Member Avatar for samp4ever

Hi everybody. I'm implementing an application that use FileSystemWatcher to monitor the events of a local File System with C#.

The problem is that I should also know for my application even the user or the process who made a change, an access, created, deleted and so on a file or a directory. FileSystemWatcher just tell me: "there is an event of this type in this file/directory". Doesn't tell me who raise that event.

Is there something in C# giving these information? If not, any idea of how can I do to retrieve it?

Thank you in advance

  • 3 Contributors
  • 4 Replies
  • 112 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by makman99
Member Avatar for makman99

For files, there is the owner, last access, etc...
When the filesystemwatch goes off, you can get those values using windows api's
If I remember correctly filesystemwatch should also tell you what happened to the file

For who was working with it... You can tell who created it by looking at the owner value of the file.
Is this going to be running over a network or a single computer? Because if it's just a single computer you can just check for who ever is logged in at the time of change.

Member Avatar for Momerath

Checking who's logged in won't work if the system is accessing the file. There is no real way to check who is accessing a file in C# as it requires hooking into the OS. There is a command you can download from Microsoft called handle that will tell you what process is currently accessing a file (it's a command line tool so you'd have to parse the output), but that doesn't help if the access is faster than you can detect it and call handle.

Member Avatar for samp4ever

Thanks for the answers.

If I remember correctly filesystemwatch should also tell you what happened to the file

Yes just tell me the kind of event raised: created, deleted, renamed, changed, and is possible to filter to know more exactly what does change mean.

Is this going to be running over a network or a single computer?

Should be a tool running for both on server / local computer. The idea to track the users logged in at the moment of the change could be a good approximation to have some idea and information, even if not exactly what I should need.

There is a command you can download from Microsoft called handle that will tell you what process is currently accessing a file (it's a command line tool so you'd have to parse the output), but that doesn't help if the access is faster than you can detect it and call handle.

Something like this could be good. In your opinion how should I do? Should I start a process with C# and then manage the output? Sure it doesn't work in that case you wrote, cause when the system raise an event with FSW I should check the handle and parse the result so I could have no more this information if the process is faster than the tool..

Member Avatar for makman99

It seems as though it's not possible to find out specifically through a network of people connected to the same file system. Only way appears to be to record those with access to the file when the file was changed.

For a single computer, its just a matter of who was logged in at the time of modification to the file.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.