Log Created files & dir

Hello Gurus,

In my filter driver CREATE dispatch routine .

1>I wish to make a log of all registries, files, directories etc when
they are Created only and not when any existing ones are opened. What
condition I need to check for this?

If ( FILE_CREATED == Irp->IoStatus.Information ) does not seem to work.

Any Ideas ?

regards,
Anurag

You need to check this after the FS driver has
processed the request. Set a completion routine and
check it there.

— Anurag Sarin wrote:

>
> Hello Gurus,
>
> In my filter driver CREATE dispatch routine .
>
> 1>I wish to make a log of all registries, files,
> directories etc when
> they are Created only and not when any existing ones
> are opened. What
> condition I need to check for this?
>
>
> If ( FILE_CREATED == Irp->IoStatus.Information )
> does not seem to work.
>
>
> Any Ideas ?
>
> regards,
> Anurag
>
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

_______________________________
Do you Yahoo!?
Express yourself with Y! Messenger! Free. Download now.
http://messenger.yahoo.com

Thanks for the response. But setting a completion routine will be a
little change of structure for me .
Is their any other way I can differentiate a file is created and not
opened in a dispatch routine.

Regards,
Anurag
-----Original Message-----
From: Randy Cook [mailto:xxxxx@yahoo.com]
Sent: Tuesday, September 28, 2004 8:59 PM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Log Created files & dir

You need to check this after the FS driver has
processed the request. Set a completion routine and
check it there.

— Anurag Sarin wrote:

>
> Hello Gurus,
>
> In my filter driver CREATE dispatch routine .
>
> 1>I wish to make a log of all registries, files,
> directories etc when
> they are Created only and not when any existing ones
> are opened. What
> condition I need to check for this?
>
>
> If ( FILE_CREATED == Irp->IoStatus.Information )
> does not seem to work.
>
>
> Any Ideas ?
>
> regards,
> Anurag
>
>
>
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

_______________________________
Do you Yahoo!?
Express yourself with Y! Messenger! Free. Download now.
http://messenger.yahoo.com


Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@divassoftware.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

The only way to get the return code is in a completion
routine.

In dispatch you could check the parameters passed and
query to see if the file exists or not, but without
checking the return code you really have no idea what
happened. For example, the open/create could fail for
any number of reasons.

— Anurag Sarin wrote:

> Thanks for the response. But setting a completion
> routine will be a
> little change of structure for me .
> Is their any other way I can differentiate a file is
> created and not
> opened in a dispatch routine.
>
> Regards,
> Anurag
> -----Original Message-----
> From: Randy Cook [mailto:xxxxx@yahoo.com]
> Sent: Tuesday, September 28, 2004 8:59 PM
> To: Windows File Systems Devs Interest List
> Subject: Re: [ntfsd] Log Created files & dir
>
>
> You need to check this after the FS driver has
> processed the request. Set a completion routine and
> check it there.
>
> — Anurag Sarin wrote:
>
> >
> > Hello Gurus,
> >
> > In my filter driver CREATE dispatch routine .
> >
> > 1>I wish to make a log of all registries, files,
> > directories etc when
> > they are Created only and not when any existing
> ones
> > are opened. What
> > condition I need to check for this?
> >
> >
> > If ( FILE_CREATED == Irp->IoStatus.Information )
> > does not seem to work.
> >
> >
> > Any Ideas ?
> >
> > regards,
> > Anurag
> >
> >
> >
> >
> >
> >
> > —
> > Questions? First check the IFS FAQ at
> > https://www.osronline.com/article.cfm?id=17
> >
> > You are currently subscribed to ntfsd as: unknown
> > lmsubst tag argument: ‘’
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> >
>
>
>
>
>
> Do you Yahoo!?
> Express yourself with Y! Messenger! Free. Download
> now.
> http://messenger.yahoo.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as:
> xxxxx@divassoftware.com To
> unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown
> lmsubst tag argument: ‘’
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>

___________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com