文件观察器 - 获取在 Windows 中创建文件的进程名称？
有没有好的方法来获取在 Windows 中创建文件的进程名称？
我在 Windows 2000 Server 上有一个目录
C:\WINNT\Temp 充满了名为如下的文件：
70618199
21834082
它们的大小始终为 121,201 KB。
我可以通过编程方式“捕获”正在该位置放置文件的程序名称或服务名称吗？
更多信息：
我对此做了更多研究。 我将文件重命名为 TIFF 并且能够打开它。
该机器通过自定义编写的 ASP.NET 应用程序充当文档搜索工具。 本机的 E:\ 驱动器上包含大约 50,000 个 TIFF 文档。 该计算机还运行启用了全文索引的 SQL Server 2000。 全文索引绝不会触及 TIFF - 但它不应该触及，因为这是 SQL，对吧？ 但 FTS 确实需要打开索引服务。 奇怪的是，这个 TIFF 似乎是 Web 服务器提供的最大的东西。 IIS 或索引服务是否使用 C:\WINNT\Temp 进行某种缓存？ 想法？
解决方案（也许？） 这似乎是 Microsoft 索引服务。
当我关闭它时，这些文件都不会在 WINNT\Temp 中创建。
它似乎抓取了它找到的最大文件并将其复制到 WINNT\Temp 中。 这很奇怪。 当您处理 100MB 以上的 TIFF 文件时，这可能会导致磁盘空间不足。 非常烦人。
我想我会关闭索引服务的“Web”分支。
Is there a good way to get the process name that created a file in Windows?
I have a directory on a Windows 2000 Server
C:\WINNT\Temp that is filling up with files named like:
70618199
21834082
They are always 121,201 KB in size.
Programatically can I "capture" the program name or service name that is dropping files in this location?
MORE INFO:
I did some more research on this. I renamed the file TIFF and was able to open it.
This machine functions as a document search tool via a custom written ASP.NET app.
The machine contains approx 50,000 TIFF documents on the E:\ drive. This machine also runs SQL Server 2000 w/ Full-Text Indexing turned on. Full-Text Indexing in no way touches the TIFFs - but it shouldn't because this is SQL right? But FTS does require Indexing service be turned on. The weird thing this TIFF seems to be the largest thing served off of the web server. Does IIS or Indexing Service use C:\WINNT\Temp for some kind of caching? Thoughts?
RESOLUTION (Maybe?)
This seems to be Microsoft Indexing Service.
When I shut it down, none of these files get created in WINNT\Temp.
It seems to grab the largest file it finds and copies it into WINNT\Temp.
This is weird. When you are dealing with a 100MB+ TIFF file, this can cause you to run out of disk space. Very annoying.
Guess I will just shut down the "Web" branch of my Indexing Services.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
总有 进程监视器 取代 FileMon，它会告诉您哪个进程是访问有问题的文件。
There's always Process monitor which replaces FileMon which will tell you which process is accessing the files in question.
如果您想要类似于 windows 下的 fusions 的东西，您可以查看 Process Explorer
它不会让您监视文件，但您可以查看当前正在运行的进程是否正在访问该临时目录并创建类似的命名临时文件。
If you want something similar to fuser for windows, you can check out Process Explorer
It won't let you watch a file, but you can see if any current running processes are accessing that temp directory and creating similar named temp files.
我使用过 FileMon.exe， 但仅适用于 XP 。
I've used FileMon.exe, but in only works on XP.
我发现以编程方式从 .NET 执行此操作的唯一方法是运行 Sysinternal命令行处理应用程序并传入文件名并读取控制台输出，以尝试使用文件的打开句柄捕获源应用程序。
否则其他人提到的实用程序就可以了。
The only way I've found to do this from .NET programatically is to run Sysinternal's Command-line Handle App and pass the file name in and read the console output to try to catch the source application with an open handle to the file.
Otherwise the utilities others have mentioned would do fine.
您始终可以将该目录设置为只读，然后看看会出现什么情况。 但如果它是文档服务器，您可能不想这样做。
You could always set that directory to read-only and see what throws up. Although if it's a document server you might not want to do that.
这是一种回收者病毒。 它在所有磁盘分区中创建了一个名为“Recycler”的隐藏文件夹，但我无法从 Windows 安全模式中删除它们。 诺顿、AVG 卡巴斯基未能检测到或删除它。
我关闭系统还原，使用启动盘重新启动电脑，进入命令提示符并从所有驱动器中删除“Recycler”文件夹。 使用命令 rmdir/sc:\recycler
这是在 Windows XP 上唯一对我有用的东西。
This is a Recycler Virus. It created a hidden folder called "Recycler" In all disk partitions and i was not able to delete them from windows Safe Mode. Norton, AVG Kaspersky failed to detect it or delete it.
I turn off system restore, rebooted the PC using a Boot disk went to command prompt and deleted "Recycler" folder from all drives. using command rmdir/s c:\recycler
This is the only thing that worked for me on Windows XP.
只需使用标准 Win32 api (NAPI)。
参见高级。 Win32 API 新闻://comp.os.ms-windows.programmer.win32
源代码 (C)
Just use standard Win32 api (NAPI).
See Adv. Win32 api ng news://comp.os.ms-windows.programmer.win32
for source code (C)