DiskMonitor

DiskMonitor is a Windows console utility for finding which processes are producing disk reads and writes. It was built for quick troubleshooting when a machine is doing unexpected background I/O and you need a process-level view without opening a full profiler.

The app samples Win32 process I/O counters and renders a live terminal table with read/write rates, cumulative totals, process status, handle counts, operation rates, memory usage, and simple high-I/O alerts. When run as Administrator, it also starts an ETW session to improve disk/file attribution.

Requirements

• Windows
• .NET 8 SDK to build from source
• Administrator privileges for ETW-enhanced disk/file attribution

The app intentionally exits on non-Windows systems because it depends on Win32 process counters and Windows ETW events.

Features

• Live process table with:
  • read bytes per second
  • write bytes per second
  • total bytes read
  • total bytes written
  • process handle count
  • I/O operations per second
  • process status
• Sort modes for total writes, total reads, current write rate, current read rate, handle count, I/O operations, and working set.
• Process-name search.
• Optional drive filter.
• Idle disk readout for fixed disks with no observed activity in the current sample.
• Optional closed-process rows for processes that exited after producing I/O.
• Optional compact CSV logging.
• Single-instance guard to avoid running multiple monitors at once.

Keyboard Controls

Key	Action
S	Toggle compact CSV logging
T	Cycle sort mode
+ / -	Decrease or increase sample interval
Up / Down	Show more or fewer table rows
M	Open drive filter menu
A	Toggle high-I/O alerts
P	Pause or resume sampling
C	Show or hide closed processes
/	Search process names
Esc	Clear search and drive filter
Q	Quit

CSV Logging

CSV logging is designed to avoid becoming part of the disk-write problem being investigated.

When enabled, DiskMonitor keeps activity in memory and flushes a compact batch every 30 seconds to io_monitor.csv in the current working directory. Each flush writes only the top active processes that performed I/O during that interval.

Logged fields include interval end time, PID, process name, interval read/write bytes, cumulative totals, handle count, operation deltas, working set, I/O pattern, active/closed status, limited-access marker, and drive.

Accuracy Notes

• Core per-process totals come from GetProcessIoCounters.
• Processes that cannot be queried directly are marked with #.
• ETW is only available when running as Administrator.
• Drive attribution is best effort. With ETW, it uses observed file events. Without ETW, it falls back to the process image drive.
• Alerts are heuristics for high throughput or many small I/O operations. They are useful leads, not definitive diagnoses.
• Handle count is reported honestly as process handle count. It is not an open-file count.

See FEATURE_VALIDATION.md for a feature-by-feature validation summary.

Build

dotnet build DiskMonitor.sln -c Release

Run

dotnet run --project DiskMonitor.csproj

For best disk attribution, run the terminal as Administrator.

Publish

dotnet publish DiskMonitor.csproj -c Release -r win-x64 --self-contained true

License

DiskMonitor is released under the MIT License. See LICENSE.