events and catch the process info when they occur?

How can I catch which process is transiently locking the files as they are written?


I think that you should consider using procmon on the file server, with these settings:

File -> Backing Files -> "Use file named:" and choose a path with enough free disk space. (by using a backing file, you avoid filling up the virtual memory of your server).

Filter: Create one or more filters to match the folders or the root directory containing the file (typically, "Path" "Begins With" path)

Filter -> Drop Filtered Events

Then, start the capture and see if you filter is working correctly. You can tweak Options -> "History Depth" depending on the number of events.

| improve this answer | |

EDIT : I just realized this was on windows, i will modify this to a similar option that works on Windows OS; will update in a bit

Possible WIN Solution :

Download the following tools from sysinternals


Create a batch file with following content :

  handle -u >> output.txt
  timeout /t 1 > NUL
goto loop

Run the batch file at the same location where you put the sysinternal handle, it will print all open files with process listed every second, so run the batch file while doing file transfer and then manually kill it with CTRL+C. Scour the logs to find the faulty process

Possible UNIX solution :

Before you do the file transfer, execute this command on the faulty machine :

nohup watch -n 1 lsof | grep FILENAME_HERE >> /path/to/log/log.txt &

"nohup" : makes the command run in the background, so it will keep running until you manually kill it

"watch -n 1" : will run this command every second

"lsof" : list all open files

"grep" : filter results of lsof

">>" : pipe output and append to file

& : runs the command and returns you to cmd prompt

So you start this command, then start your transfers, if you're unsure you can remove the grep part but it will make going through the logs a little harder. Although you could grep the logs for a file that failed and find what process was using it. If you're unsure about any of this let me know

Once you are done remember to kill the process manually

ps -aux | grep watch

find pid and run

kill $pid

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.