I have a Windows Server 2012 R2 running Veritas Enterprise Vault (EV). For backups of index data/metadata we put EV into backup mode and take a snapshot of the disks using the underlying SAN storage, then mount that snapshot on a backup server to protect it. We have been intermitently seeing a few corrupt files on the snapshot disks, and have been working with vendors to find a cause, to no avial. The current theory is that even though we put the application in backup mode, something is still accessing the files as we take the snapshot. So my question is - does anyone know of a way we can monitor the files in a particular filesystem on the source server and record any processes that try to access them (as we take the snapshot)? Ideally it would be something we can run continuously, but maybe even an on-demand scan started just before the snapshot would be able to tell us something.
Thanks in advance.