I once used a Netbase trace facility to look at the activity on just several files - was much less of an overhead than NM logging and it revealed some rather odd behaviour from some of our subprograms - as it logged every access, fopen, fread etc.