4

We have an internal .NET application that mirrors file directories across a network. On the client-side, we use .NET file watcher class to monitor directories.

On one of our 6 client servers, we have noticed that the integrated windows defragmenter some times triggers file watcher delete events on files when it runs a defrag job. The files either remain or get recreated in the source directory but trigger the delete event so our application deletes the files on the destination side. We have seen this several times, but only on that 1 server (never on any of the other 5).

Anyone have any thoughts or ideas why the delete events are being triggered, or any defrag settings to check to see the differences from the other servers?

Any thoughts or ideas would be appreciated.

Thanks,

EDIT: Reasons for my hypothesis:

  • It's happening in the middle of the night when no one is using the servers,
  • always around the same day/time (Monday around 3 am)
  • defrag job kicks off and the event viewer shows the defragmentation starting right around that same time.
  • This has occurred about 3-4 times in the past 2 months since we installed the software on this server.
  • This software has been installed on other servers for about 6+ months and we have never seen this issue before.
Newey
  • 123
  • 2
  • 8
  • 2
    Interesting question, IMHO this is tricky because common system events such as this can raise many different events and even more as it gets deeper causing this kind of behavior. Not only system events, but other program events as well, for example, AV software. The real question is, *how do you know*? – Trevor Jul 30 '20 at 19:45
  • 1
    If defragging caused this sort of behaviour it would be well-known and well-documented. As such, I find your hypothesis extremely unlikely. Almost certainly you've noticed a correlation, not a causation, and the actual cause is something entirely different. – Ian Kemp Jul 30 '20 at 21:09
  • It's happening in the middle of the night when no one is using the servers, always the same day (Monday mornings around 3am) and event viewer shows the defragmentation starting right around that same time with each of 4 instances where I've seen this happen. It could be unrelated, but the correlation seems pretty strong. Sorry, I probably should have included that reasoning for my hypothesis in my original post. – Newey Jul 30 '20 at 23:47
  • @IanKemp `it would be well-known and well-documented`, is the [remarks](https://learn.microsoft.com/en-us/dotnet/api/system.io.filesystemwatcher.changed?view=netcore-3.1#remarks) section not a sufficient explanation? Here's the first few sentences: `Common file system operations might raise more than one event. For example, when a file is moved from one directory to another, several OnChanged and some OnCreated and OnDeleted events might be raised.` – Trevor Jul 31 '20 at 13:22
  • @Çöđěxěŕ Defrag is not a "common file system operation", it is an operation that is controlled by the filesystem but transparent to anything that accesses said filesystem, precisely to prevent the scenario of spurious events being raised to programs watching that filesystem. Now, there is nothing stopping some application from hooking into the Windows defragmentation APIs and filesystem driver to raise defrag events as filesystem events, but that is not a default Windows behaviour. – Ian Kemp Aug 01 '20 at 13:52
  • Your update makes me even more certain this is not related to defragmentation in any way shape or form: if it was due to defrag, I'd expect it to happen every time the defrag job runs, not every other time. I'd suggest running [Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) on the directory of the server in question when your app is running, and seeing what events are triggered by which applications at the time you are experiencing this behaviour - that will definitively tell you which application is responsible. – Ian Kemp Aug 01 '20 at 13:57
  • Thank you I'll check on process monitor – Newey Aug 02 '20 at 18:25

0 Answers0