Users and/or processes managing file system

[samp4ever]

Hi everybody. I'm implementing an application that use FileSystemWatcher to monitor the events of a local File System with C#.

The problem is that I should also know for my application even the user or the process who made a change, an access, created, deleted and so on a file or a directory. FileSystemWatcher just tell me: "there is an event of this type in this file/directory". Doesn't tell me who raise that event.

Is there something in C# giving these information? If not, any idea of how can I do to retrieve it?

Thank you in advance

[makman99]

For files, there is the owner, last access, etc...
When the filesystemwatch goes off, you can get those values using windows api's
If I remember correctly filesystemwatch should also tell you what happened to the file

For who was working with it... You can tell who created it by looking at the owner value of the file.
Is this going to be running over a network or a single computer? Because if it's just a single computer you can just check for who ever is logged in at the time of change.

[Momerath]

Checking who's logged in won't work if the system is accessing the file. There is no real way to check who is accessing a file in C# as it requires hooking into the OS. There is a command you can download from Microsoft called handle that will tell you what process is currently accessing a file (it's a command line tool so you'd have to parse the output), but that doesn't help if the access is faster than you can detect it and call handle.

[samp4ever]

Thanks for the answers.

If I remember correctly filesystemwatch should also tell you what happened to the file

Yes just tell me the kind of event raised: created, deleted, renamed, changed, and is possible to filter to know more exactly what does change mean.

Is this going to be running over a network or a single computer?

Should be a tool running for both on server / local computer. The idea to track the users logged in at the moment of the change could be a good approximation to have some idea and information, even if not exactly what I should need.

There is a command you can download from Microsoft called handle that will tell you what process is currently accessing a file (it's a command line tool so you'd have to parse the output), but that doesn't help if the access is faster than you can detect it and call handle.

Something like this could be good. In your opinion how should I do? Should I start a process with C# and then manage the output? Sure it doesn't work in that case you wrote, cause when the system raise an event with FSW I should check the handle and parse the result so I could have no more this information if the process is faster than the tool..

[makman99]

It seems as though it's not possible to find out specifically through a network of people connected to the same file system. Only way appears to be to record those with access to the file when the file was changed.

For a single computer, its just a matter of who was logged in at the time of modification to the file.