File opened/closed in Windows.

Ace128 has asked for the wisdom of the Perl Monks concerning the following question:

Hey,

I know when a file is read, writen or modified (attributes) using Win32::AdvNotify or PodMasters nice module Win32::ReadDirectoryChanges. However, I wanna know when a file is opened or closed! I've found this:

"How FileMon Works

For the Windows 9x driver, the heart of FileMon is in the virtual device driver, Filevxd.vxd. It is dynamically loaded, and in its initialization it installs a file system filter via the VxD service, IFSMGR_InstallFileSystemApiHook, to insert itself onto the call chain of all file system requests. On Windows NT the heart of FileMon is a file system driver that creates and attaches filter device objects to target file system device objects so that FileMon will see all IRPs and FastIO requests directed at drives. When FileMon sees an open, create or close call, it updates an internal hash table that serves as the mapping between internal file handles and file path names. Whenever it sees calls that are handle based, it looks up the handle in the hash table to obtain the full name for display. If a handle-based access references a file opened before FileMon started, FileMon will fail to find the mapping in its hash table and will simply present the handle's value instead."

Information on accesses is dumped into an ASCII buffer that is periodically copied up to the GUI for it to print in its listbox. "

Using that and just opening a text file it spits out:

18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 7
+7824 Length: 4096    
18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 0
+ Length: 4096    
18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 0
+ Length: 4096    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\test.txt    SUCCESS  
+  Options: Open  Access: All    
18:06:33    System:3564    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_READ*    E:    SUCCESS    Offset: 0
+ Length: 4096    
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_BASIC_INFO    E:\test.txt    
+SUCCESS    Attributes: A    
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    IRP_MJ_QUERY_INFORMATION    E:\test.txt   
+ SUCCESS    FileNameInformation    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    IRP_MJ_CREATE     E:\    SUCCESS    Option
+s: Open Directory  Access: All    
18:06:33    cmd.exe:3564    IRP_MJ_DIRECTORY_CONTROL    E:\    SUCCESS
+    FileBothDirectoryInformation: test.txt    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    FASTIO_QUERY_STANDARD_INFO    E:\test.txt 
+   SUCCESS    Length: 512    
18:06:33    cmd.exe:3564    IRP_MJ_CLEANUP    E:\test.txt    SUCCESS  
+      
18:06:33    cmd.exe:3564    IRP_MJ_CLOSE     E:\test.txt    SUCCESS   
+     
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\    SUCCESS    Att
+ributes: DHSA    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\test.txt    SUCCES
+S    Attributes: A    
18:06:33    cmd.exe:3564    FASTIO_QUERY_OPEN    E:\    SUCCESS    Att
+ributes: DHSA    
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:    SUCCESS    Opt
+ions: Open  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_QUERY_VOLUME_INFORMATION    E: 
+   BUFFER OVERFLOW    FileFsVolumeInformation    
18:06:33    notepad.exe:4008    IOCTL: 0x90120    E:    SUCCESS       
+ 
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    SUC
+CESS    FileNamesInformation    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    NO 
+MORE FILES    FileNamesInformation    
18:06:33    System:4008    IRP_MJ_CLEANUP    E:\    SUCCESS        
18:06:33    System:4008    IRP_MJ_CLOSE     E:\    SUCCESS        
18:06:33    System:4008    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    System:4008    IRP_MJ_CLOSE     E:    SUCCESS        
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: Traverse    
18:06:33    notepad.exe:4008    FSCTL_IS_VOLUME_MOUNTED    E:\    SUCC
+ESS        
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    SUC
+CESS    FileBothDirectoryInformation: test.txt    
18:06:33    notepad.exe:4008    IRP_MJ_CLEANUP    E:\    SUCCESS      
+  
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\    SUCCESS       
+ 
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\test.txt    SUCCE
+SS    Options: Open  Access: All    
18:06:33    System:4008    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\test.txt    SUCCES
+S        
18:06:33    notepad.exe:4008    IRP_MJ_QUERY_VOLUME_INFORMATION    E:\
+test.txt    BUFFER OVERFLOW    FileFsVolumeInformation    
18:06:33    notepad.exe:4008    IRP_MJ_QUERY_INFORMATION    E:\test.tx
+t    BUFFER OVERFLOW    FileAllInformation    
18:06:33    notepad.exe:4008    FASTIO_QUERY_STANDARD_INFO    E:\test.
+txt    SUCCESS    Length: 512    
18:06:33    notepad.exe:4008    IRP_MJ_CLEANUP    E:\test.txt    SUCCE
+SS        
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\test.txt    SUCCES
+S        
18:06:33    System:4    IRP_MJ_QUERY_INFORMATION    E:\test.txt    SUC
+CESS    FileNameInformation    
18:06:33    System:4    IRP_MJ_CREATE     E:    SUCCESS    Options: Op
+en  Access: All    
18:06:33    System:4    IRP_MJ_QUERY_VOLUME_INFORMATION    E:    BUFFE
+R OVERFLOW    FileFsVolumeInformation    
18:06:33    System:4    IRP_MJ_CLEANUP    E:    SUCCESS        
18:06:33    System:4    IRP_MJ_CLOSE     E:    SUCCESS        
18:06:33    notepad.exe:4008    FASTIO_QUERY_OPEN    E:\test.txt    SU
+CCESS    Attributes: A    
18:06:33    notepad.exe:4008    IRP_MJ_CREATE     E:\    SUCCESS    Op
+tions: Open Directory  Access: All    
18:06:33    notepad.exe:4008    IRP_MJ_DIRECTORY_CONTROL    E:\    SUC
+CESS    FileBothDirectoryInformation: test.txt    
18:06:33    notepad.exe:4008    IRP_MJ_CLEANUP    E:\    SUCCESS      
+  
18:06:33    notepad.exe:4008    IRP_MJ_CLOSE     E:\    SUCCESS       
+ 
18:06:35    notepad.exe:4008    IRP_MJ_CLEANUP    E:\    SUCCESS      
+  
18:06:35    notepad.exe:4008    IRP_MJ_CLOSE     E:\    SUCCESS
[download]

I also found this

So, anyone here that can help me out? I'm not sure where to start (and yes, I wanna do this in Perl, using Win32::API or similar I suppose :) ).

Thanks,
Ace

edit: g0n - replaced pre tags with code tags

Comment on File opened/closed in Windows. Download Code

Replies are listed 'Best First'.
Re: File opened/closed in Windows. by zer (Deacon) on Mar 16, 2006 at 19:12 UTC
are you monitoring this file? 18:06:33 notepad.exe:4008 IRP_MJ_CLOSE E:\test.txt SUCCES Looks like is the system call used to close the file. so you would want to monitor the pid's. when you come across a FASTIO_QUERY_OPEN or a IRP_MJ_CLOSE it would open and close. I hope this is what you need to know, i am having some difficulty trying to understand what you are trying to do.	[reply]
Re^2: File opened/closed in Windows. by Ace128 (Hermit) on Mar 16, 2006 at 23:58 UTC
I wanna be notified when a file is opened or closed somehow. It should be archiveable somehow using the Win32 (::API) module, but first I need to know what functions to use in Windows. The other modules I mentioned dont have that support (since its not in the Windows API for ReadDirectoryChangesW). However, it _seems_ possible, but Im not sure how. Linux INotify has it easy, since it has IN_CLOSE (A file has been closed) and IN_OPEN (file closed) support.	[reply]
Re^3: File opened/closed in Windows. by Anonymous Monk on Mar 17, 2006 at 00:30 UTC
You apparently know how to use Win32::API, so once you know which apis to call, you'll know how to do it. Therefore your problem is not a Perl problem, but a Win32::API problem, and there are better forums for those than PM.	[reply]
Re: File opened/closed in Windows. by Marza (Vicar) on Mar 16, 2006 at 21:55 UTC
What are you trying to accomplish? Filemon can dump out tons of messages. Especially if the system runs jobs.	[reply]
Re^2: File opened/closed in Windows. by Ace128 (Hermit) on Mar 17, 2006 at 00:01 UTC
I wanna be notified when a file is opened or closed somehow. The goal is to create some kind of callback, which is called when a file in windows is opened or closed. After that I can do fonky stuff, because if a file is closed, its not locked! (although the filemon spits out ALOT, so seems like a file is opened and closed alot...)	[reply]
Re^3: File opened/closed in Windows. by Marza (Vicar) on Mar 17, 2006 at 01:54 UTC
Only one file? If that is the case; I don't think filemon is the way to go as it logs the filesystem so that is many opens and closes you have to contend with. This sounds like a security issue? Have you thought about running a service and a routine to do that? You could look at Roths Dirmon script and get an idea. This script monitors a directory for adds and deletes. May not be what you are looking for but I think filemon will be a moster if I understand what you are after. We have used filemon but we ran it and greped out the stuff we wanted.....	[reply]
Re^4: File opened/closed in Windows. by Ace128 (Hermit) on Mar 17, 2006 at 06:30 UTC
Re: File opened/closed in Windows. by Anonymous Monk on Mar 17, 2006 at 07:14 UTC
dfaure made Win32::ReadDirectoryChangesW	[reply]
Re^2: File opened/closed in Windows. by Ace128 (Hermit) on Mar 18, 2006 at 05:09 UTC
Oh, sh-t. I thought his nick was "PodMaster"! Well, that one I have. That doesnt solve the open/close problem.	[reply]