EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Matching events to FileSystemWatcher

Also by EldoS: MsgConnect
Cross-platform protocol-independent communication framework for building peer-to-peer and client-server applications and middleware components.
#24036
Posted: 03/12/2013 03:12:01
by Werner van Deventer (Basic support level)
Joined: 03/12/2013
Posts: 1

I'm having a bit of trouble getting things to work nicely here. With FileSystemWatcher you get a pretty clear cut way of detecting deletions and new files. With CallbackFilter it appears a bit more complicated.

I've tried adding CreateNotify as a callback filter but it never gets fired when I create new files. Should I be subscribing to OpenNotify and then checking the creation disposition to determine if the file is new?

For deletions there isn't much in terms of catching when files have been deleted, again I've add the callback rule of DeleteNotify but no matter how many files I delete, OnCanFileBeDeletedN never gets called.

Try this out with you FileMon example app as well, so many events get fired and none of them are what I would expect. It appears as though OpenFileN is the one to sit on and just check the value of enumerations that come through. Is this normal?

Example while running the FileMon example.

- Create a new file and the following events occur:
OpenFileN C:\Temp
EnumerateDirectoryN C:\Temp New File.txt
CloseFileN C:\Temp
OpenFileN C:\Temp
EnumerateDirectoryN C:\Temp New File2.txt
CloseFileN C:\Temp
OpenFileN C:\Temp
CloseFileN C:\Temp
OpenFileN C:\Temp
EnumerateDirectoryN C:\Temp New File3.txt
CloseFileN C:\Temp
CloseFileN C:\Temp


I only created New File3.txt here, the other files still got reported in the events even though no action was performed against them and there are many other files types in C:\Temp. More importantly, notice there is no CreateFileN as expected.

- Delete a file.
OpenFileN C:\Temp
EnumerateDirectoryN C:\Temp New File3.txt
CloseFileN C:\Temp


Notice that no CanFileBeDeletedN event fires here, how can you tell if something was deleted?

I have tested this on Windows 7 and 8 with the exact same results.
#24041
Posted: 03/12/2013 06:42:17
by Vladimir Cherniga (EldoS Corp.)

Quote
I've tried adding CreateNotify as a callback filter but it never gets fired when I create new files. Should I be subscribing to OpenNotify and then checking the creation disposition to determine if the file is new?

Yes, you should subscribe both event handlers. CreateNotify invoked in the case of CreateDisposition = CREATE_NEW, but in most cases other values of CreateDisposition is used during file creation. From the filter view it couldn't be determined that file already exist or not, so you should manually check the target for existence.
Quote
For deletions there isn't much in terms of catching when files have been deleted, again I've add the callback rule of DeleteNotify but no matter how many files I delete, OnCanFileBeDeletedN never gets called.

There is another way of file can be deleted. It could be opened with flag FILE_FLAG_DELETE_ON_CLOSE, so you should check it in CreateOptions callback parameter. With this flag set on, the file will be deleted on a last close file request.
Quote
I only created New File3.txt here, the other files still got reported in the events even though no action was performed against them and there are many other files types in C:\Temp. More importantly, notice there is no CreateFileN as expected.

This is a normal behavior, because file creation may trigger a lot of side requests, especially when windows explorer used. You can use ProcMon utility from sysinternals.com and observe the same file system activity with a same filter mask, when browsing folders in explorer.
#28056
Posted: 01/20/2014 05:10:47
by markus fronius (Basic support level)
Joined: 01/16/2014
Posts: 1

Had the same problem that i could not trigger the e.g. CreateFileN event. Solution was quit simple: use a wildcard in path declaration like C:\Test\*.* instead of C:\Test.

Reply

Statistics

Topic viewed 2405 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!