File I/O rates by process by file

[Ian Boyd]

i'm trying to see what processes are reading or writing from what files and
how much on a non-Vista computer.

In the end i want a list that is of the form:

Image PID File Read (B/min) Write (B/min)
PDEngine.exe 4920 \Device\HarddiskVolume4 6358793 4911993
utorrent.exe 8056 S:\pagefile.sys (Page File) 4096 0
SearchIndexer.exe 1440
S:\SearchIndex\Search\Data\...\CiFiles\CiMG0027.001 0 69632
System 4 C:\Users\Ian\AppData\Roaming\uTorrent\resume.dat 0
120832
svchost.exe (LocalServiceNetworkRestricted) 1016
C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat 0
512
System 4 C:\$Mft (NTFS Master File Table) 0 167366 Normal 0
System 4 S:\$LogFile (NTFS Volume Log) 0 192566 Normal 0
OUTLOOK.EXE 7924 C:\$LogFile (NTFS Volume Log) 0 106496
System 4 C:\$Mft (NTFS Master File Table) 0 12007 Normal 0

etc etc

Some among you will see which Microsoft app i've copied and pasted from -
which is why i'm trying to get something similar on XP. i asked in one
newgroup on how to get write such a thing, and one smart-ass suggested WMI.

So i thought i might as well ask: Can WMI get file I/O stats by process and
file? From what i can tell anything WMI can report you can also get through
perfmon.msc, and Performance Monitor cannot show file io bytes grouped by
process and file.

Basically i want:

SELECT
ProcessName,
ProcessID,
Filename,
SUM(BytesRead) AS FileRead,
SUM(BytesWritten) AS FileWrite,
FROM wmi.FileIoStatisticsByProcess
WHERE EventDate > getdate()-1/24/60 --one minute
GROUP BY ProcessName, ProcessID, Filename

[Ian Boyd]

Possible answers (pick the ones that best apply):

a) No, you cannot do that. That is not something that WMI is designed to
show you

b) No, you cannot do that by default. You would have write your own WMI
provider

c) i would think you can do that, that sounds like something that should be
available through WMI

d) i am sure WMI can provide that information, but i have no idea how you'd
get it.

e) i know you can get that information from WMI, but i can't remember which
namespaces

f) i know you can get that information from WMI, i've seen it done, but i
never knew exactly how

g) i know you can get that informaton from WMI, i've done it, but i can't
find the code right now

h) i know you can get that information from WMI, and the namespaces are...

i) i know you can get that information from WMI, and here's the code...

j) i know you can get that information from WMI, and here's a program that
does it...

k) i don't know if you can get that from WMI, but here's a program that does
what you want already...