Hello
I track an opened file and get an FO.
Then when closing, another value of FO is being displayed, though it is w/
same name as the opened file.
Is it possible for the FO to change between open and close?
A simple case:
1.run cmd.exe
2.c:\>type file.txt
file.txt get’s FO1 as a value. On close, file.txt is being closed w/ clean
up as value of FO2.
(No other files are accessing file.txt).
Please advise.
–
Elias
One file object means one open instance of a file. If
you want to track the file, you should instead key
your file name information on FsContext. Do keep in
mind that a FsContext means one stream. On FAT, files
have only one stream, so one FsContext will mean one
file. However, on NTFS a file can have multiple
streams associated with it.
Best regards,
Razvan
— lallous wrote:
> Hello
>
> I track an opened file and get an FO.
> Then when closing, another value of FO is being
> displayed, though it is w/
> same name as the opened file.
>
> Is it possible for the FO to change between open and
> close?
>
> A simple case:
>
> 1.run cmd.exe
> 2.c:>type file.txt
>
> file.txt get’s FO1 as a value. On close, file.txt is
> being closed w/ clean
> up as value of FO2.
>
> (No other files are accessing file.txt).
>
> Please advise.
>
> –
> Elias
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
_______________________________
Do you Yahoo!?
Shop for Back-to-School deals on Yahoo! Shopping.
http://shopping.yahoo.com/backtoschool
Hello Razvan,
Yes, i am counting instances of open files rather than tracking the file
(FsContext).
I want to track a given file object (or a file open instance) from its
creation till the close is issued and the FO is discarded.
Now I wonder, why on create, FO1 appeared but that FO never got closed,
instead an untracked FO was closed.
Why that happened?
–
Elias
“Razvan Hobeanu” wrote in message
news:xxxxx@ntfsd…
> One file object means one open instance of a file. If
> you want to track the file, you should instead key
> your file name information on FsContext. Do keep in
> mind that a FsContext means one stream. On FAT, files
> have only one stream, so one FsContext will mean one
> file. However, on NTFS a file can have multiple
> streams associated with it.
>
> Best regards,
> Razvan
>
> — lallous wrote:
>
>> Hello
>>
>> I track an opened file and get an FO.
>> Then when closing, another value of FO is being
>> displayed, though it is w/
>> same name as the opened file.
>>
>> Is it possible for the FO to change between open and
>> close?
>>
>> A simple case:
>>
>> 1.run cmd.exe
>> 2.c:>type file.txt
>>
>> file.txt get’s FO1 as a value. On close, file.txt is
>> being closed w/ clean
>> up as value of FO2.
>>
>> (No other files are accessing file.txt).
>>
>> Please advise.
>>
>> –
>> Elias
>>
>>
>>
>> —
>> Questions? First check the IFS FAQ at
>> https://www.osronline.com/article.cfm?id=17
>>
>> You are currently subscribed to ntfsd as:
>> xxxxx@yahoo.com
>> To unsubscribe send a blank email to
>> xxxxx@lists.osr.com
You are seeing the cache manager or the memory manager accessing the file.
It creates additional file objects that are not seen via the CREATE API in
order to maintain references to the file while it is mapped.
It is also a better solution (if you are interested in file object tracking)
to monitor the CLEANUP call to get the per-instance “close” on the objects.
The close call is for the final instance of the file to be closed (which is
what you are probably seeing, the memory mapping object being closed).
I hope this helps.
Jamey
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of lallous
Sent: Friday, September 10, 2004 8:51 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] beginner question
Hello
I track an opened file and get an FO.
Then when closing, another value of FO is being displayed, though it is w/
same name as the opened file.
Is it possible for the FO to change between open and close?
A simple case:
1.run cmd.exe
2.c:\>type file.txt
file.txt get’s FO1 as a value. On close, file.txt is being closed w/ clean
up as value of FO2.
(No other files are accessing file.txt).
Please advise.
–
Elias
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
__________ NOD32 1.860 (20040903) Information __________
This message was checked by NOD32 antivirus system.
http://www.nod32.com
> It creates additional file objects that are not seen via the CREATE API in
order to maintain references to the file while it is mapped.
This is so on NTFS, and also for directories (user directory open used for
FindFirstFile has no FCB at all, but the FSD creates internal file object to
cache the directory content).
On FAT usual files, the first open of the file calls CcInitializeCacheMap, and
the cache manager gets a hold on the file object.
The CLEANUP path calls CcUnInitializeCacheMap, but it only schedules the cache
map for death and not kills it immediately.
So, the cache map - and the file object - live long ago after (Tony Mason once
said - hours), till it will be garbage-collected by Cc and the file object will
be destroyed (CLOSE).
This is by design, to retain the cached pages for files which are quickly
closed-reopened.
Another scenario:
hFile = CreateFile();
hSection = CreateFileMapping(hFile);
CloseHandle(hFile);
MapViewOfFile(hSection);
CloseHandle(hSection);
Causes the similar thing. CLEANUP arrives from CloseHandle(hFile), but the file
object is held by MM for long time, and paging IO will still be active on it.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com