0

Every now and then, my sleeping disk wakes up, does what sounds like a single read, and then sits idle until it falls asleep again. Sometimes a program that I am using completely freezes for about 10 seconds while the disk spins up, even though that program doesn't seem to need to read from that drive.

Is there an api for listening to file accesses as they happen, or similar, so I can figure out what is read from that drive, so I can move it? If not on Windows, can I do this on Linux?

This is also applicable for figuring out what files/folders a program is accessing in general, so I wouldn't say it only applies to my very narrow problem.

Filip Haglund
  • 13,919
  • 13
  • 64
  • 113
  • *"If not on Windows, can I do this on Linux?"* - That needs a bit of clarification. How do you propose that a foreign OS would help in diagnosing Windows internals? – IInspectable Jun 07 '17 at 18:45
  • Ah, I was thinking, since many programs and programming languages can run on both Windows and Linux, running the same program on Linux could give me a hint of what files and folders it accesses. Finding those same folders on Windows would be a fairly easy task, since the folder structure is probably similar. – Filip Haglund Jun 07 '17 at 18:48
  • The abstraction layer for programming languages is the language runtime (e.g. .NET CLR, CRT, etc.). The implementation wildly differs between operating systems, and running the 'same' application on different systems has completely different runtime characteristics. This is not a promising route. Instead, run a tool like [Process Monitor](https://technet.microsoft.com/en-US/sysinternals/processmonitor.aspx) to see all filesystem activities. – IInspectable Jun 07 '17 at 19:35
  • Though this other question is specific to C#, I believe it's essentially a duplicate because the answer is the same: There's no API for doing this from a user-mode program in a way to catch every possible access. You would have to write a file system driver, which is how tools like Process Monitor get the job done. https://stackoverflow.com/questions/11417658/monitoring-applications-file-access-in-windows?rq=1 – Adrian McCarthy Jun 07 '17 at 22:47

1 Answers1

1

There's a simple tool called What's My Computer Doing? that you can use to get a quick idea of what's causing activity on your computer.

Install and run it, and leave it running in the background. Once you use this tool to narrow down which process is causing the disk activity, you'll want a more comprehensive tool. I use Process Monitor from Sysinternals/Microsoft.

It can be a bit daunting at first, but that's mainly because it is so powerful. It can also alter the behavior of the computer. When it's running, it backs up the huge quantity of data it collects to the disk. So that's why I suggest using the 'What's My Computer Doing?' tool first. Once you know which process is generating the disk access you can add a new filter rule (keep all the defaults, as they mask out a bunch of normal system processes) and select "Process Name" "is" "process_name", or select "PID" "is" "actual_PID".

There are plenty of tutorials like this one that can help you get started with Process Monitor.

JimBurd
  • 98
  • 5