I’m trying to track file activity, logging each time a file is opened and subsequently closed.
What I’m seeing is that the same file object is being opened, and then opened again, etc.
As a consequence in a list I’m keeping I have the same file object listed multiple times and in all cases the file object is still open, that is, this is not a case of simply recycling the same fileobjects.
1st, why is this happening? Can I tell that it is happening from the response in the Post Op callback for IRP_MJ_CREATE without tracking this in my own structures?
Eventually each open is seeing matched with a close (I think), but my naive algorithm of building a queue of structures per open files is getting overwhelmed.
Am I hallucinating this whole thing?
Larry
Hello Larry
Am I hallucinating this whole thing?
Yeah, you and your bugz 
Good luck
Lyndon
wrote in message news:xxxxx@ntfsd…
> I’m trying to track file activity, logging each time a file is opened and
> subsequently closed.
> What I’m seeing is that the same file object is being opened, and then
> opened again, etc.
>
> As a consequence in a list I’m keeping I have the same file object listed
> multiple times and in all cases the file object is still open, that is,
> this is not a case of simply recycling the same fileobjects.
> 1st, why is this happening? Can I tell that it is happening from the
> response in the Post Op callback for IRP_MJ_CREATE without tracking this
> in my own structures?
>
> Eventually each open is seeing matched with a close (I think), but my
> naive algorithm of building a queue of structures per open files is
> getting overwhelmed.
>
> Am I hallucinating this whole thing?
>
> Larry
>
>
>
cross poster alert: larrydick = usfinecats
wrote in message news:xxxxx@ntfsd…
> I’m trying to track file activity, logging each time a file is opened and
> subsequently closed.
> What I’m seeing is that the same file object is being opened, and then
> opened again, etc.
>
> As a consequence in a list I’m keeping I have the same file object listed
> multiple times and in all cases the file object is still open, that is,
> this is not a case of simply recycling the same fileobjects.
> 1st, why is this happening? Can I tell that it is happening from the
> response in the Post Op callback for IRP_MJ_CREATE without tracking this
> in my own structures?
>
> Eventually each open is seeing matched with a close (I think), but my
> naive algorithm of building a queue of structures per open files is
> getting overwhelmed.
>
> Am I hallucinating this whole thing?
>
> Larry
>
>
>
Then use a stream handle context and only log it once.
xxxxx@sbcglobal.net wrote:
I’m trying to track file activity, logging each time a file is opened and subsequently closed.
What I’m seeing is that the same file object is being opened, and then opened again, etc.
As a consequence in a list I’m keeping I have the same file object listed multiple times and in all cases the file object is still open, that is, this is not a case of simply recycling the same fileobjects.
1st, why is this happening? Can I tell that it is happening from the response in the Post Op callback for IRP_MJ_CREATE without tracking this in my own structures?
Eventually each open is seeing matched with a close (I think), but my naive algorithm of building a queue of structures per open files is getting overwhelmed.
Am I hallucinating this whole thing?
Larry
Questions? First check the IFS FAQ at https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: matt-martin@tx.rr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com