File Monitoring (Read,Write etc...) monitoring system.

I need to develop a system to monitor operations performed on files/folders.
Such as
1. open,
2. read,
3. write,
4. close,
5. copy,
6 rename,and
7. move


I have stumbled upon one solution.

Having a "File System Filter Driver" which monitors every atomic operation performed on the file system. But the information available out of the driver is too huge to classify into a single user operation.

For example
(*) IRP_MJ_WRITE is the Major function getting initiated when a user tries to write a file.
(*) However more than one IRP_MJ_WRITE happens for a single write.
(*) when user saves the document twice,it is difficult for me to group the IRP_MJ_WRITE's into TWO user writes.


Someone help me on how to proceed on this, or may be any other solution to this problem.

Hi,

if you can use Win-API, take a look at "ReadDirectoryChangesW" in the MSDN.
This works fine and uncomplicated.

Hope this helps,
Matze

Quote:

---

Originally Posted by Madhan_Saran

I need to develop a system to monitor operations performed on files/folders.

---

You might also take a look at FindFirstChangeNotification() / FindNextChangeNotification().

Quote:

---

Originally Posted by matze42

Hi,

if you can use Win-API, take a look at "ReadDirectoryChangesW" in the MSDN.
This works fine and uncomplicated.

Hope this helps,
Matze

---

The only drawback of the function is that it is not available for Win 9x systems. Also, the drive being monitored must have NTFS file system.

Quote:

---

Originally Posted by Madhan_Saran

I need to develop a system to monitor operations performed on files/folders.

---

Is there any special reason why you need to re-invent the wheel?

• Filemon for Windows

Quote:

---

Originally Posted by PadexArt

The only drawback of the function is that it is not available for Win 9x systems. Also, the drive being monitored must have NTFS file system.

---

Neither of these things are much of a drawback these days!!

Markus