Re[2]: RE: Cannot observe IRP_MJ_READ for notepad?

> It needs to look into the implentation of filemon and minispy for

the reason. I am just wondering some one already knew the reason?

The file stays in the cache since the file has been initially open.
The create request has not been observed by the fltmgr,
so it cannot find the name in the cache.

L.