Windows / NTFS - is it possible to measure completion time of file operations?

I'm looking for possibility of measuring how much time it takes to finish file operation issued to NTFS driver (open file close file delete file, write, read etc) and to be able to log it. I can't change application to measure time inside app. I'm interested in how much time passes between issuing a call and returning to application execution.

Application is continuously writing to NTFS volume placed on iSCSI storage. It is also routinely removing oldest files. File sizes are between 100 and 200 MB. There is always around 10 % of free space on the volume. At some point application is unable to write data at regular pace so it starts buffering in memory. Then something happens and buffer starts emptying and everything returns to normal.

I tested for I/O operations to both physical and logical volumes - I see no anomalies during "outage"

Now I want to find out if the problem is within application or somewhere in OS. For that reason I was thinking if I'm able to log all file operations timings I'll be able to figure out if it is system that takes more time than usual or operations are fast and something blocks inside application.

Platform is 64bit Windows Server 2008R2. I tried sysinternals process monitor but it does not log execution time. It can take few hours for the problem to appear.

Can you suggest the right tool for this job ?


Hire somebody to write either monolithic or mini filter driver for file system. You'll be able to intercept all calls from particular app of interest and track them right to NTFS or any other FS driver entry points. OSR had some data interception (?) kit or whatever, could come handy as well.

https://www.osr.com/dmk/