Winapi. How to intercept file creation?

Question

Windows

I didn’t deal with hooks, I read a little about burning keys.
Can you give an example from winapi how to intercept the creation of a file? I want to keep track of the size of these files, otherwise there is not much free disk space and it is constantly decreasing, although sometimes it increases. Either the swap file, or other programs.
At the same time, if it is still possible to find out which processes create and delete files.