How do i record disk activity?

[Maximilian]

I want to know which program/process keeps causing my storage drives to spin up seemingly at random, system restore is off for them and so is the recycle bin.

Resource monitor would show me what's accessing the disk but i would need to sit and watch it as it only shows what's happening right at that moment. Anyone know of any other solutions to this?

 

[krose]

I think you can do it with the windows performance monitor. Type perfmon in the search box. You can set up a snap-in to monitor various attributes of your drives, and create reports.

 

[code65536]

I'm not sure perfmon can monitor activity on a per-process level.

What I'd use in this situation is Sysinternals procmon. Set up a filter for the path of your storage drive, set it to show only file activity, and be sure to check the "drop filtered events" option from the menu (or else procmon will get overloaded really easily).


FWIW, one consistent cause of drive storage drive spinup that I noticed on my server is the Windows Installer service starting up (it polls drives when it starts up), and Windows Installer starts up when Windows Update starts up. The problem is, the WU service starts up on a regular basis (once per day) even when I have turned off automatic update checks, so I ended up just disabling the WU service and temporarily re-enabling it when I do my monthly manual WU checks.

Your case could be totally different, so I still suggest running procmon for a while to see if you can catch your culprit.

 

[Maximilian]

I'm not sure perfmon can monitor activity on a per-process level.

What I'd use in this situation is Sysinternals procmon. Set up a filter for the path of your storage drive, set it to show only file activity, and be sure to check the "drop filtered events" option from the menu (or else procmon will get overloaded really easily).


FWIW, one consistent cause of drive storage drive spinup that I noticed on my server is the Windows Installer service starting up (it polls drives when it starts up), and Windows Installer starts up when Windows Update starts up. The problem is, the WU service starts up on a regular basis (once per day) even when I have turned off automatic update checks, so I ended up just disabling the WU service and temporarily re-enabling it when I do my monthly manual WU checks.

Your case could be totally different, so I still suggest running procmon for a while to see if you can catch your culprit.

I think it may be exactly what you said tbh... i started windows update manually the other day and noticed the drives spun up. Ill give procmon a shot anyway just to make sure.

 

[corkyg]

Don't forget Indexing. And, if you are connected to the Internet, some programs interact on a time schedule.

 

[code65536]

Don't forget Indexing. And, if you are connected to the Internet, some programs interact on a time schedule.

Yea, those are possibilities, too.

But indexing is off by default except for the user profile folder which is usually on the boot drive and not a storage drive. Similarly, most programs that do periodic things don't touch storage drives, either. Except maybe a malware protection program--I guess that's a potential possibility.

Something else to check is the Task Scheduler. That's where WU is set to run once every day, but it can't be disabled from there. (I tried; if I disable or delete the daily task, it gets automatically resurrected in short order, and trying to disable what I suspect is the watchdog task that does the re-enabling doesn't work because administrators don't have the privs--only the "SYSTEM" user can modify it--which is why I ended up just disabling the WU service instead.) There's also the automatic maintenance task which, among other things, does a CPU-intensive memtest in a regular basis (but only when the computer is idle, and it stops the instant I move the mouse or tap the keyboard), but that didn't seem to do anything to spin up storage drives, at least not on my system. And there are a gazillion other things in the Task Scheduler, too, so it's probably easier to have procmon point a finger for you.

 

[Dude111]

I dont know if you have a file called taskmon.exe but if you do,start that..... A text file will be created with every program that runs,etc........

I used it one time and its quite conveinent!! (Im not sure if other OSs have that file or not. (Im on 98se but I wanted to throw this suggestion in JUST IN CASE!! (I love to help)))


Good luck!