EldoS | Feel safer!

Software components for data protection, secure storage and transfer

File open events for audit

Also by EldoS: CallbackRegistry
A component to monitor and control Windows registry access and create virtual registry keys.
Posted: 02/27/2015 03:58:17
by Aleš Remškar (Standard support level)
Joined: 12/15/2014
Posts: 3

I'm trying to implement auditing functionality in my application, but I can't find way to filter events to those when user actually open/close file and not just browsing.

Any suggestions?
Posted: 02/27/2015 04:18:20
by Vladimir Cherniga (EldoS Corp.)

There is a FileMon sample provided with installation. This is a tool monitoring file system activity using CallbackFilter library. Does it fulfill your requirements ?
Posted: 03/02/2015 05:00:06
by Aleš Remškar (Standard support level)
Joined: 12/15/2014
Posts: 3

I use FileMon, but it also raises events when browsing. I'm only interested, when file is opened. I need to filter events, but I cant figure out how?
Posted: 03/02/2015 05:04:32
by Eugene Mayevski (EldoS Corp.)

If you mean browsing the directory in Windows Explorer, then the behavior your observe is correct -- Windows Explorer DOES open files in the directory. There's no way to disable this behavior or distinguish between open/read operations when the directory is being browsed and when the files are copied by Explorer.

Sincerely yours
Eugene Mayevski



Topic viewed 2619 times

Number of guests: 1, registered members: 0, in total hidden: 0


Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!