File Access and Process Monitoring - How to find locked files and the processes locking them

Sonja_Bauernfeind · Jul 31, 2014 3:55:03 AM

There are multiple ways to go about finding out the exact process locking a file and preventing QlikView from carrying out a specific operation. This article covers 3 options available to the standard Windows Server 2008 R2 Operating System.

Common causes for locks are:

A QVB (Reload Engine) that did not terminate correctly
Qlik Sense Engine service holding file in error
The QVS.exe (QlikView Server Service) holding the file in error
AntiVirus Software during the scanning process
Backup Software locking the file during the backup process
Scheduled maintenance tools (Windows or Third Party)

Resolution:

1st option: Process Monitor

1. Download Windows Process Monitor and unzip it to your server (Desktop is fine, the location doesn't matter). You can find the download link here: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

2. Click the magnifying glass icon ("Capture") to stop monitoring temporarily. It should change to a magnifying glass with a red X over it when process monitoring has stopped.

3. Navigate to File > Backing Files...

4. Select the "Use file named:" radio button, and enter in a path where you wish to save the .pml file (an example may be C:\YourCaseNumber\procmon.PML), and press OK.

5. Click the Filter icon ("Filter") to show the Process Monitor Filter dialogue.

6. Create a filter to include a file at a specific path. In the drop-down, select "Path", then "Is" in the next drop-down, enter in the file path you wish to monitor (for example, maybe a locked file at \\SomeSharedDrive\QlikviewRootFolder\CalData.pgo) , and finally select "Include" in the last drop-down.

7. Click "Add". A new item should appear at the top of the list of filters, and it should be enabled.

8. Click "OK" to close the Process Monitor Filter dialogue.

9. Click the magnifying glass icon again to begin capture (there should be NO red X). You should see lots of different events being logged.

10. Once you are sure that the filter is correct and capturing what requested, drop filtered events to avoidgenerating huge files (Filter --> Drop Filtered Events)

11. Replicate the issue described in the case.
If the issue cannot be replicated on demand, and Procmon needs to run until issue occurs, "Backing files" and "History Depth" may need to be configured to store the capture in multiple files with limited size.
File > Backing files
Options > History Depth

12. Once you have replicated the problem while capturing, then you can click the magnifying glass icon again to stop capturing. (there should be a red X on the icon once capturing is disabled)
Note: Do not close Procmon as means to stop the capture as this may inadvertently remove the .pml files.

13. Copy the .PML file(s) to a different location so that they are not overwritten or removed by Procmon by accident.
Note:
1. When using "Backing File" feature, if Procmon is closed as means to stop it, and then reopened, the files are cleared. You may or may not be prompted with a message indicating that the current .pml file will be overwritten, and it looks like it depends on whether procmon is currently using the very first .pml file generated, or has already created other .pml files. If it has already roled to the next <name>-X.pml files it will remove those files right away with no warning.
2. If Procmon is kept opened after stopping the capture, two files should remain available for copying from the location specified under "Backing Files".
3. If Procmon is stopped and then started, the last active file (of the two) will be used to store (append) new data.

14. Open the .PML file that was created and verify that Qlik events were actually logged in there (close Process Monitor, and then double-click on the .PML file; click "Cancel" if the filter dialogue appears again).

15. If all looks good in the prior step, then you can view the PML file or send it to Support if requested. If not, try capturing again.

Note: Make sure that Process Monitor is closed when you are finished collecting the data; it DOES use more memory, and this could impact the server if left running overnight by accident (THOUGH, if you cannot reproduce the issue on-demand then make sure you can set aside time and resources on the server to run Process Monitor until it captures the issue--but please let us know if you are doing this and will need more time to collect the information we're asking for).

2nd option: Share and Storage Management

Note: This has to be executed on the host of the file share.

Pre-installed on Windows 2008 R2
Open through START - Administrative Tools - Share and Storage Management

Select the Share holding the .QVWs or .QVDs affected by a lock
Begin monitoring by opening the "Manage Open Files.." menu on the right:

3rd option: Windows File Auditing written to Windows Event log

Note: This can be resource-intensive!

First, the "Audit object access" needs to be enabled from the security policy.

Go to Run > secpol.msc
Security settings > Local Policies > Audit Policy > Audit object access
Edit the "Audit object access" to audit either "Success", "Failure" or both.
Hit OK

This setting can be pushed from a Domain Controller too, through editing the Group Policy on the Domain Controller:

Start > Administrative Tools > Group Policy Management
Within Group Policy Management > Forest: [forestname] > Domains > [domainname] > Group Policy Objects > Right-click and edit the GPO (by default "Default Domain Policy")
Within the Group Policy Management Editor > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy > Audit object access.

Then we can target the specific files/folders:

No installation required
Locate the file or folder you want to audit in Windows Explorer.
Right-click the file or folder and then click Properties.
Click the Security tab.
Click Advanced.
Click the Auditing tab.
If you are using Windows Server 2008, click Edit.
Click Add.
Enter the name of a user or group you want to audit for the selected file or folder, and click Check
Names to validate your entry. For example, enter Everyone.
Click OK.
Select Success and Failure next to Full control to audit everything for the selected file or folder.