Description

This article will demonstrate how to determine which local process is recalling items on a Windows file server.  This can be useful when there are issues occurring on the file server.  Mass recalls of items could cause performance issues or even crash the server.  

Enable a Dtrace of the EvPlaceholderService process on the file server and log to a file.  It may be necessary to leave this running for several hours so target a drive with enough free space.  

The following excerpt shows that Explore.EXE is making the request to recall the file.  

(EvPlaceholderService)    <2728>    EV:M    WorkItem::GetExeName: Trying to get the .exe name for pid: 3900
(EvPlaceholderService)    <2728>    EV:M    WorkItem::GetExeNameUsingPHHelper: entry - PID:3900
(EvPlaceholderService)    <2728>    EV:M    WorkItem::GetExeNameUsingPHHelper: exit - PID:3900, exe name:Explorer.EXE
(EvPlaceholderService)    <2728>    EV:M    WorkItem::GetExeName: The .exe name for for pid: 3900 is Explorer.EXE

Note: The process for pid: 4 is always the System process and indicates a recall from a remote client/server.  This would be typical of a user recalling an item.  This cannot be excluded from recalls.  

Once the process(es) are found they can be added to the ExcludedExes key using the reference in the Related articles section.