EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Using CallbackFilter with shared folder

Also by EldoS: CallbackProcess
A component to control process creation and termination in Windows and .NET applications.
#10459
Posted: 06/23/2009 07:48:30
by Filippo Solimando (Standard support level)
Joined: 06/23/2009
Posts: 10

Hello, I'm trying to monitor a shared folder. I've two situations:

1) I add a filter to a local folder (that is shared) and another computer access to the files I want to monitor.

2) I add a filter to a shared folder and access the files from the same machine.

In the first case I'm unable to know (by the class CallbackFilter in my callbacks) what process is accessing the file.

In the second case the callbacks are not called by the filter.

I may think is cause the OS is calling another service (RPC Locator, ecc), but my acknowledge about User and Kernel drivers is not enough to point the real issue.

Is there a way to monitor a shared folder?

Thanks
#10460
Posted: 06/23/2009 14:40:20
by Vladimir Cherniga (EldoS Corp.)

Quote
Filippo Solimando wrote:
In the first case I'm unable to know (by the class CallbackFilter in my callbacks) what process is accessing the file.

This is impossible, SMB will not give you this info.
Quote
Filippo Solimando wrote:
In the second case the callbacks are not called by the filter.

Please specify how exactly you set the filter rules.
#10464
Posted: 06/24/2009 02:27:04
by Filippo Solimando (Standard support level)
Joined: 06/23/2009
Posts: 10

When I map a shared folder from another computer I tryed these rules

\\123.123.123.123\Folder\*.*

or

\\RemoteMachine\Folder\*.* (with dns name)

or

z:\*.* (where I mapped with subst the shared folder)

It didn't worked.
The same application works fine with local folders with similar rule.
Tryed it on WinXP and Win2003 server systems, all 32 bit.
#10468
Posted: 06/24/2009 09:30:15
by Vladimir Cherniga (EldoS Corp.)

What is the exact sample did you use ? When you attach filter in CBFilter sample does it show in window remote path in the form like this:
\device\lanmanredirector\remotemachine\... ?
#10469
Posted: 06/24/2009 10:40:13
by Filippo Solimando (Standard support level)
Joined: 06/23/2009
Posts: 10

After few more tests I tryed the FileMon example (Driver version 1.0.13.35).

The filter I digited is \\123.123.123.132\Folder\*.*

Any except RenameOrMoveFileN callbacks are called if I access or modify the files and folders in the specified path.

The RenameOrMoveFileN reports me the current message

"RenameOrMoveFileN \??\UNC\123.123.123.123\Folder\test\file.txt"

if I rename the file specified in that path.

It doesn't happen anything if I open/delete/modify files and folder.

FileMon example works fine for local folders like c:\test\*.*
I didn't modified the code in the sample project and running it in Release version

I hope we can find the issue as we are evaluating this product and is necessary to keep a monitor to shared folders in some way for our project.

Thanks for reply
#10477
Posted: 06/25/2009 10:42:19
by Vladimir Cherniga (EldoS Corp.)

Please ask me one question. In CBFilter sample, when you specify filtered path in the edit box, then press button "Add Rule..", what is the string, that is appeared in the filter rules list ?
#10478
Posted: 06/26/2009 03:52:06
by Filippo Solimando (Standard support level)
Joined: 06/23/2009
Posts: 10

I did a screenshot of the result of the CBFilter:

in the first rule I simple declared a local folder C:\a\*.*

on the second filter I mapped with subst the shared folder on another computer and the rule was Z:\*.* where Z is of course the letter I assigned

on the last rule I wrote the direct IP adress and path of the shared folder \\192.168.0.100\test\*.*


#10489
Posted: 06/29/2009 03:47:07
by Vladimir Cherniga (EldoS Corp.)

Please use for your tests the attached FileMon sample and callback filter driver( which version is 0.1.4.14 ). Attach filter with a path specified as in your previous message. Then access the specified path and try to open/close/modify files in the share. You shoud mentioned that if you specify network path as,for example, "z:\*.*" - you should use this path as a syntax, when accessing files from network share. Try different method to set filter: through the network disk, UNC path, direct ip address. Please post the results here.


[ Download ]
#10507
Posted: 07/01/2009 04:10:27
by Filippo Solimando (Standard support level)
Joined: 06/23/2009
Posts: 10

Quote
Vladimir Cherniga wrote:
Please use for your tests the attached FileMon sample and callback filter driver( which version is 0.1.4.14 ). Attach filter with a path specified as in your previous message. Then access the specified path and try to open/close/modify files in the share. You shoud mentioned that if you specify network path as,for example, "z:\*.*" - you should use this path as a syntax, when accessing files from network share. Try different method to set filter: through the network disk, UNC path, direct ip address. Please post the results here.


We repeated all our tests with this last version and it's working fine, both with mounted path and UNC address.
The tests were made only with your application, as CallbackFilter APIs from our current library version are not able to reconize this driver version.
To finalize our projects we'll wait the final version of the SDK, but we are able to continue our development with the current version.

Thanks for the support
Also by EldoS: Rethync
The cross-platform framework that simplifies synchronizing data between mobile and desktop applications and servers and cloud storages

Reply

Statistics

Topic viewed 4446 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!