multiple file create requests on each operation

NTFSD
1

Hello,
Im writing a minifilter driver based on the DDK minifilter example.

listening on IRP_MJ_CREATE.

On each file operation of the user i get 5 or 6 events in the driver.
(the callbacks are called on each one ofcourse)

Is there anyway to reduce this number of calls to just one and ignore
the rest as long as it the same file?

Thanks,

2

How are you “creating or opening the file” if you are doing this from
explorer or some of the command line utilities they are actually doing
separate operations. Ignore any of them and nothing works.

Don Burn (MVP, Windows DKD)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr

“Dani” wrote in message news:xxxxx@ntfsd:

> Hello,
> Im writing a minifilter driver based on the DDK minifilter example.
>
> listening on IRP_MJ_CREATE.
>
> On each file operation of the user i get 5 or 6 events in the driver.
> (the callbacks are called on each one ofcourse)
>
> Is there anyway to reduce this number of calls to just one and ignore
> the rest as long as it the same file?
>
>
> Thanks,

3

I think this depends on what your minifilter is doing for each
IRP_MJ_CREATE.

Anyway, there is no mechanism to tell FltMgr to not call your callback for
subsequent requests (other than detaching from a volume). Once you register
a callback you will receive all preOp callbacks for that operation on that
volume. Whether the postOp callback is called depends on the status you
return from your preOp. So if you don’t want to do processing for subsequent
IRP_MJ_CREATEs for the same file you’re going to have to define what that
means and implement it in your code.

Finally, I’d like to point out that in your preCreate callback it is
impossible to know whether an IRP_MJ_CREATE is for a file you’ve already
seen or not. The fact that the name is the same is not enough.

Thanks,
Alex.