Cool Tools Part XIV: FileMon

All right, admittedly, this is a little more low-level tool than we feature here, but I use this tool all the time and it proved indispensible in diagnosing the issue in my last post.  The tool is called FileMon, and is hugely valuable for diagnosing "File Not Found" or "File Permission" issues.  I've used it with Visual Studio when it claims it can't find a DLL, the portal API when I get weird file version exceptions (particularly with Search Server), and in the most recent case where Notification Server claimed not to be able to find a file.

Basically, the tool reports on every single file access and which Windows process is making the request.  As you can imagine, this produces a LOT of noise - Windows is constantly accessing hundreds of files from dozens of processes, but fortunately, FileMon provides some robust filtering to help you find what you're looking for.

Let's take an example from the use case in my last post: figuring out why I'm not getting notifications.  All I had to go on was this exception:


Hm... can't find a file in "/plumtree/collab/templates/"?  But where is it looking for that file?  I know these templates used to exist in /ptnotification/4.2/settings/templates, but /ptnotification/ doesn't exist anymore.  And they're not in the /cns/ directory OR the /ptcollab/ directory.

Join me after the link for the solution!

Again, the problem is we have an error that looks like it has to do with file access, but we have no idea where the system is even LOOKING for the file, let alone whether it exists or not.

Enter FileMon.  Basically, you start the tool and start capturing file access.  The initial problem is that it's capturing HUGE amounts of information, so you use the "filter" button to rule out processes that can't possibly be accessing the file you're looking for, such as Windows Explorer or Windows Services:


When that's done, you're still going to have a really big list of file accesses, but at least it's manageable.  From here, repeat the process you were doing (in my case, initiating a Notification request), and let FileMon do its thing.  Then, search the resulting list for the file you're having problems with.  I found this entry with the file name showing up in PTSpy:


WOW - I wasn't expecting that!  Notice that the process accessing the file is IIS.  And the path is in the imageserver folder.  But, that was all the information I needed to realize the templates were stored on the image server, and chase down the original problem with IIS.

Download FileMon and see for yourself how useful (or at least interesting) it can be.  Note that this tool has been superseded by ProcessMon, which combines FileMon with Regmon (another Cool Tool I use all the time), but I haven't checked it out yet.

Stay In Touch