Is there a good way to get the process name that created a file in Windows?
I have a directory on a Windows 2000 Server
C:\WINNT\Temp that is filling up with files named like:
70618199
21834082
They are always 121,201 KB in size.
Programatically can I ‘capture’ the program name or service name that is dropping files in this location?
MORE INFO:
I did some more research on this. I renamed the file TIFF and was able to open it.
This machine functions as a document search tool via a custom written ASP.NET app. The machine contains approx 50,000 TIFF documents on the E:\ drive. This machine also runs SQL Server 2000 w/ Full-Text Indexing turned on. Full-Text Indexing in no way touches the TIFFs – but it shouldn’t because this is SQL right? But FTS does require Indexing service be turned on. The weird thing this TIFF seems to be the largest thing served off of the web server. Does IIS or Indexing Service use C:\WINNT\Temp for some kind of caching? Thoughts?
RESOLUTION (Maybe?) This seems to be Microsoft Indexing Service.
When I shut it down, none of these files get created in WINNT\Temp.
It seems to grab the largest file it finds and copies it into WINNT\Temp. This is weird. When you are dealing with a 100MB+ TIFF file, this can cause you to run out of disk space. Very annoying.
Guess I will just shut down the ‘Web’ branch of my Indexing Services.
There’s always Process monitor which replaces FileMon which will tell you which process is accessing the files in question.