FileSystemWatcher + Monitor Reads/Opens

[James]

Hey all,

I am looking to use FileSystemWatcher to monitor file access, deletion,
creation, and modification.

However, I also want to monitor when any user opens / reads this file?
Is this possible?

Thanks in advance.

-- James

 

[Kevin Spencer]

You should be able to use NotifyFilters.LastAccess to do this.

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
You can lead a fish to a bicycle,
but it takes a very long time,
and the bicycle has to *want* to change.

 

[James]

Which file system event handler is raised by NotifyFilters.LastAccess
then?

 

[Kevin Spencer]

That would be the "Changed" event..

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
You can lead a fish to a bicycle,
but it takes a very long time,
and the bicycle has to *want* to change.

 

[James]

Perhaps I am doing this wrong but CHANGED does not raise an event when
the file is opened.

 

[Kevin Spencer]

Hi James,

Without seeing your code, I can't tell you what's going wrong. However, the
following MSDN article has a sample that illustrates how to use the
notifyFilters Enumeration to specify what sort of changes to watch for. You
will note that "LastAccess" is included in the sample:
http://msdn.microsoft.com/library/d...guringfilesystemwatchercomponentinstances.asp

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
You can lead a fish to a bicycle,
but it takes a very long time,
and the bicycle has to *want* to change.

 

[James]

My Notify Filters are: LastAccess, LastWrite, FileName, DirectoryName

Still CHANGED only seems to be occuring the first time i select a file
(select, not open). Successive acceses to this file after that point
do not raise a changed event.

My code (C++) is basically the same as the msdn sample :

http://msdn.microsoft.com/library/d...iofilesystemwatcherclassnotifyfiltertopic.asp

except for a few differences in names.

 

[Kevin Spencer]

Hi James,

Interesting. Aside from seeing your actual code, I'm at a loss. I have never
tried to use that particular filter. I do know from my research that the
LastAccess attribute is not immediately updated on the disk by NTFS, but
stored in memory. Perhaps that is the root of the issue. Have you tried
waiting?

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
You can lead a fish to a bicycle,
but it takes a very long time,
and the bicycle has to *want* to change.

 

[James]

Perhaps we are barking down the wrong path here, getting help up on
some functionallity that is just not meant to be. Is there a better
way of accomplishing my task? Simply put, I want to monitor ALL file
activity on a system (like FileMon from sysinternals). I can from
there filter out what I need and react accordingly . However, I am
trying to accomplish this without writing a driver (which is how i
believe filemon works).

Any suggestions?

 

[Kevin Spencer]

Well, James, if you want to use Windows API to do this, check out:

http://msdn.microsoft.com/library/en-us/fileio/fs/obtaining_directory_change_notifications.

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
You can lead a fish to a bicycle,
but it takes a very long time,
and the bicycle has to *want* to change.

 

[James]

This looks like it may work. I'll have to write some code to test, but
thanks for the pointer.

P.S. you may want to add a .ASP on the end of that link so it does not
404.

i.e.:
http://msdn.microsoft.com/library/d.../obtaining_directory_change_notifications.asp

 

[Kevin Spencer]

Thanks James. I didn't realize that the "asp" got dropped somehow between my
copying and pasting!

--

Kevin Spencer
Microsoft MVP
..Net Developer
You can lead a fish to a bicycle,
but it takes a very long time,
and the bicycle has to *want* to change.

 

[James]

The method(s) seemed promising however i still cannot track the opening
of a specific file.

I.E. when user X opens file Y i want to know about it immediately.

Suggestions?

 

[Kevin Spencer]

Hi James,

I think I mentioned that I had not used the LastAccessed filter before. I
may be misunderstanding its use. It only seems to be mentioned in connection
with other types of actions that change a file, such as renaming, changing
its contents, etc. In any case, I'm not at all sure any more that you can
use this to determine whether or not a file has been read only, without
changing it.

I'm sure that somewhere there is an event that happens which you can
capture, but I have scoured the MSDN Library without success trying to find
it.

How about we back up a bit. What exactly is the situation here? Perhaps
there is a parameter of your requirements that can be leveraged in another
way.

--
HTH,

Kevin Spencer
Microsoft MVP
..Net Developer
You can lead a fish to a bicycle,
but it takes a very long time,
and the bicycle has to *want* to change.

 

[James]

Simply stated, I want to know (by being signalled, no polling as its
way to resource intensive) that a file of my selection has been
opened/read, modified in some way, or deleted. The second two are
easily done, the first one is not very easy at all. From what I've
read i think I'm doomed to driver territory, writing an upper filter
driver for the file system.