文件监视器 - 获取在Windows中创建文件的进程名称？ [英] File Watcher - get the process name that created a file in Windows?

问题描述

有没有一种很好的方法来获取在Windows中创建文件的进程名称？

Is there a good way to get the process name that created a file in Windows?

我在Windows 2000 Server上有一个目录

C：\ WINNT \ Temp ，它填满了名为的文件：

70618199

21834082

I have a directory on a Windows 2000 Server
C:\WINNT\Temp that is filling up with files named like:
70618199
21834082

它们的大小总是121,201 KB。

They are always 121,201 KB in size.

以编程方式，我可以捕获在此位置删除文件的程序名称或服务名称吗？

Programatically can I "capture" the program name or service name that is dropping files in this location?

更多信息：

我对此做了更多研究。我重命名了文件TIFF并且能够打开它。

这台机器通过自定义编写的ASP.NET应用程序充当文档搜索工具。
本机在E：\驱动器上包含大约50,000个TIFF文档。此计算机还运行SQL Server 2000 w /全文索引打开。全文索引绝不会触及TIFF - 但它不应该因为这是SQL吗？但是FTS确实要求打开索引服务。奇怪的是，这个TIFF似乎是Web服务器提供的最大功能。 IIS或索引服务是否使用C：\ WINNT \ Temp进行某种缓存？想法？

MORE INFO:
I did some more research on this. I renamed the file TIFF and was able to open it.
This machine functions as a document search tool via a custom written ASP.NET app. The machine contains approx 50,000 TIFF documents on the E:\ drive. This machine also runs SQL Server 2000 w/ Full-Text Indexing turned on. Full-Text Indexing in no way touches the TIFFs - but it shouldn't because this is SQL right? But FTS does require Indexing service be turned on. The weird thing this TIFF seems to be the largest thing served off of the web server. Does IIS or Indexing Service use C:\WINNT\Temp for some kind of caching? Thoughts?

解决方案（也许？）
这似乎是微软索引服务。

当我关闭它，这些文件都不会在WINNT\Temp中创建。

它似乎抓住它找到的最大文件并将其复制到WINNT\Temp中。
这很奇怪。当您处理100MB + TIFF文件时，这可能会导致磁盘空间不足。非常讨厌。

猜猜我将关闭索引服务的Web分支。

RESOLUTION (Maybe?) This seems to be Microsoft Indexing Service.
When I shut it down, none of these files get created in WINNT\Temp.
It seems to grab the largest file it finds and copies it into WINNT\Temp. This is weird. When you are dealing with a 100MB+ TIFF file, this can cause you to run out of disk space. Very annoying.
Guess I will just shut down the "Web" branch of my Indexing Services.

推荐答案

总是进程监视器取代了FileMon，它将告诉你哪个进程正在访问相关文件。

There's always Process monitor which replaces FileMon which will tell you which process is accessing the files in question.

这篇关于文件监视器 - 获取在Windows中创建文件的进程名称？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！