Filter Manager Cache

NTDEV
1

Approximately how long does filename cache in the Filter Manager live
for? What is the max size of this cache pool?

I ask because I would like to use FltGetFileNameQueryMethod with
FLT_FILE_NAME_QUERY_CACHE_ONLY
instead of a hash to deal with multiple creates on a single file.

Matt

2

Excuse me, I meant *FltGetFileNameInformation *not FltGetFileNameQueryMethod

MM wrote:

Approximately how long does filename cache in the Filter Manager live
for? What is the max size of this cache pool?

I ask because I would like to use FltGetFileNameQueryMethod with
FLT_FILE_NAME_QUERY_CACHE_ONLY
instead of a hash to deal with multiple creates on a single file.

Matt

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@comcast.net
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

This question actually belongs over on ntfsd rather than ntdev. However, it
is an interesting question, and I’m working on a minifilter at the moment,
so here is what I think is going on.

First: as the implementation of the file name cache is undocumented your
minifilter should not rely on any such undocumented implementation details.

Ok, I’ll stop preaching. I don’t think the file name cache works that way
(time or sized based) at all. I think the name cache node for a specific
stream is persistent while any mini-filter has a reference open on the name
structure, and is deleted when the last reference to that name is released.
I could be wrong. In other words, the cache lifetime of a name is generally
brief but under your control in terms of keeping it persistent while you are
processing a specific file.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of MM
Sent: Sunday, January 29, 2006 6:30 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Filter Manager Cache

Approximately how long does filename cache in the Filter
Manager live for? What is the max size of this cache pool?

I ask because I would like to use FltGetFileNameQueryMethod
with FLT_FILE_NAME_QUERY_CACHE_ONLY instead of a hash to deal
with multiple creates on a single file.

Matt

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com