Introduction

Previously, the major papers for studies on file access patterns were for the Unix operating system. Two of the earliest such papers were A Study of File Sizes and Functional Lifetimes, by M. Satyanarayanan, and A Trace-Driven Analysis of the UNIX 4.2 BSD File System, by J. Ousterhout et al. As of yet, there does not appear to be any papers for studies on file access patterns using the Windows NT operating system.

The planned objective for CS 297 this quarter was to further my understanding of Windows NT auditing features and determine the suitability of using the auditing features for a file access study. In addition, I wanted to determine whether it would be possible to look at various disk defragmentation methods. In particular, Symantec Corporation used one disk defragmentation method in MS-DOS/Windows 3.1 versions and the original Windows 95 version of Speed Disk (a program that's part of the Norton Utilities software suite) but switched to a different defragmentation method in the version of Speed Disk included with version 3.0 of the Windows 95 version of Norton Utilities. I do not know what defragmentation method was used in version 2.0 of Norton Utilities for Windows 95. As with file access patterns, there does not appear to be any significant papers on disk fragmentation and performance on Windows. There are a few studies on it, however.

Some issues for consideration with regards to Windows NT auditing are:

1.

Does Windows NT's audit log differentiate between a file read and a read done to load a program?

2.

What is the difference between ``Primary User, Domain, Logon ID'' and the ``Client User, Domain, Logon ID?''

3.

What is the difference between ``Object Deleted'' and ``Object Open'' with ``Accesses: DELETE?''

4.

What is ``Operation ID?''

5.

What are the following ``Accesses'' types?

• READ_CONTROL
• SYNCHRONIZE
• ReadEA/WriteEA
• ReadAttributes/WriteAttributes

Some issues for consideration with regards to a study of file access patterns are:

1.

How easy is it to get a filesystem snapshot on Windows NT?

2.

Do we want or can have more, the same, or less information in our study compared to Ousterhout's?

3.

Why did Ousterhout conduct his study?

4.

How do new file types affect results?

5.

Do results generalize?

6.

Files are modified soon after creation - is that true for clients, servers, or both?

7.

What do we need to measure and how detailed should it be?