As you can see in the screen shot below after we turned off HIDE HIDDEN SYSTEM FILES, we could see that there was a dumpstack.log.tmp file which is not a good thing:
When dumpstack.log.tmp appears there is a serious problem or bug check (commonly known as a Blue Screen of Death or BSOD). When the system encounters such errors, it logs the details in this file for diagnostic purposes.
We noticed that the file had been LAST MODIFIED several days prior to the day we were working on the server so we thought we might be able to just delete it. As you likely guessed, that failed because the file was in use. Checking out backup solutions logs showed the same thing; it could not be backed up because it was in use (and even the VSS writer was unhappy about it).
Then the question because what, specifically, is using that file. If it had been a shared file, we would have just gone to COMPUTER MANAGEMENT > SHARED FILES > OPEN FILES, but that was not the case here.
To figure out what had that file open and locked we used:
- Use Resource Monitor:
- Press
Win + R, typeresmon, and hit Enter - In the CPU tab
- In the Associated Handles section, type
DUMPSTACK.LOG.TMPin the search box- This found nothing
- In the OVERVIEW tab, expand DISK and click on FILE (to sort by name)
- This found much, but not what we needed
- Press
- Use Process Explorer:
- Download and run Process Explorer directly from Microsoft HERE
- Click FIND (in the menu) and search for
DUMPSTACK.LOG.TMP - Here we found that SYSTEM was using the file and the only way to clear it was to reboot
0 Comments